Linux Analysis Report arm7

Overview

General Information

Sample Name: arm7
Analysis ID: 519719
MD5: 3ac52d54aa555033f5095b063a2ea628
SHA1: bc1a24e602b2f4201bbfaec9f7e0495bdeddb45f
SHA256: 2a53b47394e367a0d4285aa9609938380cf048acbd57d8a18bfb218a0e34c566
Tags: Mirai
Infos:

Detection

Mirai
Score: 84
Range: 0 - 100
Whitelisted: false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample tries to kill many processes (SIGKILL)
Reads system files that contain records of logged in users
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample contains only a LOAD segment without any section mappings
Reads CPU information from /sys indicative of miner or evasive malware
Yara signature match
Executes the "grep" command used to find patterns in files or piped streams
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Deletes log files
Creates hidden files and/or directories
Sample tries to set the executable flag
Executes commands using a shell command-line interpreter

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: arm7 Virustotal: Detection: 18% Perma Link
Source: arm7 ReversingLabs: Detection: 15%

Bitcoin Miner:

barindex
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/lib/xorg/Xorg (PID: 5421) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5458) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5511) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5528) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5558) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5437) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5870) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: unknown HTTPS traffic detected: 162.213.33.132:443 -> 192.168.2.23:35746 version: TLS 1.2

