Linux Analysis Report iKuUJ0F8Du

Overview

General Information

Sample Name:	iKuUJ0F8Du
Analysis ID:	519722
MD5:	5d0d54974ca6c1262372b7292ff1eb70
SHA1:	00bdfd4f35dd30e1c049648cf5d8cffaf70cddd0
SHA256:	8126a9a1a562576157434656d620574ce14b6db55b8c37bc6341c0bf1664820e
Tags:	32elfmirairenesas
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample tries to kill many processes (SIGKILL)

Reads system files that contain records of logged in users

Uses known network protocols on non-standard ports

Sample reads /proc/mounts (often used for finding a writable filesystem)

Reads CPU information from /sys indicative of miner or evasive malware

Executes the "grep" command used to find patterns in files or piped streams

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Deletes log files

Creates hidden files and/or directories

Sample has stripped symbol table

Sample tries to set the executable flag

Executes commands using a shell command-line interpreter

Classification

Signatures

AV Detection:

Multi AV Scanner detection for submitted file

Source: iKuUJ0F8Du	Virustotal: Detection: 37%			Perma Link
Source: iKuUJ0F8Du	ReversingLabs: Detection: 25%

Bitcoin Miner:

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/lib/xorg/Xorg (PID: 5393)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5441)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5502)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5512)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5542)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5422)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5856)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: unknown

HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:37342 version: TLS 1.2

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 222.252.187.30:23 -> 192.168.2.23:37590
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 222.252.187.30:23 -> 192.168.2.23:37590
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:50990
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:50990
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51010
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51010
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51032
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51032
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51080
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51080
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51118
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51118
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51138
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51138
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.235.162.242:23 -> 192.168.2.23:51578
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51146
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51146
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51162
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51162
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51176
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51176
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51196
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51196
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.217.174.74:23 -> 192.168.2.23:35172
Source: Traffic	Snort IDS: 716 INFO TELNET access 45.226.126.212:23 -> 192.168.2.23:39786
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51242
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51242
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51308
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51308
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.235.162.242:23 -> 192.168.2.23:51760
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 116.50.205.58:23 -> 192.168.2.23:49738
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 116.50.205.58:23 -> 192.168.2.23:49738
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51392
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51392
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 185.139.182.130:23 -> 192.168.2.23:48178
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 185.139.182.130:23 -> 192.168.2.23:48178
Source: Traffic	Snort IDS: 716 INFO TELNET access 45.226.126.212:23 -> 192.168.2.23:40012
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51490
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51490
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51556
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51556
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51622
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51622
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 222.252.187.30:23 -> 192.168.2.23:38616
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 222.252.187.30:23 -> 192.168.2.23:38616
Source: Traffic	Snort IDS: 716 INFO TELNET access 45.226.126.212:23 -> 192.168.2.23:40236
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.235.162.242:23 -> 192.168.2.23:52088
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51680
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 14.247.39.69:23 -> 192.168.2.23:43366
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 14.247.39.69:23 -> 192.168.2.23:43366
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51680
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51714
