Linux Analysis Report arm

Overview

General Information

Sample Name: arm
Analysis ID: 518884
MD5: b31e3180a6bf96af79f2b181a494d87f
SHA1: ff8adee220db2416071830ff02f8ea64e13bd4ef
SHA256: f693c8fe32d094d0b6ae8f4d68d8f98789d8c57e997b1f4ba0163587d150f27e
Tags: Mirai
Infos:

Detection

Mirai
Score: 84
Range: 0 - 100
Whitelisted: false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample tries to kill many processes (SIGKILL)
Reads system files that contain records of logged in users
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample contains only a LOAD segment without any section mappings
Reads CPU information from /sys indicative of miner or evasive malware
Yara signature match
Executes the "grep" command used to find patterns in files or piped streams
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Deletes log files
Creates hidden files and/or directories
Sample tries to set the executable flag
Executes commands using a shell command-line interpreter
Executes the "rm" command used to delete files or directories

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: arm Virustotal: Detection: 18% Perma Link
Source: arm ReversingLabs: Detection: 15%

Bitcoin Miner:

barindex
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/lib/xorg/Xorg (PID: 5418) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5468) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5527) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5536) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5566) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5455) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5879) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: unknown HTTPS traffic detected: 162.213.33.132:443 -> 192.168.2.23:36184 version: TLS 1.2