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45246
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45252
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45256
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45262
Source: Traffic Snort IDS: 404 ICMP Destination Unreachable Protocol Unreachable 37.208.25.170: -> 192.168.2.23:
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:33698
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:33698
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45278
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:33708
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:33708
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45326
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:33744
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:33744
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:33810
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:33810
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45392
Source: Traffic Snort IDS: 716 INFO TELNET access 123.161.211.184:23 -> 192.168.2.23:45356
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 188.228.192.177:23 -> 192.168.2.23:49958
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 188.228.192.177:23 -> 192.168.2.23:49958
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:33852
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:33852
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45462
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:33950
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:33950
Source: Traffic Snort IDS: 492 INFO TELNET login failed 123.161.211.184:23 -> 192.168.2.23:45356
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45554
Source: Traffic Snort IDS: 716 INFO TELNET access 121.33.113.160:23 -> 192.168.2.23:37584
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:33998
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:33998
Source: Traffic Snort IDS: 716 INFO TELNET access 39.120.26.136:23 -> 192.168.2.23:48748
Source: Traffic Snort IDS: 716 INFO TELNET access 123.161.211.184:23 -> 192.168.2.23:45518
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45598
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 77.76.148.119:23 -> 192.168.2.23:55862
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 77.76.148.119:23 -> 192.168.2.23:55862
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.23:59632 -> 83.244.89.111:23
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34036
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34036
Source: Traffic Snort IDS: 492 INFO TELNET login failed 123.161.211.184:23 -> 192.168.2.23:45518
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45616
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.23:59644 -> 83.244.89.111:23
Source: Traffic Snort IDS: 716 INFO TELNET access 121.33.113.160:23 -> 192.168.2.23:37628
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34048
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34048
Source: Traffic Snort IDS: 716 INFO TELNET access 123.161.211.184:23 -> 192.168.2.23:45562
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45636
Source: Traffic Snort IDS: 716 INFO TELNET access 117.36.77.242:23 -> 192.168.2.23:36662
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34066
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34066
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 113.162.209.38:23 -> 192.168.2.23:60770
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 113.162.209.38:23 -> 192.168.2.23:60770
Source: Traffic Snort IDS: 716 INFO TELNET access 121.33.113.160:23 -> 192.168.2.23:37656
Source: Traffic Snort IDS: 492 INFO TELNET login failed 117.36.77.242:23 -> 192.168.2.23:36662
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 77.76.148.119:23 -> 192.168.2.23:55934
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 77.76.148.119:23 -> 192.168.2.23:55934
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34086
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34086
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45656
Source: Traffic Snort IDS: 492 INFO TELNET login failed 123.161.211.184:23 -> 192.168.2.23:45562
Source: Traffic Snort IDS: 716 INFO TELNET access 117.36.77.242:23 -> 192.168.2.23:36684
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34096
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34096
Source: Traffic Snort IDS: 716 INFO TELNET access 121.33.113.160:23 -> 192.168.2.23:37676
Source: Traffic Snort IDS: 716 INFO TELNET access 123.161.211.184:23 -> 192.168.2.23:45602
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45672
Source: Traffic Snort IDS: 492 INFO TELNET login failed 117.36.77.242:23 -> 192.168.2.23:36684
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34110
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34110
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45686
Source: Traffic Snort IDS: 492 INFO TELNET login failed 123.161.211.184:23 -> 192.168.2.23:45602
Source: Traffic Snort IDS: 716 INFO TELNET access 121.33.113.160:23 -> 192.168.2.23:37710
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34140
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34140
Source: Traffic Snort IDS: 716 INFO TELNET access 117.36.77.242:23 -> 192.168.2.23:36748
Source: Traffic Snort IDS: 492 INFO TELNET login failed 120.94.0.1:23 -> 192.168.2.23:55346
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 77.76.148.119:23 -> 192.168.2.23:55982
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 77.76.148.119:23 -> 192.168.2.23:55982
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45764