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51714
Source: Traffic	Snort IDS: 716 INFO TELNET access 1.181.80.102:23 -> 192.168.2.23:48134
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51740
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 5.28.158.153:23 -> 192.168.2.23:33022
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 5.28.158.153:23 -> 192.168.2.23:33022
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51740
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 185.139.182.130:23 -> 192.168.2.23:48606
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 185.139.182.130:23 -> 192.168.2.23:48606
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51762
Source: Traffic	Snort IDS: 716 INFO TELNET access 45.226.126.212:23 -> 192.168.2.23:40332
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51762
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.181.80.102:23 -> 192.168.2.23:48134
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51782
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51782
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 116.50.205.58:23 -> 192.168.2.23:50268
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 116.50.205.58:23 -> 192.168.2.23:50268
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51800
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51800
Source: Traffic	Snort IDS: 716 INFO TELNET access 1.181.80.102:23 -> 192.168.2.23:48214
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 114.98.62.185:23 -> 192.168.2.23:37096
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51812
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51812
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51830
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51830
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.181.80.102:23 -> 192.168.2.23:48214
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51842
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.235.162.242:23 -> 192.168.2.23:52290
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51842
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 185.139.182.130:23 -> 192.168.2.23:48734
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 185.139.182.130:23 -> 192.168.2.23:48734
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 5.28.158.153:23 -> 192.168.2.23:33156
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 5.28.158.153:23 -> 192.168.2.23:33156
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51860
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51860
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 114.98.62.185:23 -> 192.168.2.23:37160
Source: Traffic	Snort IDS: 716 INFO TELNET access 1.181.80.102:23 -> 192.168.2.23:48284
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51886
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.181.80.102:23 -> 192.168.2.23:48284
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.217.174.74:23 -> 192.168.2.23:35884
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51886
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51940
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51940
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 116.50.205.58:23 -> 192.168.2.23:50444
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 116.50.205.58:23 -> 192.168.2.23:50444
Source: Traffic	Snort IDS: 716 INFO TELNET access 1.181.80.102:23 -> 192.168.2.23:48366
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 89.21.217.221:23 -> 192.168.2.23:51464
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 89.21.217.221:23 -> 192.168.2.23:51464
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 185.139.182.130:23 -> 192.168.2.23:48846
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 185.139.182.130:23 -> 192.168.2.23:48846
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 5.28.158.153:23 -> 192.168.2.23:33282
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 5.28.158.153:23 -> 192.168.2.23:33282
Source: Traffic	Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.23:52414 -> 124.235.162.242:23
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.235.162.242:23 -> 192.168.2.23:52414
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 114.98.62.185:23 -> 192.168.2.23:37276
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.181.80.102:23 -> 192.168.2.23:48366
Source: Traffic	Snort IDS: 716 INFO TELNET access 1.181.80.102:23 -> 192.168.2.23:48450
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 114.98.62.185:23 -> 192.168.2.23:37348
Source: Traffic	Snort IDS: 716 INFO TELNET access 42.112.23.219:23 -> 192.168.2.23:42172
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.181.80.102:23 -> 192.168.2.23:48450
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 185.139.182.130:23 -> 192.168.2.23:48964
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 185.139.182.130:23 -> 192.168.2.23:48964
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 5.28.158.153:23 -> 192.168.2.23:33402
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 5.28.158.153:23 -> 192.168.2.23:33402
Source: Traffic	Snort IDS: 716 INFO TELNET access 45.226.126.212:23 -> 192.168.2.23:40678
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.235.162.242:23 -> 192.168.2.23:52550
Source: Traffic	Snort IDS: 716 INFO TELNET access 1.181.80.102:23 -> 192.168.2.23:48528