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 716 INFO TELNET access 122.102.45.162:23 -> 192.168.2.23:51630
Source: Traffic Snort IDS: 492 INFO TELNET login failed 218.84.2.131:23 -> 192.168.2.23:41380
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 162.255.252.206:23 -> 192.168.2.23:60614
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 162.255.252.206:23 -> 192.168.2.23:60614
Source: Traffic Snort IDS: 716 INFO TELNET access 210.104.175.158:23 -> 192.168.2.23:52502
Source: Traffic Snort IDS: 492 INFO TELNET login failed 218.84.2.131:23 -> 192.168.2.23:41634
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 210.104.175.158:23 -> 192.168.2.23:52502
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 210.104.175.158:23 -> 192.168.2.23:52502
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:48582
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:48618
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:48632
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:48670
Source: Traffic Snort IDS: 716 INFO TELNET access 122.102.45.162:23 -> 192.168.2.23:52236
Source: Traffic Snort IDS: 716 INFO TELNET access 210.104.175.158:23 -> 192.168.2.23:52928
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 210.104.175.158:23 -> 192.168.2.23:52928
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 210.104.175.158:23 -> 192.168.2.23:52928
Source: Traffic Snort IDS: 492 INFO TELNET login failed 218.84.2.131:23 -> 192.168.2.23:42066
Source: Traffic Snort IDS: 716 INFO TELNET access 210.104.175.158:23 -> 192.168.2.23:53134
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:52974
Source: Traffic Snort IDS: 492 INFO TELNET login failed 218.84.2.131:23 -> 192.168.2.23:42188
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:52992
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 210.104.175.158:23 -> 192.168.2.23:53134
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 210.104.175.158:23 -> 192.168.2.23:53134
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:53008
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 162.255.252.206:23 -> 192.168.2.23:33240
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 162.255.252.206:23 -> 192.168.2.23:33240
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:53028
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:53052
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:53072
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:53088
Source: Traffic Snort IDS: 492 INFO TELNET login failed 218.84.2.131:23 -> 192.168.2.23:42296
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:53114
Source: Traffic Snort IDS: 716 INFO TELNET access 186.200.199.169:23 -> 192.168.2.23:53360
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:53156
Source: Traffic Snort IDS: 716 INFO TELNET access 210.104.175.158:23 -> 192.168.2.23:53350
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49266
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:53200
Source: Traffic Snort IDS: 716 INFO TELNET access 210.104.175.158:23 -> 192.168.2.23:53396
Source: Traffic Snort IDS: 492 INFO TELNET login failed 186.200.199.169:23 -> 192.168.2.23:53360
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49296
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 90.189.197.215:23 -> 192.168.2.23:51680
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 90.189.197.215:23 -> 192.168.2.23:51680
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:53236
Source: Traffic Snort IDS: 716 INFO TELNET access 210.104.175.158:23 -> 192.168.2.23:53428
Source: Traffic Snort IDS: 716 INFO TELNET access 122.102.45.162:23 -> 192.168.2.23:52858
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 81.139.172.106:23 -> 192.168.2.23:45172
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 81.139.172.106:23 -> 192.168.2.23:45172
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49338
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:53278
Source: Traffic Snort IDS: 716 INFO TELNET access 210.104.175.158:23 -> 192.168.2.23:53470
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49374
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:53308
Source: Traffic Snort IDS: 716 INFO TELNET access 186.200.199.169:23 -> 192.168.2.23:53568
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49408
Source: Traffic Snort IDS: 716 INFO TELNET access 173.212.153.87:23 -> 192.168.2.23:53342
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49446
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 117.175.71.135:23 -> 192.168.2.23:40822
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 117.175.71.135:23 -> 192.168.2.23:40822
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49452
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 210.104.175.158:23 -> 192.168.2.23:53470
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 210.104.175.158:23 -> 192.168.2.23:53470