Source: Traffic Snort IDS: 716 INFO TELNET access 123.161.211.184:23 -> 192.168.2.23:45718
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 94.26.54.196:23 -> 192.168.2.23:35366
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 94.26.54.196:23 -> 192.168.2.23:35366
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34218
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34218
Source: Traffic Snort IDS: 492 INFO TELNET login failed 117.36.77.242:23 -> 192.168.2.23:36748
Source: Traffic Snort IDS: 716 INFO TELNET access 121.33.113.160:23 -> 192.168.2.23:37872
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45880
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 188.228.192.177:23 -> 192.168.2.23:50414
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 188.228.192.177:23 -> 192.168.2.23:50414
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34308
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34308
Source: Traffic Snort IDS: 492 INFO TELNET login failed 123.161.211.184:23 -> 192.168.2.23:45718
Source: Traffic Snort IDS: 716 INFO TELNET access 117.36.77.242:23 -> 192.168.2.23:36934
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:45956
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34376
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34376
Source: Traffic Snort IDS: 716 INFO TELNET access 39.120.26.136:23 -> 192.168.2.23:49120
Source: Traffic Snort IDS: 716 INFO TELNET access 121.33.113.160:23 -> 192.168.2.23:37976
Source: Traffic Snort IDS: 492 INFO TELNET login failed 117.36.77.242:23 -> 192.168.2.23:36934
Source: Traffic Snort IDS: 716 INFO TELNET access 123.161.211.184:23 -> 192.168.2.23:45904
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 77.76.148.119:23 -> 192.168.2.23:56224
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 77.76.148.119:23 -> 192.168.2.23:56224
Source: Traffic Snort IDS: 716 INFO TELNET access 178.204.151.185:23 -> 192.168.2.23:32794
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 94.26.54.196:23 -> 192.168.2.23:35606
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 94.26.54.196:23 -> 192.168.2.23:35606
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34414
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34414
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:46052
Source: Traffic Snort IDS: 716 INFO TELNET access 178.204.151.185:23 -> 192.168.2.23:32868
Source: Traffic Snort IDS: 716 INFO TELNET access 117.36.77.242:23 -> 192.168.2.23:37076
Source: Traffic Snort IDS: 492 INFO TELNET login failed 123.161.211.184:23 -> 192.168.2.23:45904
Source: Traffic Snort IDS: 492 INFO TELNET login failed 120.94.0.1:23 -> 192.168.2.23:55686
Source: Traffic Snort IDS: 716 INFO TELNET access 178.204.151.185:23 -> 192.168.2.23:32888
Source: Traffic Snort IDS: 716 INFO TELNET access 121.33.113.160:23 -> 192.168.2.23:38084
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34512
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34512
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:46100
Source: Traffic Snort IDS: 492 INFO TELNET login failed 117.36.77.242:23 -> 192.168.2.23:37076
Source: Traffic Snort IDS: 716 INFO TELNET access 178.204.151.185:23 -> 192.168.2.23:32920
Source: Traffic Snort IDS: 716 INFO TELNET access 123.161.211.184:23 -> 192.168.2.23:46048
Source: Traffic Snort IDS: 716 INFO TELNET access 178.204.151.185:23 -> 192.168.2.23:32966
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34568
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34568
Source: Traffic Snort IDS: 716 INFO TELNET access 117.36.77.242:23 -> 192.168.2.23:37194
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:46170
Source: Traffic Snort IDS: 716 INFO TELNET access 178.204.151.185:23 -> 192.168.2.23:32992
Source: Traffic Snort IDS: 716 INFO TELNET access 121.33.113.160:23 -> 192.168.2.23:38190
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 77.76.148.119:23 -> 192.168.2.23:56430
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 77.76.148.119:23 -> 192.168.2.23:56430
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 94.26.54.196:23 -> 192.168.2.23:35792
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 94.26.54.196:23 -> 192.168.2.23:35792
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34628
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34628
Source: Traffic Snort IDS: 716 INFO TELNET access 178.204.151.185:23 -> 192.168.2.23:33022
Source: Traffic Snort IDS: 492 INFO TELNET login failed 117.36.77.242:23 -> 192.168.2.23:37194
Source: Traffic Snort IDS: 492 INFO TELNET login failed 123.161.211.184:23 -> 192.168.2.23:46048
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:46224
Source: Traffic Snort IDS: 492 INFO TELNET login failed 120.94.0.1:23 -> 192.168.2.23:55842
Source: Traffic Snort IDS: 716 INFO TELNET access 178.204.151.185:23 -> 192.168.2.23:33052
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34670
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34670
Source: Traffic Snort IDS: 716 INFO TELNET access 121.33.113.160:23 -> 192.168.2.23:38258
Source: Traffic Snort IDS: 716 INFO TELNET access 117.36.77.242:23 -> 192.168.2.23:37280
Source: Traffic Snort IDS: 716 INFO TELNET access 123.161.211.184:23 -> 192.168.2.23:46198
Source: Traffic Snort IDS: 716 INFO TELNET access 178.204.151.185:23 -> 192.168.2.23:33078
Source: Traffic Snort IDS: 716 INFO TELNET access 183.249.26.124:23 -> 192.168.2.23:46278
Source: Traffic Snort IDS: 1251 INFO TELNET Bad Login 198.210.67.144:23 -> 192.168.2.23:34710
Source: Traffic Snort IDS: 718 INFO TELNET login incorrect 198.210.67.144:23 -> 192.168.2.23:34710
Source: Traffic Snort IDS: 716 INFO TELNET access 115.234.205.163:23 -> 192.168.2.23:52930