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58492
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58518
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58542
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58544
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58546
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58550
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58552
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58562
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58576
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58592
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58614
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58634
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58654
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58664
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58676
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58728
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58738
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58746
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58760
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58770
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58760
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58788
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58802
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58812
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58824
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58840
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58850
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58856
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58864
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33326
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33336
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33342
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33356
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33368
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33382
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33396
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33404
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33420
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33440
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33454
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33474
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33498
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33518
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33534
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33554
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33576
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33598
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33618
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33634
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33646
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33660
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33674
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33688
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33704
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33716
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33728
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33744

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.23:48594 -> 144.172.71.18:40485

Sample listens on a socket

Source: /tmp/iKuUJ0F8Du (PID: 5240)	Socket: 0.0.0.0::23	Jump to behavior
Source: /usr/sbin/sshd (PID: 5294)	Socket: 0.0.0.0::22	Jump to behavior
Source: /usr/sbin/sshd (PID: 5294)	Socket: [::]::22	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5337)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5338)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5393)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5440)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/bin/ibus-daemon (PID: 5797)	Socket: <unknown socket type>:unknown	Jump to behavior

Source: unknown	Network traffic detected: HTTP traffic on port 37342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37342
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 174.89.72.56
Source: unknown	TCP traffic detected without corresponding DNS query: 149.86.186.166
Source: unknown	TCP traffic detected without corresponding DNS query: 47.93.131.56
Source: unknown	TCP traffic detected without corresponding DNS query: 222.162.189.165
Source: unknown	TCP traffic detected without corresponding DNS query: 181.233.194.143
Source: unknown	TCP traffic detected without corresponding DNS query: 79.225.197.57
Source: unknown	TCP traffic detected without corresponding DNS query: 19.153.60.212
Source: unknown	TCP traffic detected without corresponding DNS query: 217.68.165.104
Source: unknown	TCP traffic detected without corresponding DNS query: 122.1.8.220
Source: unknown	TCP traffic detected without corresponding DNS query: 145.88.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 39.131.192.57
Source: unknown	TCP traffic detected without corresponding DNS query: 68.182.107.90
Source: unknown	TCP traffic detected without corresponding DNS query: 139.101.34.94
Source: unknown	TCP traffic detected without corresponding DNS query: 39.171.8.54
Source: unknown	TCP traffic detected without corresponding DNS query: 204.211.193.128
Source: unknown	TCP traffic detected without corresponding DNS query: 47.129.59.188
Source: unknown	TCP traffic detected without corresponding DNS query: 203.235.112.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.32.204.136
Source: unknown	TCP traffic detected without corresponding DNS query: 119.26.140.105
Source: unknown	TCP traffic detected without corresponding DNS query: 168.2.60.189
Source: unknown	TCP traffic detected without corresponding DNS query: 204.245.58.135
Source: unknown	TCP traffic detected without corresponding DNS query: 79.99.54.155
Source: unknown	TCP traffic detected without corresponding DNS query: 70.84.6.13
Source: unknown	TCP traffic detected without corresponding DNS query: 38.128.235.150
Source: unknown	TCP traffic detected without corresponding DNS query: 91.9.8.196
Source: unknown	TCP traffic detected without corresponding DNS query: 185.145.196.5
Source: unknown	TCP traffic detected without corresponding DNS query: 31.83.16.4
Source: unknown	TCP traffic detected without corresponding DNS query: 130.130.3.105
Source: unknown	TCP traffic detected without corresponding DNS query: 135.43.119.37
Source: unknown	TCP traffic detected without corresponding DNS query: 130.140.189.113
Source: unknown	TCP traffic detected without corresponding DNS query: 120.229.202.123
Source: unknown	TCP traffic detected without corresponding DNS query: 174.154.191.221
Source: unknown	TCP traffic detected without corresponding DNS query: 45.11.237.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.63.65.9
Source: unknown	TCP traffic detected without corresponding DNS query: 132.239.155.245
Source: unknown	TCP traffic detected without corresponding DNS query: 112.245.99.73
Source: unknown	TCP traffic detected without corresponding DNS query: 160.108.198.216
Source: unknown	TCP traffic detected without corresponding DNS query: 211.49.175.121
Source: unknown	TCP traffic detected without corresponding DNS query: 120.178.136.178
Source: unknown	TCP traffic detected without corresponding DNS query: 220.94.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 113.81.101.237
Source: unknown	TCP traffic detected without corresponding DNS query: 212.131.174.251
Source: unknown	TCP traffic detected without corresponding DNS query: 97.80.128.84
Source: unknown	TCP traffic detected without corresponding DNS query: 17.89.244.78
Source: unknown	TCP traffic detected without corresponding DNS query: 12.147.182.29
Source: unknown	TCP traffic detected without corresponding DNS query: 13.165.74.106
Source: unknown	TCP traffic detected without corresponding DNS query: 182.166.187.219
Source: unknown	TCP traffic detected without corresponding DNS query: 221.119.150.172
Source: unknown	TCP traffic detected without corresponding DNS query: 206.101.173.175
Source: unknown	TCP traffic detected without corresponding DNS query: 164.160.248.135

Source: Xorg.0.log.86.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.86.dr	String found in binary or memory: http://www.ubuntu.com/support)

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

Source: unknown

HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:37342 version: TLS 1.2

System Summary:

Sample tries to kill many processes (SIGKILL)

Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1888, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	SIGKILL sent: pid: 5495, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	SIGKILL sent: pid: 5845, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	SIGKILL sent: pid: 6079, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	SIGKILL sent: pid: 5879, result: successful	Jump to behavior

Sample tries to kill a process (SIGKILL)

Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1888, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	SIGKILL sent: pid: 5495, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	SIGKILL sent: pid: 5845, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	SIGKILL sent: pid: 6079, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	SIGKILL sent: pid: 5879, result: successful	Jump to behavior

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Source: iKuUJ0F8Du

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: classification engine

Classification label: mal80.spre.troj.lin@0/51@3/0

Persistence and Installation Behavior:

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5337)	File: /proc/5337/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File: /proc/5439/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File: /proc/5501/mounts	Jump to behavior
Source: /usr/bin/gjs (PID: 6080)	File: /proc/6080/mounts	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5542)	File: /proc/5542/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5443)	File: /proc/5443/mounts

Executes the "grep" command used to find patterns in files or piped streams

Source: /bin/sh (PID: 5326)

