Edit tour

Linux Analysis Report
nigga.mips.elf

Overview

General Information

Sample name:nigga.mips.elf
Analysis ID:1676365
MD5:ba97a534617226101906b66c33286025
SHA1:56d87849cfaca430808696ea510f9d8b6b8d2856
SHA256:03f25cb9c6e38b79bb1717d58c2c0282ff0f9fc7b3099240d51bb1b580ad2e3c
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:76
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1676365
Start date and time:2025-04-28 17:26:59 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 47s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:nigga.mips.elf
Detection:MAL
Classification:mal76.spre.troj.linELF@0/0@0/0
Command:/tmp/nigga.mips.elf
PID:5486
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:
  • system is lnxubuntu20
  • wrapper-2.0 (PID: 5499, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
  • wrapper-2.0 (PID: 5500, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
  • wrapper-2.0 (PID: 5501, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
  • wrapper-2.0 (PID: 5502, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
    • xfpm-power-backlight-helper (PID: 5544, Parent: 5502, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness
  • wrapper-2.0 (PID: 5503, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
  • wrapper-2.0 (PID: 5504, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
  • xfconfd (PID: 5541, Parent: 5540, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
  • systemd New Fork (PID: 5550, Parent: 2935)
  • xfce4-notifyd (PID: 5550, Parent: 2935, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
  • dash New Fork (PID: 5551, Parent: 3583)
  • rm (PID: 5551, Parent: 3583, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.gaWUt98Qu2 /tmp/tmp.uVEzpmVIJI /tmp/tmp.hWQjQFAtEL
  • dash New Fork (PID: 5552, Parent: 3583)
  • cat (PID: 5552, Parent: 3583, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.gaWUt98Qu2
  • dash New Fork (PID: 5553, Parent: 3583)
  • head (PID: 5553, Parent: 3583, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5554, Parent: 3583)
  • tr (PID: 5554, Parent: 3583, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5555, Parent: 3583)
  • cut (PID: 5555, Parent: 3583, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5556, Parent: 3583)
  • cat (PID: 5556, Parent: 3583, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.gaWUt98Qu2
  • dash New Fork (PID: 5557, Parent: 3583)
  • head (PID: 5557, Parent: 3583, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10
  • dash New Fork (PID: 5558, Parent: 3583)
  • tr (PID: 5558, Parent: 3583, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037
  • dash New Fork (PID: 5559, Parent: 3583)
  • cut (PID: 5559, Parent: 3583, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80
  • dash New Fork (PID: 5560, Parent: 3583)
  • rm (PID: 5560, Parent: 3583, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.gaWUt98Qu2 /tmp/tmp.uVEzpmVIJI /tmp/tmp.hWQjQFAtEL
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
nigga.mips.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    nigga.mips.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0xf7d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf7e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf7f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf80c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf85c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf870:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf884:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf898:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf8ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf8c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf94c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    nigga.mips.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0xfd28:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    nigga.mips.elfMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
    • 0x1160d:$x5: .mdebug.abi32
    • 0x10520:$s1: LCOGQGPTGP
    SourceRuleDescriptionAuthorStrings
    5490.1.00007fd198400000.00007fd198411000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      5490.1.00007fd198400000.00007fd198411000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xf7d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf7e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf7f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf80c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf85c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf870:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf884:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf898:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf8ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf8c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf94c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      5490.1.00007fd198400000.00007fd198411000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0xfd28:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      5486.1.00007fd198400000.00007fd198411000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        5486.1.00007fd198400000.00007fd198411000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0xf7d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf7e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf7f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf80c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf85c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf870:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf884:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf898:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf8ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf8c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf8d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf8e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf8fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf910:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf924:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf938:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf94c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xf960:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        Click to see the 10 entries
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: nigga.mips.elfAvira: detected
        Source: nigga.mips.elfReversingLabs: Detection: 63%
        Source: nigga.mips.elfVirustotal: Detection: 60%Perma Link
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.79.109
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.79.109
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.79.109
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.79.109
        Source: unknownTCP traffic detected without corresponding DNS query: 87.121.79.109
        Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
        Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
        Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
        Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
        Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
        Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
        Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
        Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
        Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
        Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
        Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
        Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/noneAccept: */*Accept-Encoding: identityHost: motd.ubuntu.comConnection: Keep-Alive
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50540
        Source: unknownNetwork traffic detected: HTTP traffic on port 54590 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 50540 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 54590