Source: Traffic Snort IDS: 716 INFO TELNET access 178.204.151.185:23 -> 192.168.2.23:33110
Source: Traffic Snort IDS: 716 INFO TELNET access 115.234.205.163:23 -> 192.168.2.23:52942
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57304
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57316
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57322
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:48594 -> 144.172.71.18:40485
Sample listens on a socket
Source: /tmp/arm7 (PID: 5251) Socket: 0.0.0.0::23 Jump to behavior
Source: /usr/sbin/sshd (PID: 5317) Socket: 0.0.0.0::22 Jump to behavior
Source: /usr/sbin/sshd (PID: 5317) Socket: [::]::22 Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5363) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5364) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5421) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5457) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/bin/ibus-daemon (PID: 5736) Socket: <unknown socket type>:unknown Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 35746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 35746
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 192.199.57.252
Source: unknown TCP traffic detected without corresponding DNS query: 176.152.95.5
Source: unknown TCP traffic detected without corresponding DNS query: 36.225.204.31
Source: unknown TCP traffic detected without corresponding DNS query: 19.158.28.134
Source: unknown TCP traffic detected without corresponding DNS query: 121.88.200.84
Source: unknown TCP traffic detected without corresponding DNS query: 79.181.225.135
Source: unknown TCP traffic detected without corresponding DNS query: 174.225.180.228
Source: unknown TCP traffic detected without corresponding DNS query: 209.125.28.100
Source: unknown TCP traffic detected without corresponding DNS query: 140.4.56.25
Source: unknown TCP traffic detected without corresponding DNS query: 66.195.28.149
Source: unknown TCP traffic detected without corresponding DNS query: 157.117.128.224
Source: unknown TCP traffic detected without corresponding DNS query: 161.30.117.79
Source: unknown TCP traffic detected without corresponding DNS query: 189.7.67.184
Source: unknown TCP traffic detected without corresponding DNS query: 95.244.81.146
Source: unknown TCP traffic detected without corresponding DNS query: 188.12.130.208
Source: unknown TCP traffic detected without corresponding DNS query: 212.64.62.167
Source: unknown TCP traffic detected without corresponding DNS query: 76.107.79.99
Source: unknown TCP traffic detected without corresponding DNS query: 176.221.17.131
Source: unknown TCP traffic detected without corresponding DNS query: 165.122.137.37
Source: unknown TCP traffic detected without corresponding DNS query: 130.147.198.147
Source: unknown TCP traffic detected without corresponding DNS query: 112.55.0.34
Source: unknown TCP traffic detected without corresponding DNS query: 92.163.185.163
Source: unknown TCP traffic detected without corresponding DNS query: 79.133.204.182
Source: unknown TCP traffic detected without corresponding DNS query: 66.140.111.130
Source: unknown TCP traffic detected without corresponding DNS query: 32.71.34.229
Source: unknown TCP traffic detected without corresponding DNS query: 186.67.192.29
Source: unknown TCP traffic detected without corresponding DNS query: 91.217.82.124
Source: unknown TCP traffic detected without corresponding DNS query: 128.108.131.154
Source: unknown TCP traffic detected without corresponding DNS query: 173.212.208.70
Source: unknown TCP traffic detected without corresponding DNS query: 44.122.121.93
Source: unknown TCP traffic detected without corresponding DNS query: 51.14.9.58
Source: unknown TCP traffic detected without corresponding DNS query: 42.55.184.30
Source: unknown TCP traffic detected without corresponding DNS query: 152.74.247.14
Source: unknown TCP traffic detected without corresponding DNS query: 44.94.224.198
Source: unknown TCP traffic detected without corresponding DNS query: 119.53.254.131
Source: unknown TCP traffic detected without corresponding DNS query: 109.102.2.232
Source: unknown TCP traffic detected without corresponding DNS query: 39.35.170.77
Source: unknown TCP traffic detected without corresponding DNS query: 213.223.111.27
Source: unknown TCP traffic detected without corresponding DNS query: 163.130.106.69
Source: unknown TCP traffic detected without corresponding DNS query: 20.140.155.61
Source: unknown TCP traffic detected without corresponding DNS query: 59.2.171.77
Source: unknown TCP traffic detected without corresponding DNS query: 157.251.47.109
Source: unknown TCP traffic detected without corresponding DNS query: 131.96.70.127
Source: unknown TCP traffic detected without corresponding DNS query: 181.148.185.52
Source: unknown TCP traffic detected without corresponding DNS query: 37.252.145.43
Source: unknown TCP traffic detected without corresponding DNS query: 220.212.79.248
Source: unknown TCP traffic detected without corresponding DNS query: 64.129.206.237
Source: unknown TCP traffic detected without corresponding DNS query: 151.242.252.90
Source: unknown TCP traffic detected without corresponding DNS query: 147.92.30.27
Source: unknown TCP traffic detected without corresponding DNS query: 105.49.136.22
Source: arm7 String found in binary or memory: http://upx.sf.net
Source: Xorg.0.log.86.dr String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.86.dr String found in binary or memory: http://www.ubuntu.com/support)
Source: unknown DNS traffic detected: queries for: daisy.ubuntu.com
Source: unknown HTTPS traffic detected: 162.213.33.132:443 -> 192.168.2.23:35746 version: TLS 1.2