Source: Traffic Snort IDS: 492 INFO TELNET login failed 218.84.2.131:23 -> 192.168.2.23:42580
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49468
Source: Traffic Snort IDS: 492 INFO TELNET login failed 186.200.199.169:23 -> 192.168.2.23:53568
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49482
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49486
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49504
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 138.186.179.11:23 -> 192.168.2.23:42786
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 138.186.179.11:23 -> 192.168.2.23:42786
Source: Traffic Snort IDS: 716 INFO TELNET access 186.200.199.169:23 -> 192.168.2.23:53712
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49530
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49546
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49572
Source: Traffic Snort IDS: 492 INFO TELNET login failed 186.200.199.169:23 -> 192.168.2.23:53712
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49590
Source: Traffic Snort IDS: 716 INFO TELNET access 210.104.175.158:23 -> 192.168.2.23:53732
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49632
Source: Traffic Snort IDS: 492 INFO TELNET login failed 218.84.2.131:23 -> 192.168.2.23:42750
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49640
Source: Traffic Snort IDS: 716 INFO TELNET access 210.169.117.62:23 -> 192.168.2.23:34238
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49666
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49676
Source: Traffic Snort IDS: 716 INFO TELNET access 186.200.199.169:23 -> 192.168.2.23:53858
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 138.186.179.11:23 -> 192.168.2.23:43436
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 138.186.179.11:23 -> 192.168.2.23:43436
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49694
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 117.175.71.135:23 -> 192.168.2.23:41092
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 117.175.71.135:23 -> 192.168.2.23:41092
Source: Traffic Snort IDS: 716 INFO TELNET access 210.169.117.62:23 -> 192.168.2.23:34310
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 210.104.175.158:23 -> 192.168.2.23:53732
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 210.104.175.158:23 -> 192.168.2.23:53732
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49716
Source: Traffic Snort IDS: 492 INFO TELNET login failed 186.200.199.169:23 -> 192.168.2.23:53858
Source: Traffic Snort IDS: 716 INFO TELNET access 77.247.89.100:23 -> 192.168.2.23:49724
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41280
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41302
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41332
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41352
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41378
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41388
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41396
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41412
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41420
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41432
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41446
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41460
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41470
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41476
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41482
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41490
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41500
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41504
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41514
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41524
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41534
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41540
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41546
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41552
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41560
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41568
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41578
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41582
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:56100 -> 185.227.108.66:40485
Sample listens on a socket
Source: /tmp/arm (PID: 5261) Socket: 0.0.0.0::23 Jump to behavior
Source: /usr/sbin/sshd (PID: 5317) Socket: 0.0.0.0::22 Jump to behavior
Source: /usr/sbin/sshd (PID: 5317) Socket: [::]::22 Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5361) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5362) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5418) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5526) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5467) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/bin/ibus-daemon (PID: 5623) Socket: <unknown socket type>:unknown Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 36184