        System Summary

        barindex
        Source: nigga.mips.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: nigga.mips.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: nigga.mips.elf, type: SAMPLEMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
        Source: 5490.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5490.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 5486.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5486.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 5488.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 5488.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: nigga.mips.elf PID: 5486, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: nigga.mips.elf PID: 5486, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: nigga.mips.elf PID: 5490, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: nigga.mips.elf PID: 5490, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3104, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3161, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3162, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3163, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3164, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3165, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3170, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3182, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3208, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3212, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3163, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3164, result: no such processJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3165, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3170, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3182, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3208, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3212, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5488, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5499, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5500, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5501, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5502, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5503, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5504, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5541, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5550, result: successfulJump to behavior
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3104, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3161, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3162, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3163, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3164, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3165, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3170, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3182, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3208, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5488)SIGKILL sent: pid: 3212, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3163, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3164, result: no such processJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3165, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3170, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3182, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3208, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 3212, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5488, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5499, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5500, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5501, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5502, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5503, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5504, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5541, result: successfulJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)SIGKILL sent: pid: 5550, result: successfulJump to behavior
        Source: nigga.mips.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: nigga.mips.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: nigga.mips.elf, type: SAMPLEMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
        Source: 5490.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5490.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 5486.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5486.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 5488.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 5488.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: nigga.mips.elf PID: 5486, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: nigga.mips.elf PID: 5486, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: nigga.mips.elf PID: 5490, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: nigga.mips.elf PID: 5490, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: classification engineClassification label: mal76.spre.troj.linELF@0/0@0/0
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5499)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5500)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5501)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5502)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /home/saturnino/.fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/X11/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /home/saturnino/.cacheJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /home/saturnino/.localJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Directory: /home/saturnino/.configJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /home/saturnino/.fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/X11/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5541)Directory: /home/saturnino/.cacheJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5541)Directory: /home/saturnino/.localJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5541)Directory: /home/saturnino/.configJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5541)Directory: /home/saturnino/.configJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5550)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/5541/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3760/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3122/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3638/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3117/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3114/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3630/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3631/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3632/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/914/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/518/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/519/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/917/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/5419/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/5550/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/5552/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/5553/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/5554/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3134/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3375/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3132/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3095/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1745/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1866/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1588/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/884/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1982/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/765/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3246/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/767/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/800/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1906/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/802/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/803/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1748/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/5428/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3420/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1482/