System Summary:

barindex
Sample tries to kill many processes (SIGKILL)
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 772, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 789, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 904, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1389, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1809, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1888, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1983, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 2048, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) SIGKILL sent: pid: 5473, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) SIGKILL sent: pid: 5859, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) SIGKILL sent: pid: 6094, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) SIGKILL sent: pid: 6090, result: successful Jump to behavior
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x8000
Yara signature match
Source: arm7, type: SAMPLE Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
Sample tries to kill a process (SIGKILL)
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 772, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 789, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 904, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1389, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1809, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1888, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 1983, result: successful Jump to behavior
Source: /tmp/arm7 (PID: 5251) SIGKILL sent: pid: 2048, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) SIGKILL sent: pid: 5473, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) SIGKILL sent: pid: 5859, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) SIGKILL sent: pid: 6094, result: successful Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) SIGKILL sent: pid: 6090, result: successful Jump to behavior
Source: arm7 Joe Sandbox Cloud Basic: Detection: clean Score: 0 Perma Link
Source: classification engine Classification label: mal84.spre.troj.evad.lin@0/51@3/0

Data Obfuscation:

barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior:

barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /usr/bin/dbus-daemon (PID: 5363) File: /proc/5363/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) File: /proc/5456/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) File: /proc/5510/mounts Jump to behavior
Source: /usr/bin/gjs (PID: 6095) File: /proc/6095/mounts Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5558) File: /proc/5558/mounts Jump to behavior
Source: /bin/fusermount (PID: 5476) File: /proc/5476/mounts
Executes the "grep" command used to find patterns in files or piped streams
Source: /bin/sh (PID: 5352) Grep executable: /usr/bin/grep -> grep -F .utf8 Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/670/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/793/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/674/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/675/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/796/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1532/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/797/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/676/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/677/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/799/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/910/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/912/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/517/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/759/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/918/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/761/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/884/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1389/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/720/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/721/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/800/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/801/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/847/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/491/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/2050/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/2009/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/772/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/774/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1477/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/654/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/896/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1476/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1872/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/2048/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/655/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1475/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/656/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/777/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/657/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/658/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/419/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/936/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1809/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1494/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1890/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/2062/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1888/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1601/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/420/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1886/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/2018/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1489/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/785/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/2014/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1320/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/788/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/667/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/789/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/904/exe Jump to behavior
Source: /tmp/arm7 (PID: 5251) File opened: /proc/1207/exe Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) File opened: /proc/6131/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) File opened: /proc/6144/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) File opened: /proc/5510/status Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) File opened: /proc/5510/attr/current Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) File opened: /proc/6091/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) File opened: /proc/6116/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) File opened: /proc/5458/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) File opened: /proc/6119/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) File opened: /proc/5558/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) File opened: /proc/6118/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) File opened: /proc/5528/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5510) File opened: /proc/5858/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) File opened: /proc/6131/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) File opened: /proc/6133/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) File opened: /proc/6135/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) File opened: /proc/5860/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) File opened: /proc/6114/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) File opened: /proc/6091/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) File opened: /proc/6095/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) File opened: /proc/5456/status Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) File opened: /proc/5456/attr/current Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) File opened: /proc/6128/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) File opened: /proc/5457/cmdline Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5456) File opened: /proc/5458/cmdline Jump to behavior
Creates hidden files and/or directories
Source: /usr/bin/whoopsie (PID: 5293) Directory: /nonexistent/.cache Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5328) Directory: /root/.cache Jump to behavior
Sample tries to set the executable flag
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5328) File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx) Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5328) File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx) Jump to behavior
Executes commands using a shell command-line interpreter
Source: /usr/share/language-tools/language-options (PID: 5350) Shell command executed: sh -c "locale -a | grep -F .utf8 " Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5433) Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\"" Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5861) Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\"" Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5421) Log file created: /var/log/Xorg.0.log Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57304
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57316
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 57322