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 36184 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 58.192.102.140
Source: unknown TCP traffic detected without corresponding DNS query: 118.90.93.140
Source: unknown TCP traffic detected without corresponding DNS query: 222.254.186.81
Source: unknown TCP traffic detected without corresponding DNS query: 112.79.204.222
Source: unknown TCP traffic detected without corresponding DNS query: 115.99.96.203
Source: unknown TCP traffic detected without corresponding DNS query: 39.186.234.77
Source: unknown TCP traffic detected without corresponding DNS query: 118.254.74.66
Source: unknown TCP traffic detected without corresponding DNS query: 69.57.172.31
Source: unknown TCP traffic detected without corresponding DNS query: 165.164.156.146
Source: unknown TCP traffic detected without corresponding DNS query: 212.118.144.26
Source: unknown TCP traffic detected without corresponding DNS query: 68.199.17.222
Source: unknown TCP traffic detected without corresponding DNS query: 65.150.194.143
Source: unknown TCP traffic detected without corresponding DNS query: 174.119.60.47
Source: unknown TCP traffic detected without corresponding DNS query: 164.197.144.199
Source: unknown TCP traffic detected without corresponding DNS query: 39.222.123.132
Source: unknown TCP traffic detected without corresponding DNS query: 212.30.136.39
Source: unknown TCP traffic detected without corresponding DNS query: 168.36.199.89
Source: unknown TCP traffic detected without corresponding DNS query: 125.34.199.107
Source: unknown TCP traffic detected without corresponding DNS query: 218.168.142.107
Source: unknown TCP traffic detected without corresponding DNS query: 105.49.181.148
Source: unknown TCP traffic detected without corresponding DNS query: 46.50.133.70
Source: unknown TCP traffic detected without corresponding DNS query: 165.204.204.251
Source: unknown TCP traffic detected without corresponding DNS query: 32.156.0.113
Source: unknown TCP traffic detected without corresponding DNS query: 163.229.40.17
Source: unknown TCP traffic detected without corresponding DNS query: 8.2.229.112
Source: unknown TCP traffic detected without corresponding DNS query: 134.53.255.240
Source: unknown TCP traffic detected without corresponding DNS query: 99.41.17.213
Source: unknown TCP traffic detected without corresponding DNS query: 64.240.111.77
Source: unknown TCP traffic detected without corresponding DNS query: 59.128.128.107
Source: unknown TCP traffic detected without corresponding DNS query: 136.67.175.29
Source: unknown TCP traffic detected without corresponding DNS query: 147.162.243.53
Source: unknown TCP traffic detected without corresponding DNS query: 99.28.118.224
Source: unknown TCP traffic detected without corresponding DNS query: 180.58.192.149
Source: unknown TCP traffic detected without corresponding DNS query: 36.98.216.54
Source: unknown TCP traffic detected without corresponding DNS query: 37.139.221.157
Source: unknown TCP traffic detected without corresponding DNS query: 122.141.191.122
Source: unknown TCP traffic detected without corresponding DNS query: 128.64.153.81
Source: unknown TCP traffic detected without corresponding DNS query: 164.109.131.199
Source: unknown TCP traffic detected without corresponding DNS query: 148.2.164.76
Source: unknown TCP traffic detected without corresponding DNS query: 216.222.206.186
Source: unknown TCP traffic detected without corresponding DNS query: 138.163.27.65
Source: unknown TCP traffic detected without corresponding DNS query: 91.226.215.137
Source: unknown TCP traffic detected without corresponding DNS query: 153.172.192.198
Source: unknown TCP traffic detected without corresponding DNS query: 166.219.128.17
Source: unknown TCP traffic detected without corresponding DNS query: 218.152.250.82
Source: unknown TCP traffic detected without corresponding DNS query: 70.235.42.197
Source: unknown TCP traffic detected without corresponding DNS query: 39.37.193.19
Source: unknown TCP traffic detected without corresponding DNS query: 118.24.229.81
Source: unknown TCP traffic detected without corresponding DNS query: 150.220.28.38
Source: unknown TCP traffic detected without corresponding DNS query: 169.70.125.56
Source: arm String found in binary or memory: http://upx.sf.net
Source: Xorg.0.log.104.dr String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.104.dr String found in binary or memory: http://www.ubuntu.com/support)
Source: motd-news.17.dr String found in binary or memory: https://ubuntu.com/blog/microk8s-memory-optimisation
Source: unknown DNS traffic detected: queries for: daisy.ubuntu.com
Source: unknown HTTPS traffic detected: 162.213.33.132:443 -> 192.168.2.23:36184 version: TLS 1.2