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/490/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1480/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1755/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1238/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1875/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/2964/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3413/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1751/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1872/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/2961/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1475/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/656/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/778/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/657/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/5555/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/658/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/659/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/418/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/936/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/419/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/816/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1879/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1891/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3310/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3153/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/780/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/5293/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/660/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1921/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/783/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1765/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/2974/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1400/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1884/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3424/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/2972/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3147/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/2970/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1881/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3146/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3300/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3665/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1805/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1925/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1804/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1648/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1922/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3429/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/5464/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/5465/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3442/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3165/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3164/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3163/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3162/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/790/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3161/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/792/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/793/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/672/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1930/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/674/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/795/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/3315/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1411/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/2984/cmdlineJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5492)File opened: /proc/1410/cmdlineJump to behavior
        Source: /usr/bin/dash (PID: 5551)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.gaWUt98Qu2 /tmp/tmp.uVEzpmVIJI /tmp/tmp.hWQjQFAtELJump to behavior
        Source: /usr/bin/dash (PID: 5560)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.gaWUt98Qu2 /tmp/tmp.uVEzpmVIJI /tmp/tmp.hWQjQFAtELJump to behavior
        Source: /tmp/nigga.mips.elf (PID: 5486)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5499)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5500)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5501)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5502)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5503)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5504)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5550)Queries kernel information via 'uname': Jump to behavior
        Source: nigga.mips.elf, 5486.1.00005560dbc9a000.00005560dbd21000.rw-.sdmp, nigga.mips.elf, 5488.1.00005560dbc9a000.00005560dbd21000.rw-.sdmp, nigga.mips.elf, 5490.1.00005560dbc9a000.00005560dbd21000.rw-.sdmpBinary or memory string: `U!/etc/qemu-binfmt/mips
        Source: nigga.mips.elf, 5486.1.00007fff03f62000.00007fff03f83000.rw-.sdmp, nigga.mips.elf, 5488.1.00007fff03f62000.00007fff03f83000.rw-.sdmp, nigga.mips.elf, 5490.1.00007fff03f62000.00007fff03f83000.rw-.sdmpBinary or memory string: Wx86_64/usr/bin/qemu-mips/tmp/nigga.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nigga.mips.elf
        Source: nigga.mips.elf, 5486.1.00005560dbc9a000.00005560dbd21000.rw-.sdmp, nigga.mips.elf, 5488.1.00005560dbc9a000.00005560dbd21000.rw-.sdmp, nigga.mips.elf, 5490.1.00005560dbc9a000.00005560dbd21000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
        Source: nigga.mips.elf, 5486.1.00007fff03f62000.00007fff03f83000.rw-.sdmp, nigga.mips.elf, 5488.1.00007fff03f62000.00007fff03f83000.rw-.sdmp, nigga.mips.elf, 5490.1.00007fff03f62000.00007fff03f83000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: nigga.mips.elf, type: SAMPLE
        Source: Yara matchFile source: 5490.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5486.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5488.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: nigga.mips.elf PID: 5486, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: nigga.mips.elf PID: 5490, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: nigga.mips.elf, type: SAMPLE
        Source: Yara matchFile source: 5490.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5486.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 5488.1.00007fd198400000.00007fd198411000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: nigga.mips.elf PID: 5486, type: MEMORYSTR
        Source: Yara matchFile source: Process Memory Space: nigga.mips.elf PID: 5490, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
        Hidden Files and Directories
        1
        OS Credential Dumping
        11
        Security Software Discovery
        Remote ServicesData from Local System1
        Encrypted Channel
        Exfiltration Over Other Network Medium1
        Service Stop
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
        File Deletion
        LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Non-Application Layer Protocol
        Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
        Application Layer Protocol
        Automated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
        Ingress Tool Transfer
        Traffic DuplicationData Destruction
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1676365 Sample: nigga.mips.elf Startdate: 28/04/2025 Architecture: LINUX Score: 76 26 87.121.79.109, 443, 54590 NETERRA-ASBG Bulgaria 2->26 28 34.243.160.129, 443, 50540 AMAZON-02US United States 2->28 32 Malicious sample detected (through community Yara rule) 2->32 34 Antivirus / Scanner detection for submitted sample 2->34 36 Multi AV Scanner detection for submitted file 2->36 38 Yara detected Mirai 2->38 8 nigga.mips.elf 2->8         started        10 xfce4-panel wrapper-2.0 2->10         started        12 xfce4-panel wrapper-2.0 2->12         started        14 16 other processes 2->14 signatures3 process4 process5 16 nigga.mips.elf 8->16         started        18 nigga.mips.elf 8->18         started        21 wrapper-2.0 xfpm-power-backlight-helper 10->21         started        signatures6 23 nigga.mips.elf 16->23         started        30 Sample tries to kill multiple processes (SIGKILL) 18->30 process7 signatures8 40 Sample tries to kill multiple processes (SIGKILL) 23->40