Malware Analysis System Evasion:

barindex
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/lib/xorg/Xorg (PID: 5421) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5458) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5511) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5528) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5558) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5437) Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5870) Reads CPU info from /sys: /sys/devices/system/cpu/online
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/arm7 (PID: 5244) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/whoopsie (PID: 5293) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5353) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5364) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5392) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-x-session (PID: 5417) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5421) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/at-spi-bus-launcher (PID: 5474) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/at-spi2-registryd (PID: 6091) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5457) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5458) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5511) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5528) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5558) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 5858) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gsd-wacom (PID: 6116) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gsd-color (PID: 6118) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gsd-keyboard (PID: 6119) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gsd-smartcard (PID: 6126) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6131) Queries kernel information via 'uname': Jump to behavior
Source: /usr/libexec/gsd-power (PID: 6144) Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5437) Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5870) Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6161) Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6774) Queries kernel information via 'uname':
Deletes log files
Source: /usr/lib/xorg/Xorg (PID: 5421) Truncated file: /var/log/Xorg.pid-5421.log Jump to behavior
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.773] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.479] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.362] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 483.823] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.819] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.321] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.217] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 487.492] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.415] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.312] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.734] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.657] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.068] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.236] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.682] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.515] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.419] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.537] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.137] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.452] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.341] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.792] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.511] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.641] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.607] (--) vmware(0): w.red: 8
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.301] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.694] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.712] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.740] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.437] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.530] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.678] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.577] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.040] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 487.587] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.749] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.107] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.047] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.040] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.714] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.153] (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.685] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.491] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.455] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.237] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.640] (==) vmware(0): Default visual is TrueColor
Source: arm7, 5244.1.000000003fb70bab.000000008f3bd8a1.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.891] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.204] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.158] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 487.563] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.089] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.733] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.376] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.564] (--) vmware(0): depth: 24
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.587] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.801] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.295] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.737] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.592] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.723] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.286] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.916] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.737] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 487.298] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.158] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.585] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.761] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.188] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.734] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.622] (--) vmware(0): vis: 4
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.718] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.962] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.200] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.211] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: arm7, 5244.1.0000000031600e67.00000000015e858b.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.980] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.727] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.538] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.689] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.668] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.796] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.378] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.266] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.386] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.351] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.471] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.496] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.444] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.466] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.922] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.731] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.005] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.728] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.142] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.242] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.709] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.439] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.223] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.363] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.098] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.152] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.538] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.755] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.323] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.658] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.718] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.704] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.346] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.699] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.355] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.723] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.754] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.134] (EE) vmware(0): Failed to open drm.
Source: arm7, 5251.1.000000003fb70bab.000000008f3bd8a1.rw-.sdmp Binary or memory string: !/proc/1599/exe0!/usr/bin/vmtoolsd1@P
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.598] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.699] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.193] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.508] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.644] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.86.dr Binary or memory string: [ 487.432] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.460] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.147] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.731] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.171] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.530] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.172] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.424] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.017] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.967] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.422] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.957] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.679] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: arm7, 5244.1.0000000031600e67.00000000015e858b.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm7SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.293] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.615] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.636] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.695] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.248] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.198] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.987] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.471] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.681] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.693] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.572] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.767] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.967] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.147] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.439] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.565] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.604] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.408] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.290] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.625] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.279] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.867] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.798] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: arm7, 5251.1.000000003fb70bab.000000008f3bd8a1.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.273] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.597] (--) vmware(0): depth: 24
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.481] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.367] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.062] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.557] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.653] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.207] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.507] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.384] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.268] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.515] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.257] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.766] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 488.238] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.146] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.582] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.972] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.945] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.608] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.524] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.677] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.740] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.649] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.759] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.306] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.776] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.548] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.445] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.639] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.510] (**) vmware(0): *Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.024] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.627] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.054] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.250] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.401] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.551] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.611] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.781] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.215] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.281] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.255] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 487.985] (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.570] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.101] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.553] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.704] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.401] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.665] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.806] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.777] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.347] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.095] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.609] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.669] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.177] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.770] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.118] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.243] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.506] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.766] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.716] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.86.dr Binary or memory string: [ 483.958] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.357] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.121] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 482.431] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.393] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 482.361] (II) LoadModule: "vmware"
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.930] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.450] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.519] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.697] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.230] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.444] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.827] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 482.332] (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.86.dr Binary or memory string: [ 487.558] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.675] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.602] (--) vmware(0): bpp: 32
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.433] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.142] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.688] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.780] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.630] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 482.376] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.951] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.673] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.318] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.937] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.075] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.999] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.86.dr Binary or memory string: [ 487.613] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.881] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.711] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.544] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.903] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.635] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.514] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.897] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.501] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.396] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 488.227] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.846] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.579] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.716] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 487.972] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: arm7, 5244.1.000000003fb70bab.000000008f3bd8a1.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.132] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.127] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.743] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.710] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.032] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 487.599] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.977] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.391] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 487.991] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.733] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.617] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.647] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.708] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.371] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.663] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.010] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.166] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.544] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.230] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.792] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.620] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.223] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.161] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.612] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.475] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.787] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.405] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.491] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.592] (--) vmware(0): mheig: 885
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.522] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.795] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.499] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.156] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 487.552] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.684] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.565] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.410] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.572] (--) vmware(0): bpp: 32
Source: Xorg.0.log.86.dr Binary or memory string: [ 487.569] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 488.216] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.670] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.415] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.430] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.429] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.525] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.789] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.993] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 484.783] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.434] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 485.910] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr Binary or memory string: [ 486.771] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.86.dr Binary or memory string: [ 494.615] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'