System Summary:

barindex
Sample tries to kill many processes (SIGKILL)
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 772, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 789, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 904, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1389, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1809, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1888, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) SIGKILL sent: pid: 5520, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) SIGKILL sent: pid: 5868, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) SIGKILL sent: pid: 6091, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5526) SIGKILL sent: pid: 5882, result: successful Jump to behavior
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8000
Yara signature match
Source: arm, type: SAMPLE Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
Sample tries to kill a process (SIGKILL)
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 772, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 789, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 904, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1389, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1809, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/arm (PID: 5261) SIGKILL sent: pid: 1888, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) SIGKILL sent: pid: 5520, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) SIGKILL sent: pid: 5868, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) SIGKILL sent: pid: 6091, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5526) SIGKILL sent: pid: 5882, result: successful Jump to behavior
Source: arm Joe Sandbox Cloud Basic: Detection: clean Score: 0 Perma Link
Source: classification engine Classification label: mal84.spre.troj.evad.lin@0/52@3/0

Data Obfuscation:

barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior:

barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /usr/bin/dbus-daemon (PID: 5361) File: /proc/5361/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File: /proc/5464/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5526) File: /proc/5526/mounts Jump to behavior
Source: /usr/bin/gjs (PID: 6092) File: /proc/6092/mounts Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5566) File: /proc/5566/mounts Jump to behavior
Source: /bin/fusermount (PID: 5471) File: /proc/5471/mounts
Executes the "grep" command used to find patterns in files or piped streams
Source: /bin/sh (PID: 5352) Grep executable: /usr/bin/grep -> grep -F .utf8 Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/arm (PID: 5261) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/670/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/793/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/674/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/675/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/796/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1532/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/797/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/676/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/677/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/799/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/910/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/912/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/517/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/759/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/918/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/761/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/884/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1389/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/720/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/721/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/800/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/801/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/847/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/491/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/2009/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/772/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/774/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1477/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/654/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/896/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1476/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1872/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/655/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1475/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/656/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/777/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/657/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/658/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/419/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/936/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1809/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1494/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1890/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1888/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1601/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/420/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1886/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/2018/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1489/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/785/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/2014/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1320/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/788/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/667/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/789/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/904/exe Jump to behavior
Source: /tmp/arm (PID: 5261) File opened: /proc/1207/exe Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6130/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6152/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6110/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/5464/status Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/5464/attr/current Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6134/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6112/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/5883/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6115/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6137/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/5521/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6114/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6092/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6128/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6120/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6121/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6126/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6117/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/5566/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/5467/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/5467/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/5468/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6116/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/5623/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/6118/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5464) File opened: /proc/5869/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5526) File opened: /proc/6121/cmdline Jump to behavior
Creates hidden files and/or directories
Source: /usr/bin/whoopsie (PID: 5303) Directory: /nonexistent/.cache Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5330) Directory: /root/.cache Jump to behavior
Sample tries to set the executable flag
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5330) File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx) Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5330) File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx) Jump to behavior
Executes commands using a shell command-line interpreter
Source: /usr/share/language-tools/language-options (PID: 5350) Shell command executed: sh -c "locale -a | grep -F .utf8 " Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5428) Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\"" Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5872) Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\"" Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 5208) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.0ZsCqe1shq /tmp/tmp.EYKo36YtKI /tmp/tmp.yzVwFZ13h1 Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5418) Log file created: /var/log/Xorg.0.log Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41280
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41302
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41332
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41352
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41378
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41388
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41396
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41412
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41420
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41432
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41446
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41460
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41470
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41476
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41482
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41490
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41500
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41504
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41514
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41524
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41534
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41540
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41546
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41552
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41560
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41568
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41578
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41582