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        SourceDetectionScannerLabelLink
        nigga.mips.elf64%ReversingLabsLinux.Worm.Mirai
        nigga.mips.elf60%VirustotalBrowse
        nigga.mips.elf100%AviraEXP/ELF.Agent.J.8
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches

        Download Network PCAP: filteredfull

        No contacted domains info
        NameMaliciousAntivirus DetectionReputation
        https://motd.ubuntu.com/false
          high
          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs
          IPDomainCountryFlagASNASN NameMalicious
          34.243.160.129
          unknownUnited States
          16509AMAZON-02USfalse
          87.121.79.109
          unknownBulgaria
          34224NETERRA-ASBGfalse
          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          34.243.160.129na.elfGet hashmaliciousPrometeiBrowse
            Space.sh4.elfGet hashmaliciousUnknownBrowse
              x86.elfGet hashmaliciousUnknownBrowse
                boatnet.arm.elfGet hashmaliciousMiraiBrowse
                  Aqua.dbg.elfGet hashmaliciousAquabotBrowse
                    na.elfGet hashmaliciousPrometeiBrowse
                      na.elfGet hashmaliciousPrometeiBrowse
                        gmpsl.elfGet hashmaliciousMiraiBrowse
                          na.elfGet hashmaliciousPrometeiBrowse
                            lol.mips.elfGet hashmaliciousUnknownBrowse
                              87.121.79.109nigga.x86.elfGet hashmaliciousMiraiBrowse
                                No context
                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                AMAZON-02USboatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                • 54.171.230.55
                                https://click.pstmrk.it/3s/app.7shifts.com%2Fusers%2Faccept_invite%3Fpage%3Dlanding%26token%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImp0aSI6IjkzYjNhNmUxZmIwZDU1ZjNiZjI3MDVmNzU3MDJmZSJ9.eyJpc3MiOiJodHRwczovL2FwcC43c2hpZnRzLmNvbSIsImF1ZCI6Imh0dHBzOi8vYXBwLjdzaGlmdHMuY29tIiwianRpIjoiOTNiM2E2ZTFmYjBkNTVmM2JmMjcwNWY3NTcwMmZlIiwiaWF0IjoxNzQ1NzgzMzY3LjUwOTEyNCwibmJmIjoxNzQ1NzgzMzY3LjUwOTEyNCwiZXhwIjoxNzQ2Mzg4MTY3LjUwOTEyNCwiaW52aXRlZV9maXJzdG5hbWUiOiJBaW1lZSIsImludml0ZWVfdXNlcl9pZCI6OTcyNzA1MywiY29tcGFueV9uYW1lIjoiQ2lubmFib24vQXVudGllIEFubmUncy9DYXJ2ZWwiLCJpbnZpdGVyX2ZpcnN0bmFtZSI6Ik5payIsIm5ld19jb21wYW55IjpudWxsfQ.G9r6GZ87g_p0kzvq5QaW966qEJ_zEH0a306UHS8bmeg/oFE/5va8AQ/AQ/f7b1ae26-f2a5-474e-b3c7-56cc3c2a2ff2/1/7HYARTZ6YbGet hashmaliciousUnknownBrowse
                                • 3.147.207.177
                                na.elfGet hashmaliciousPrometeiBrowse
                                • 34.249.145.219
                                na.elfGet hashmaliciousPrometeiBrowse
                                • 34.249.145.219
                                FW_ Final Reminder Before Maintenance Day From Proofpoint, Inc.emlGet hashmaliciousUnknownBrowse
                                • 3.163.125.102
                                https://zk.ycumql.es/yZHj/Get hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                • 13.226.210.95
                                http://sprayfoamsys.comGet hashmaliciousUnknownBrowse
                                • 13.33.21.118
                                mqi686.elfGet hashmaliciousMiraiBrowse
                                • 54.168.123.176
                                na.elfGet hashmaliciousPrometeiBrowse
                                • 34.243.160.129
                                mqar4.elfGet hashmaliciousMiraiBrowse
                                • 34.249.145.219
                                NETERRA-ASBGnigga.x86.elfGet hashmaliciousMiraiBrowse
                                • 87.121.79.109
                                awb_bl_invoice_delivery.lnkGet hashmaliciousBatch Injector, XWormBrowse
                                • 87.121.79.81
                                mpsl.elfGet hashmaliciousUnknownBrowse
                                • 212.73.131.238
                                8191032732_1740264845.vbsGet hashmaliciousUnknownBrowse
                                • 87.121.79.103
                                Document-00123.lnkGet hashmaliciousBatch Injector, MSIL Logger, MassLogger RATBrowse
                                • 87.121.79.107
                                splsh4.elfGet hashmaliciousUnknownBrowse
                                • 94.156.42.199
                                hoho.arm.elfGet hashmaliciousUnknownBrowse
                                • 212.73.131.222
                                sh4.elfGet hashmaliciousUnknownBrowse
                                • 87.121.79.101
                                mips.elfGet hashmaliciousUnknownBrowse
                                • 87.121.79.101
                                ppc.elfGet hashmaliciousUnknownBrowse
                                • 87.121.79.101
                                No context
                                No context
                                No created / dropped files found
                                File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
                                Entropy (8bit):5.380791583106674
                                TrID:
                                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                File name:nigga.mips.elf
                                File size:71'716 bytes
                                MD5:ba97a534617226101906b66c33286025
                                SHA1:56d87849cfaca430808696ea510f9d8b6b8d2856
                                SHA256:03f25cb9c6e38b79bb1717d58c2c0282ff0f9fc7b3099240d51bb1b580ad2e3c
                                SHA512:a111317757baf75a983130c1f1a2c0dfd02b8fe1bdb65b9413111550d2a21f235e1d883256a29fc774deaa9d4e9a7cc4908e4be8a8a1d6d0a97b3a6a42a0dac2
                                SSDEEP:768:ulz7jMctUaHXUaHWVf2VfM7dVTquCJ7fMctl1d46v5ZMt3Nw6sTQs5otP5fK5tdZ:m7sr5e7biGZiw6sEo5tdLcHzERsS
                                TLSH:DB63940E7E259FBDFED9463487B78E159A4833D627A1C582E16CDA012D7034E340BFA8
                                File Content Preview:.ELF.....................@.`...4.........4. ...(.............@...@.....`...`.................E...E..................dt.Q............................<...'......!'.......................<...'......!... ....'9... ......................<...'..x...!........'9.