Language, Device and Operating System Detection:

barindex
Reads system files that contain records of logged in users
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5328) Logged in records file read: /var/log/wtmp Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality:

barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
102.233.125.222
 unknown unknown
36926 CKL1-ASNKE false
78.218.236.140
 unknown France
12322 PROXADFR false
181.18.62.83
 unknown Venezuela
27889 TelecomunicacionesMOVILNETVE false
172.152.49.110
 unknown United States
7018 ATT-INTERNET4US false
92.83.24.178
 unknown Romania
9050 RTDBucharestRomaniaRO false
39.64.200.116
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
4.81.153.118
 unknown United States
3356 LEVEL3US false
19.108.160.107
 unknown United States
3 MIT-GATEWAYSUS false
124.229.96.184
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
87.74.162.63
 unknown United Kingdom
25310 ASN-CWACCESSGB false
57.252.125.35
 unknown Belgium
2686 ATGS-MMD-ASUS false
60.137.207.70
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
196.86.186.135
 unknown Morocco
6713 IAM-ASMA false
208.93.2.243
 unknown United States
20419 NETBLK-DMRCOMUS false
118.181.224.157
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
125.150.108.30
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
41.183.96.133
 unknown South Africa
37028 FNBCONNECTZA false
172.195.226.39
 unknown Australia
18747 IFX18747US false
97.21.13.245
 unknown United States
22394 CELLCOUS false
84.95.60.115
 unknown Israel
9116 GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste false
124.248.198.79
 unknown Hong Kong
4646 SUNNYVISIONSunnyVisionLimitedHK false
118.85.231.198
 unknown China
4809 CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr false
5.130.60.48
 unknown Russian Federation
31200 NTKIPv6customersRU false
88.46.176.34
 unknown Italy
3269 ASN-IBSNAZIT false
91.130.14.14
 unknown Austria
1257 TELE2EU false
112.0.135.246
 unknown China
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
91.52.65.166
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
132.246.240.173
 unknown Canada
25689 SSC-299-25689CA false
100.57.32.230
 unknown United States
701 UUNETUS false
211.41.216.119
 unknown Korea Republic of
9943 KNCTV-ASKangNamCableTVKR false
161.58.239.216
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
178.211.49.197
 unknown Turkey
42926 RADORETR false
114.201.2.14
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
57.213.33.248
 unknown Belgium
2686 ATGS-MMD-ASUS false
126.85.3.177
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
76.226.164.60
 unknown United States
7018 ATT-INTERNET4US false
126.3.138.66
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
177.72.20.48
 unknown Brazil
262691 CONECTALTDABR false
114.165.235.177
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
70.108.52.29
 unknown United States
701 UUNETUS false
60.141.152.168
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
12.125.15.35
 unknown United States
7018 ATT-INTERNET4US false
118.128.100.237
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
143.152.230.1
 unknown United States
385 AFCONC-BLOCK1-ASUS false
31.64.109.81
 unknown United Kingdom
12576 EELtdGB false
42.3.185.111
 unknown Hong Kong
4760 HKTIMS-APHKTLimitedHK false
89.187.44.123
 unknown Moldova Republic of
25129 MONITORING-ASMD false
135.232.5.21
 unknown United States
10455 LUCENT-CIOUS false
154.10.35.122
 unknown Korea Republic of