Malware Analysis System Evasion:

barindex
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/lib/xorg/Xorg (PID: 5418) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5468) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5527) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5536) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5566) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5455) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5879) Reads CPU info from /sys: /sys/devices/system/cpu/online
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm (PID: 5255) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/whoopsie (PID: 5303) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5353) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5362) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5411) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-x-session (PID: 5416) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5418) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/at-spi-bus-launcher (PID: 5521) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/at-spi2-registryd (PID: 5883) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5467) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5468) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5527) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5536) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5566) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 5867) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gsd-wacom (PID: 6112) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gsd-color (PID: 6114) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gsd-keyboard (PID: 6115) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gsd-smartcard (PID: 6118) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6121) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gsd-power (PID: 6137) Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5455) Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5879) Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6155) Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6507) Queries kernel information via 'uname':
Deletes log files
Source: /usr/lib/xorg/Xorg (PID: 5418) Truncated file: /var/log/Xorg.pid-5418.log Jump to behavior
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.697] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.902] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.492] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.662] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.653] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.327] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.772] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.463] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.617] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.911] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.353] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.575] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.639] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.892] (--) vmware(0): depth: 24
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.705] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.916] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.951] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.503] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.179] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.767] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.658] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.967] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.743] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.570] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.223] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.251] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.704] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.725] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.855] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.736] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.708] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.716] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.694] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.610] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.825] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.695] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.266] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.435] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.777] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.050] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.343] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.575] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.683] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.465] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.926] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.044] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.754] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.941] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.608] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: arm, 5255.1.0000000039dd1254.00000000e616feff.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.749] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.236] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.203] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.394] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.523] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.480] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.747] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.959] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.548] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.317] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.669] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.822] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.221] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.332] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.519] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.780] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.794] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 491.489] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.513] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.859] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.869] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.068] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.539] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 485.139] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.382] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.963] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.301] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: arm, 5255.1.000000004a06d35e.00000000a75fc404.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.832] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.717] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.514] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.710] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.874] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.477] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.469] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.511] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.610] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.898] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.217] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.389] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.349] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.262] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.579] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 480.677] (==) Matched vmware as autoconfigured driver 0
Source: arm, 5255.1.000000004a06d35e.00000000a75fc404.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/armSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.527] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.864] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.345] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.990] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.062] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.894] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.173] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.995] (--) vmware(0): w.red: 8
Source: Xorg.0.log.104.dr Binary or memory string: [ 480.906] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.361] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.000] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.974] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.017] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.787] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.818] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.956] (--) vmware(0): depth: 24
Source: Xorg.0.log.104.dr Binary or memory string: [ 485.146] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.815] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.428] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.470] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.724] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.886] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.375] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.056] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.441] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.197] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.720] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.709] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.689] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.671] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.209] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.228] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.633] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.829] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.454] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.846] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.701] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.553] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.564] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.250] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.982] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.580] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.288] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.429] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.792] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.623] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.307] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.613] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.775] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.683] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.366] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.129] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.840] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.883] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.104.dr Binary or memory string: [ 480.770] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.376] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.937] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.030] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.509] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.991] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.100] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.279] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.259] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.494] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.805] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.486] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.215] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.535] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.676] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 480.711] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.081] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.602] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: arm, 5261.1.00000000e616feff.000000000c04f09f.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.740] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.758] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.590] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.234] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.136] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.468] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 485.130] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.450] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.649] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.734] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.312] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.680] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.625] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.513] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.498] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.594] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.946] (--) vmware(0): mheig: 885
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.152] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.475] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.751] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.712] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.243] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 491.504] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: arm, 5261.1.00000000e616feff.000000000c04f09f.rw-.sdmp Binary or memory string: !/proc/1594/exe0!/usr/bin/vmtoolsd1P
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.093] (--) vmware(0): vis: 4
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.539] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.836] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.384] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.028] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.598] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.661] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.536] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.741] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.108] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.905] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.563] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.274] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.978] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.422] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.975] (--) vmware(0): bpp: 32
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.339] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.731] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.902] (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.644] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.907] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.268] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.214] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.458] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.878] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.322] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.910] (--) vmware(0): bpp: 32
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.549] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.657] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.769] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.231] (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.727] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.185] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.211] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.185] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.757] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.438] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.882] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.159] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.104.dr Binary or memory string: [ 480.700] (II) LoadModule: "vmware"
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.039] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.700] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.761] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.006] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.459] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.537] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.036] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.765] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.461] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.627] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.890] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.034] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.401] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.791] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.675] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.568] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.166] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.476] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.273] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.224] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.933] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.925] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.460] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.403] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.971] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.597] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.996] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.256] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.223] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.631] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.850] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.641] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.933] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.521] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.092] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.808] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.416] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.617] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.531] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.798] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.144] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.284] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: arm, 5255.1.0000000039dd1254.00000000e616feff.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.410] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.337] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.197] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.174] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.126] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.379] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.312] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.504] (**) vmware(0): *Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.518] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.801] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.543] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.534] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.160] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.448] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 491.496] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.665] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.167] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.076] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.929] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.481] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.023] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.486] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.955] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.466] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.620] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.244] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.812] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.918] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.441] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.529] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.104.dr Binary or memory string: [ 491.582] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.665] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.295] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.104.dr Binary or memory string: [ 484.368] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.667] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.921] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.947] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 481.880] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.104.dr Binary or memory string: [ 483.452] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.441] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 482.606] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.104.dr Binary or memory string: [ 492.519] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer

Language, Device and Operating System Detection:

barindex
Reads system files that contain records of logged in users
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5330) Logged in records file read: /var/log/wtmp Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality:

barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
19.59.48.218
 unknown United States
3 MIT-GATEWAYSUS false
39.250.129.180
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
175.237.148.1
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
91.198.46.37
 unknown Russian Federation
206012 AXIOSTV-AS---UpStreams---RU false
122.191.250.25
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
206.10.220.48
 unknown United States
5006 VOYANTUS false
218.158.104.94
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
149.120.38.179
 unknown United States
174 COGENT-174US false
82.62.61.200
 unknown Italy
3269 ASN-IBSNAZIT false
41.49.7.102
 unknown South Africa
37168 CELL-CZA false
41.78.123.10
 unknown Central African Republic
22351 INTELSAT-1US false
107.169.202.164
 unknown Reserved
40676 AS40676US false
65.47.69.39
 unknown United States
2828 XO-AS15US false
209.77.22.192
 unknown United States
7132 SBIS-ASUS false
176.53.19.93
 unknown Turkey
197328 INETLTDTR false
45.241.178.112
 unknown Egypt
24863 LINKdotNET-ASEG false
160.109.64.10
 unknown United States
1294 NTTDATA-SERVICES-AS1US false
53.148.44.7
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
47.99.216.211
 unknown China
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
133.118.225.139
 unknown Japan 2522 PPP-EXPJapanNetworkInformationCenterJP false
193.105.108.56
 unknown United Kingdom
207476 LV_IZSLV false
124.142.37.83
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
98.38.68.191
 unknown United States
7922 COMCAST-7922US false
110.76.137.58
 unknown Australia
59362 KSNETWORK-AS-APKSNetworkLimitedBD false
9.136.107.117
 unknown United States
3356 LEVEL3US false
23.169.25.13
 unknown Reserved
395574 CAMBIOBBUS false
84.73.6.176
 unknown Switzerland
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
4.221.60.8
 unknown United States
3356 LEVEL3US false
83.171.81.78
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
159.104.120.251
 unknown United States
16050 REUTERS-DOCKLANDS-RES-ASReutersDocklandsresiliancyGB false
170.183.207.232
 unknown United States
11685 HNBCOL-ASUS false
187.18.175.75
 unknown Brazil
28270 VideomarRedeNordesteSABR false
195.65.218.77
 unknown Switzerland
199642 AS_ADUNO_2CH false
152.90.39.20
 unknown Norway
21171 SCHIBSTEDSchibstedASAAutonomoussystemOsloNorwayNO false
75.204.186.218
 unknown United States
22394 CELLCOUS false
134.190.100.180
 unknown Canada
8111 DALUNIVCA false
184.99.204.99
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
79.103.170.149
 unknown Greece
1241 FORTHNET-GRForthnetEU false
113.72.119.63
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
205.143.49.27
 unknown United States
393341 SPOKANE-COUNTYUS false
171.221.148.233
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
171.40.189.88
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
79.204.53.161
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
63.84.141.231
 unknown United States
14414 CROSSBRDG-ASN01US false
64.242.160.158
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
109.252.60.144
 unknown Russian Federation
25513 ASN-MGTS-USPDRU false
57.223.59.4
 unknown Belgium
2686 ATGS-MMD-ASUS false
96.162.12.219
 unknown United States
7922 COMCAST-7922US false
109.36.132.123
 unknown Netherlands
15480 VFNL-ASVodafoneNLAutonomousSystemNL false
104.199.183.21
 unknown United States
15169 GOOGLEUS false
197.84.227.233
 unknown South Africa
10474 OPTINETZA false
216.175.40.141
 unknown United States
12285 ONE-ELEVENUS false
223.124.158.159
 unknown China
58453 CMI-INT-HKLevel30Tower1HK false
203.13.26.6
 unknown Australia
2764 AAPTAAPTLimitedAU false
132.165.52.220
 unknown France
777 CEA-SaclayEU false
97.254.245.162
 unknown United States
6167 CELLCO-PARTUS false
155.225.196.253
 unknown United States
2939 SCAROLINA-ASUS false
152.225.116.218
 unknown United States
701 UUNETUS false
59.118.62.107
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
183.188.162.145
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
13.6.139.40
 unknown United States
33631 PARC-ASNUS false
200.235.176.71
 unknown Brazil
1916 AssociacaoRedeNacionaldeEnsinoePesquisaBR false
198.46.69.160
 unknown United States
54290 HOSTWINDSUS false
96.11.115.242
 unknown United States
10796 TWC-10796-MIDWESTUS false
207.46.5.115
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
165.41.215.82
 unknown United States
37053 RSAWEB-ASZA false
39.18.72.112
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
197.2.168.186
 unknown Tunisia
37705 TOPNETTN false
128.232.85.144
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
53.75.197.37
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
110.209.121.115
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
178.129.66.47
 unknown Russian Federation
28812 JSCBIS-ASRU false
107.149.237.180
 unknown United States
54600 PEGTECHINCUS false
4.219.83.226
 unknown United States
3356 LEVEL3US false
176.197.214.42
 unknown Russian Federation
39927 ELIGHT-ASRU false
84.124.131.163
 unknown Spain
6739 ONO-ASCableuropa-ONOES false
207.58.227.111
 unknown United States
22958 FIDELITY-001US false
24.54.255.188
 unknown Puerto Rico
14638 LCPRLUS false
128.228.133.9
 unknown United States
31822 CITY-UNIVERSITY-OF-NEW-YORKUS false
118.199.26.215
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
5.97.10.84
 unknown Italy
3269 ASN-IBSNAZIT false
62.44.42.143
 unknown Germany
41707 ASN-HSDG-DE false
178.230.74.165
 unknown Netherlands
31615 TMO-NL-ASNL false
115.93.208.23
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
187.205.197.115
 unknown Mexico
8151 UninetSAdeCVMX false
171.159.234.243
 unknown United States
10794 BANKAMERICAUS false
152.0.94.5
 unknown Dominican Republic
6400 CompaniaDominicanadeTelefonosSADO false
9.83.120.175
 unknown United States
3356 LEVEL3US false
39.163.117.41
 unknown China
24445 CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN false
70.60.131.165
 unknown United States
10796 TWC-10796-MIDWESTUS false
97.152.11.1
 unknown United States
6167 CELLCO-PARTUS false
159.140.225.169
 unknown United States
17264 CERNER-COMUS false
176.127.118.25
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
120.3.224.35
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
12.156.59.159
 unknown United States
7018 ATT-INTERNET4US false
73.107.169.67
 unknown United States
7922 COMCAST-7922US false
185.163.151.57
 unknown Israel
57259 BROADNET-ASNIL false
175.55.216.46
 unknown China
134810 CMNET-JILIN-AS-APChinaMobileGroupJiLincommunicationsco false
181.131.145.230
 unknown Colombia
13489 EPMTelecomunicacionesSAESPCO false
191.239.1.239
 unknown Brazil
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.33.108 true