                                ELF header

                                Class:ELF32
                                Data:2's complement, big endian
                                Version:1 (current)
                                Machine:MIPS R3000
                                Version Number:0x1
                                Type:EXEC (Executable file)
                                OS/ABI:UNIX - System V
                                ABI Version:0
                                Entry Point Address:0x400260
                                Flags:0x1007
                                ELF Header Size:52
                                Program Header Offset:52
                                Program Header Size:32
                                Number of Program Headers:3
                                Section Header Offset:71196
                                Section Header Size:40
                                Number of Section Headers:13
                                Header String Table Index:12
                                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                NULL0x00x00x00x00x0000
                                .initPROGBITS0x4000940x940x8c0x00x6AX004
                                .textPROGBITS0x4001200x1200xf6500x00x6AX0016
                                .finiPROGBITS0x40f7700xf7700x5c0x00x6AX004
                                .rodataPROGBITS0x40f7d00xf7d00x11900x00x2A0016
                                .ctorsPROGBITS0x4510000x110000x80x00x3WA004
                                .dtorsPROGBITS0x4510080x110080x80x00x3WA004
                                .dataPROGBITS0x4510200x110200x2500x00x3WA0016
                                .gotPROGBITS0x4512700x112700x3540x40x10000003WAp0016
                                .sbssNOBITS0x4515c40x115c40x140x00x10000003WAp004
                                .bssNOBITS0x4515e00x115c40x3280x00x3WA0016
                                .mdebug.abi32PROGBITS0x6660x115c40x00x00x0001
                                .shstrtabSTRTAB0x00x115c40x570x00x0001
                                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                LOAD0x00x4000000x4000000x109600x109605.48870x5R E0x10000.init .text .fini .rodata
                                LOAD0x110000x4510000x4510000x5c40x9083.80650x6RW 0x10000.ctors .dtors .data .got .sbss .bss
                                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                Download Network PCAP: filteredfull