9578 CJNET-ASCheiljedangCoIncKR false
128.227.72.73
 unknown United States
6356 NERDCNETUS false
117.47.253.132
 unknown Thailand
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
76.201.244.112
 unknown United States
7018 ATT-INTERNET4US false
36.158.136.114
 unknown China
56047 CMNET-HUNAN-APChinaMobilecommunicationscorporationCN false
117.106.133.114
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
53.113.156.205
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
80.48.28.80
 unknown Poland
5617 TPNETPL false
163.175.224.201
 unknown Netherlands
57506 ASN-PDMTNO false
179.172.101.86
 unknown Brazil
26599 TELEFONICABRASILSABR false
81.58.17.231
 unknown Belgium
13127 VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo false
2.126.221.17
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
151.30.126.81
 unknown Italy
1267 ASN-WINDTREIUNETEU false
197.75.183.150
 unknown South Africa
16637 MTNNS-ASZA false
188.125.174.125
 unknown Turkey
49632 DATATELEKOMTR false
111.240.86.162
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
70.98.251.121
 unknown United States
10587 FIBERPIPEUS false
178.198.202.29
 unknown Switzerland
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
119.145.130.27
 unknown China
134764 CT-FOSHAN-IDCCHINANETGuangdongprovincenetworkCN false
218.48.113.16
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
197.73.132.129
 unknown South Africa
16637 MTNNS-ASZA false
160.13.162.120
 unknown Japan 2497 IIJInternetInitiativeJapanIncJP false
130.254.133.105
 unknown United States
18759 SAV-ASUS false
32.17.114.188
 unknown United States
2686 ATGS-MMD-ASUS false
43.160.107.77
 unknown Japan 4249 LILLY-ASUS false
148.76.99.191
 unknown United States
6128 CABLE-NET-1US false
95.194.237.230
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
39.32.71.178
 unknown Pakistan
45595 PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK false
46.198.63.212
 unknown Cyprus
6866 CYTA-NETWORKInternetServicesCY false
17.139.169.80
 unknown United States
714 APPLE-ENGINEERINGUS false
71.137.108.224
 unknown United States
7018 ATT-INTERNET4US false
200.193.105.69
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
195.126.43.153
 unknown Germany
702 UUNETUS false
189.86.165.237
 unknown Brazil
4230 CLAROSABR false
39.126.211.63
 unknown Korea Republic of
7562 HCNSEOCHO-AS-KRHCNDongjakKR false
13.103.83.161
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
175.152.229.198
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
178.17.68.63
 unknown United Kingdom
1273 CWVodafoneGroupPLCEU false
185.226.106.152
 unknown Spain
207046 REDSERVICIOES false
46.92.247.163
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
199.255.120.35
 unknown United States
40627 RC-COLO1US false
2.91.119.2
 unknown Saudi Arabia
25019 SAUDINETSTC-ASSA false
148.119.111.121
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
204.211.64.111
 unknown United States
6559 NCIHUS false
181.201.185.172
 unknown Chile
7418 TELEFONICACHILESACL false
41.121.55.44
 unknown South Africa
16637 MTNNS-ASZA false
48.160.163.212
 unknown United States
2686 ATGS-MMD-ASUS false
189.3.115.151
 unknown Brazil
4230 CLAROSABR false
161.106.193.148
 unknown France
2278 ORANGELABSOrangeLabsOLPSEU false
66.191.240.163
 unknown United States
20115 CHARTER-20115US false
98.137.186.220
 unknown United States
36647 YAHOO-GQ1US false
179.205.121.74
 unknown Brazil
26615 TIMSABR false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.33.108 true