Grep executable: /usr/bin/grep -> grep -F .utf8

Jump to behavior

Enumerates processes within the "proc" file system

Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1582/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2033/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/670/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/793/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1579/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1699/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/674/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1335/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2028/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/675/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/796/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1334/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1532/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1576/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/797/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/676/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/677/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2025/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/799/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/910/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/912/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/517/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/759/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/918/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1594/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1349/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/761/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/840/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/884/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1389/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1983/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2038/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/720/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1344/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1465/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1586/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/721/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1463/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/800/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/801/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/847/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1900/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/491/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1877/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2009/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/772/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1599/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/774/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1477/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/654/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/896/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1476/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1872/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/655/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1475/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/656/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/777/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/657/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/658/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/419/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/936/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1809/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1494/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1890/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1888/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1601/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/420/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1886/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2018/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1489/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/785/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2014/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1320/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/788/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/667/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/789/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/904/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1207/exe	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/6100/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5441/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/6102/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/6112/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/6123/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5542/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5883/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/6103/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5501/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5501/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5512/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5844/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6098/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6111/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5440/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5440/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6113/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5441/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6112/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5542/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5883/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6106/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5797/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6105/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6108/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5439/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5439/attr/current	Jump to behavior

Creates hidden files and/or directories

Source: /usr/bin/whoopsie (PID: 5286)	Directory: /nonexistent/.cache			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5307)	Directory: /root/.cache			Jump to behavior

Sample tries to set the executable flag

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5307)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5307)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)			Jump to behavior

Executes commands using a shell command-line interpreter

Source: /usr/share/language-tools/language-options (PID: 5324)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5427)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5849)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""	Jump to behavior

Source: /usr/lib/xorg/Xorg (PID: 5393)

Log file created: /var/log/Xorg.0.log

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58492
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58518
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58542
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58544
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58546
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58550
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58552
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58562
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58576
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58592
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58614
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58634
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58654
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58664
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58676
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58728
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58738
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58746
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58760
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58770
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58760
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58788
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58802
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58812
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58824
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58840
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58850
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58856
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58864
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33326
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33336
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33342
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33356
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33368
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33382
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33396
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33404
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33420
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33440
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33454
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33474
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33498
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33518
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33534
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33554
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33576
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33598
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33618
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33634
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33646
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33660
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33674
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33688
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33704
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33716
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33728
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33744

Malware Analysis System Evasion:

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/lib/xorg/Xorg (PID: 5393)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5441)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5502)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5512)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5542)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5422)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5856)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/iKuUJ0F8Du (PID: 5234)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5286)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5327)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5338)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5386)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-x-session (PID: 5391)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5393)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/at-spi-bus-launcher (PID: 5496)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/at-spi2-registryd (PID: 5883)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5440)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5441)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5502)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5512)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5542)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 5844)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-wacom (PID: 6100)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-color (PID: 6102)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-keyboard (PID: 6103)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-smartcard (PID: 6108)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6112)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-power (PID: 6123)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5422)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5856)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6148)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6753)	Queries kernel information via 'uname':

Deletes log files

Source: /usr/lib/xorg/Xorg (PID: 5393)