                                TimestampSource PortDest PortSource IPDest IP
                                Apr 28, 2025 17:28:46.462088108 CEST54590443192.168.2.1387.121.79.109
                                Apr 28, 2025 17:28:46.462131977 CEST4435459087.121.79.109192.168.2.13
                                Apr 28, 2025 17:28:46.462186098 CEST54590443192.168.2.1387.121.79.109
                                Apr 28, 2025 17:28:46.497728109 CEST54590443192.168.2.1387.121.79.109
                                Apr 28, 2025 17:28:46.497744083 CEST4435459087.121.79.109192.168.2.13
                                Apr 28, 2025 17:28:46.497862101 CEST54590443192.168.2.1387.121.79.109
                                Apr 28, 2025 17:28:46.497867107 CEST4435459087.121.79.109192.168.2.13
                                Apr 28, 2025 17:28:53.309854984 CEST54590443192.168.2.1387.121.79.109
                                Apr 28, 2025 17:28:53.352277994 CEST4435459087.121.79.109192.168.2.13
                                Apr 28, 2025 17:29:00.194248915 CEST50540443192.168.2.1334.243.160.129
                                Apr 28, 2025 17:29:00.194303036 CEST4435054034.243.160.129192.168.2.13
                                Apr 28, 2025 17:29:00.194380999 CEST50540443192.168.2.1334.243.160.129
                                Apr 28, 2025 17:29:00.195245981 CEST50540443192.168.2.1334.243.160.129
                                Apr 28, 2025 17:29:00.195276022 CEST4435054034.243.160.129192.168.2.13
                                Apr 28, 2025 17:29:03.894747972 CEST4435054034.243.160.129192.168.2.13
                                Apr 28, 2025 17:29:03.894845963 CEST50540443192.168.2.1334.243.160.129
                                Apr 28, 2025 17:29:03.895651102 CEST50540443192.168.2.1334.243.160.129
                                Apr 28, 2025 17:29:03.895675898 CEST4435054034.243.160.129192.168.2.13
                                Apr 28, 2025 17:29:03.895757914 CEST50540443192.168.2.1334.243.160.129
                                Apr 28, 2025 17:29:03.895765066 CEST4435054034.243.160.129192.168.2.13
                                Apr 28, 2025 17:29:03.896512032 CEST4435054034.243.160.129192.168.2.13
                                Apr 28, 2025 17:29:03.896593094 CEST50540443192.168.2.1334.243.160.129
                                Apr 28, 2025 17:29:04.195092916 CEST4435054034.243.160.129192.168.2.13
                                Apr 28, 2025 17:29:04.195359945 CEST50540443192.168.2.1334.243.160.129
                                Apr 28, 2025 17:29:04.195415020 CEST4435054034.243.160.129192.168.2.13
                                Apr 28, 2025 17:29:04.195471048 CEST50540443192.168.2.1334.243.160.129
                                Apr 28, 2025 17:29:04.199265957 CEST50540443192.168.2.1334.243.160.129
                                Apr 28, 2025 17:29:04.199491978 CEST4435054034.243.160.129192.168.2.13
                                Apr 28, 2025 17:29:04.199547052 CEST50540443192.168.2.1334.243.160.129
                                • motd.ubuntu.com
                                Session IDSource IPSource PortDestination IPDestination Port
                                0192.168.2.135054034.243.160.129443
                                TimestampBytes transferredDirectionData
                                2025-04-28 15:29:03 UTC249OUTGET / HTTP/1.1
                                User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none
                                Accept: */*
                                Accept-Encoding: identity
                                Host: motd.ubuntu.com
                                Connection: Keep-Alive
                                2025-04-28 15:29:04 UTC308INHTTP/1.1 200 OK
                                Date: Mon, 28 Apr 2025 15:29:04 GMT
                                Server: Apache/2.4.18 (Ubuntu)
                                Last-Modified: Tue, 01 Apr 2025 23:15:26 GMT
                                ETag: "d8-631bfb6444b92"
                                Accept-Ranges: bytes
                                Content-Length: 216
                                Vary: Accept-Encoding
                                Keep-Alive: timeout=5, max=100
                                Connection: Keep-Alive
                                Content-Type: text/plain
                                2025-04-28 15:29:04 UTC216INData Raw: 20 2a 20 53 74 72 69 63 74 6c 79 20 63 6f 6e 66 69 6e 65 64 20 4b 75 62 65 72 6e 65 74 65 73 20 6d 61 6b 65 73 20 65 64 67 65 20 61 6e 64 20 49 6f 54 20 73 65 63 75 72 65 2e 20 4c 65 61 72 6e 20 68 6f 77 20 4d 69 63 72 6f 4b 38 73 0a 20 20 20 6a 75 73 74 20 72 61 69 73 65 64 20 74 68 65 20 62 61 72 20 66 6f 72 20 65 61 73 79 2c 20 72 65 73 69 6c 69 65 6e 74 20 61 6e 64 20 73 65 63 75 72 65 20 4b 38 73 20 63 6c 75 73 74 65 72 20 64 65 70 6c 6f 79 6d 65 6e 74 2e 0a 0a 20 20 20 68 74 74 70 73 3a 2f 2f 75 62 75 6e 74 75 2e 63 6f 6d 2f 65 6e 67 61 67 65 2f 73 65 63 75 72 65 2d 6b 75 62 65 72 6e 65 74 65 73 2d 61 74 2d 74 68 65 2d 65 64 67 65 0a
                                Data Ascii: * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s just raised the bar for easy, resilient and secure K8s cluster deployment. https://ubuntu.com/engage/secure-kubernetes-at-the-edge


                                System Behavior

                                Start time (UTC):15:28:45
                                Start date (UTC):28/04/2025
                                Path:/tmp/nigga.mips.elf
                                Arguments:/tmp/nigga.mips.elf
                                File size:5777432 bytes
                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                Start time (UTC):15:28:45
                                Start date (UTC):28/04/2025
                                Path:/tmp/nigga.mips.elf
                                Arguments:-
                                File size:5777432 bytes
                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                Start time (UTC):15:28:45
                                Start date (UTC):28/04/2025
                                Path:/tmp/nigga.mips.elf
                                Arguments:-
                                File size:5777432 bytes
                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                Start time (UTC):15:28:45
                                Start date (UTC):28/04/2025
                                Path:/tmp/nigga.mips.elf
                                Arguments:-
                                File size:5777432 bytes
                                MD5 hash:0083f1f0e77be34ad27f849842bbb00c

                                Start time (UTC):15:28:50
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/xfce4-panel
                                Arguments:-
                                File size:375768 bytes
                                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                Start time (UTC):15:28:50
                                Start date (UTC):28/04/2025
                                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
                                File size:35136 bytes
                                MD5 hash:ac0b8a906f359a8ae102244738682e76

                                Start time (UTC):15:28:50
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/xfce4-panel
                                Arguments:-
                                File size:375768 bytes
                                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                Start time (UTC):15:28:50
                                Start date (UTC):28/04/2025
                                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
                                File size:35136 bytes
                                MD5 hash:ac0b8a906f359a8ae102244738682e76

                                Start time (UTC):15:28:50
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/xfce4-panel
                                Arguments:-
                                File size:375768 bytes
                                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                Start time (UTC):15:28:50
                                Start date (UTC):28/04/2025
                                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
                                File size:35136 bytes
                                MD5 hash:ac0b8a906f359a8ae102244738682e76

                                Start time (UTC):15:28:50
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/xfce4-panel
                                Arguments:-
                                File size:375768 bytes
                                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                Start time (UTC):15:28:50
                                Start date (UTC):28/04/2025
                                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
                                File size:35136 bytes
                                MD5 hash:ac0b8a906f359a8ae102244738682e76

                                Start time (UTC):15:28:59
                                Start date (UTC):28/04/2025
                                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                Arguments:-
                                File size:35136 bytes
                                MD5 hash:ac0b8a906f359a8ae102244738682e76

                                Start time (UTC):15:28:59
                                Start date (UTC):28/04/2025
                                Path:/usr/sbin/xfpm-power-backlight-helper
                                Arguments:/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
                                File size:14656 bytes
                                MD5 hash:3d221ad23f28ca3259f599b1664e2427

                                Start time (UTC):15:28:50
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/xfce4-panel
                                Arguments:-
                                File size:375768 bytes
                                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                Start time (UTC):15:28:50
                                Start date (UTC):28/04/2025
                                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
                                File size:35136 bytes
                                MD5 hash:ac0b8a906f359a8ae102244738682e76

                                Start time (UTC):15:28:50
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/xfce4-panel
                                Arguments:-
                                File size:375768 bytes
                                MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                Start time (UTC):15:28:50
                                Start date (UTC):28/04/2025
                                Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
                                File size:35136 bytes
                                MD5 hash:ac0b8a906f359a8ae102244738682e76

                                Start time (UTC):15:28:59
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/dbus-daemon
                                Arguments:-
                                File size:249032 bytes
                                MD5 hash:3089d47e3f3ab84cd81c48fd406d7a8c

                                Start time (UTC):15:28:59
                                Start date (UTC):28/04/2025
                                Path:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                                File size:112880 bytes
                                MD5 hash:4c7a0d6d258bb970905b19b84abcd8e9

                                Start time (UTC):15:29:02
                                Start date (UTC):28/04/2025
                                Path:/usr/lib/systemd/systemd
                                Arguments:-
                                File size:1620224 bytes
                                MD5 hash:9b2bec7092a40488108543f9334aab75

                                Start time (UTC):15:29:02
                                Start date (UTC):28/04/2025
                                Path:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
                                Arguments:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
                                File size:112872 bytes
                                MD5 hash:eee956f1b227c1d5031f9c61223255d1

                                Start time (UTC):15:29:02
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/dash
                                Arguments:-
                                File size:129816 bytes
                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                Start time (UTC):15:29:02
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/rm
                                Arguments:rm -f /tmp/tmp.gaWUt98Qu2 /tmp/tmp.uVEzpmVIJI /tmp/tmp.hWQjQFAtEL
                                File size:72056 bytes
                                MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/dash
                                Arguments:-
                                File size:129816 bytes
                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/cat
                                Arguments:cat /tmp/tmp.gaWUt98Qu2
                                File size:43416 bytes
                                MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/dash
                                Arguments:-
                                File size:129816 bytes
                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/head
                                Arguments:head -n 10
                                File size:47480 bytes
                                MD5 hash:fd96a67145172477dd57131396fc9608

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/dash
                                Arguments:-
                                File size:129816 bytes
                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/tr
                                Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                File size:51544 bytes
                                MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/dash
                                Arguments:-
                                File size:129816 bytes
                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/cut
                                Arguments:cut -c -80
                                File size:47480 bytes
                                MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/dash
                                Arguments:-
                                File size:129816 bytes
                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/cat
                                Arguments:cat /tmp/tmp.gaWUt98Qu2
                                File size:43416 bytes
                                MD5 hash:7e9d213e404ad3bb82e4ebb2e1f2c1b3

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/dash
                                Arguments:-
                                File size:129816 bytes
                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/head
                                Arguments:head -n 10
                                File size:47480 bytes
                                MD5 hash:fd96a67145172477dd57131396fc9608

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/dash
                                Arguments:-
                                File size:129816 bytes
                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/tr
                                Arguments:tr -d \\000-\\011\\013\\014\\016-\\037
                                File size:51544 bytes
                                MD5 hash:fbd1402dd9f72d8ebfff00ce7c3a7bb5

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/dash
                                Arguments:-
                                File size:129816 bytes
                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/cut
                                Arguments:cut -c -80
                                File size:47480 bytes
                                MD5 hash:d8ed0ea8f22c0de0f8692d4d9f1759d3

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/dash
                                Arguments:-
                                File size:129816 bytes
                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                Start time (UTC):15:29:03
                                Start date (UTC):28/04/2025
                                Path:/usr/bin/rm
                                Arguments:rm -f /tmp/tmp.gaWUt98Qu2 /tmp/tmp.uVEzpmVIJI /tmp/tmp.hWQjQFAtEL
                                File size:72056 bytes
                                MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b