Truncated file: /var/log/Xorg.pid-5393.log

Jump to behavior

Source: Xorg.0.log.86.dr	Binary or memory string: [ 482.289] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.380] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.574] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.837] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.246] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.088] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.271] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.502] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.968] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.945] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.704] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.169] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.257] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.063] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.100] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.007] (--) vmware(0): bpp: 32
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.101] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.971] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.146] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: iKuUJ0F8Du, 5240.1.0000000069bb2f5e.00000000525e272c.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.710] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.746] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.825] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.449] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.832] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.790] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 494.073] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.252] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.766] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: iKuUJ0F8Du, 5234.1.00000000e3ab1f20.0000000018b0d825.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.247] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.866] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.897] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.207] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.004] (--) vmware(0): depth: 24
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.814] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.105] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.357] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.411] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.427] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.949] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.901] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.395] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.464] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.475] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.320] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.505] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.116] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.266] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.461] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.649] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.376] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.098] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.826] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.950] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.261] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.191] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.080] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.965] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.297] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.199] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.939] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.86.dr	Binary or memory string: [ 494.053] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.964] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.879] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 486.411] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.041] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.128] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.513] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.823] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.336] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.996] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.945] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.084] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.315] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.735] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.054] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.179] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.845] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.228] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 494.045] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.425] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.589] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.487] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.527] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.692] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.521] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.465] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.133] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.414] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.279] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.518] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.406] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.407] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.424] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.430] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.310] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.524] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.699] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.457] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.212] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: iKuUJ0F8Du, 5234.1.00000000e3ab1f20.0000000018b0d825.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/iKuUJ0F8DuSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/iKuUJ0F8Du
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.722] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.991] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.937] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.941] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.152] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.011] (--) vmware(0): w.red: 8
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.918] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.794] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.739] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.045] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.137] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.469] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.450] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.325] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.301] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.442] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.887] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.906] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.045] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.800] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.211] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 486.392] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.839] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.222] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: iKuUJ0F8Du, 5234.1.000000009ae5eebd.0000000069bb2f5e.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.647] (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.537] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.952] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.862] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: iKuUJ0F8Du, 5240.1.000000009ae5eebd.0000000069bb2f5e.rw-.sdmp	Binary or memory string: U!/usr/bin/vmtoolsd
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.020] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.86.dr	Binary or memory string: [ 482.265] (II) LoadModule: "vmware"
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.371] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.441] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.438] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.743] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.933] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.453] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.831] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.829] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.748] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.028] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 494.001] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.688] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.753] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.842] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.843] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.395] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.774] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.989] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.494] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.922] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.336] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.234] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.279] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.577] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.685] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.223] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.350] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.331] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.977] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.347] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: iKuUJ0F8Du, 5240.1.000000009ae5eebd.0000000069bb2f5e.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.141] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.240] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.955] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.852] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.600] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.015] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.399] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.783] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.856] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.548] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.749] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.129] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.547] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.653] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.407] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.940] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.283] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.125] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.951] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.990] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.757] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.424] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.793] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.742] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.292] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.262] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.810] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.106] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.640] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.591] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.112] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.120] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.094] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.300] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.483] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.870] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.055] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.084] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.687] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.880] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.629] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.721] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.985] (--) vmware(0): bpp: 32
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.534] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.186] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.883] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.434] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.707] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.717] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.059] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.724] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.544] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.567] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.773] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.415] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.098] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.807] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.074] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.531] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.036] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.700] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.390] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.820] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.836] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.776] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.731] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.796] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.342] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.313] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.926] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.540] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 486.154] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.545] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.929] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 486.170] (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.288] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.981] (--) vmware(0): depth: 24
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.515] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.803] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.367] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.165] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.183] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.385] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.498] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.551] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.680] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: iKuUJ0F8Du, 5234.1.000000009ae5eebd.0000000069bb2f5e.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.305] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.884] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.352] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.433] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.817] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.512] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.203] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 486.175] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.696] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.910] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.779] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.612] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.786] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.187] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.216] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.420] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.752] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.714] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.972] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.779] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.195] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.892] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 482.233] (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.86.dr	Binary or memory string: [ 482.592] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.000] (--) vmware(0): mheig: 885
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.562] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.024] (--) vmware(0): vis: 4
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.160] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.292] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.621] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.693] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.996] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.490] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.728] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.972] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.108] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.672] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.050] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.663] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.874] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.234] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.993] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.451] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.029] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.150] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.136] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.467] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.362] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.999] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.067] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.849] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.763] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.037] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.445] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.020] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.326] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.914] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 486.403] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.403] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.555] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.118] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.156] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.524] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.769] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.509] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.677] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)

Language, Device and Operating System Detection:

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5307)

Logged in records file read: /var/log/wtmp

Jump to behavior

Stealing of Sensitive Information:

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality:

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
113.20.79.14	unknown	Fiji	9241	FINTEL-FJFijiInternationalTelecomunicationsLtdFJ	false
114.19.7.216	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
95.56.132.187	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
101.83.192.210	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
132.118.40.110	unknown	United States	306	DNIC-ASBLK-00306-00371US	false
178.244.63.176	unknown	Turkey	16135	TURKCELL-ASTurkcellASTR	false
186.178.15.149	unknown	Ecuador	28006	CORPORACIONNACIONALDETELECOMUNICACIONES-CNTEPEC	false
4.250.17.37	unknown	United States	3356	LEVEL3US	false
220.142.93.152	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
20.167.89.117	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
5.144.113.94	unknown	Russian Federation	8359	MTSRU	false
103.203.177.190	unknown	Bangladesh	64074	ABS-AS-APAlphaBroadwaySystemBD	false
93.1.71.253	unknown	France	15557	LDCOMNETFR	false
155.106.187.199	unknown	United States	7018	ATT-INTERNET4US	false
2.202.212.208	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
125.70.125.254	unknown	China	38283	CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData	false
27.231.70.48	unknown	Japan	9605	DOCOMONTTDOCOMOINCJP	false
172.175.150.76	unknown	United States	7018	ATT-INTERNET4US	false
163.199.10.38	unknown	South Africa	62355	NETWORKDEDICATEDCH	false
212.70.88.189	unknown	United Kingdom	16174	INTUITIV-ASIntuitivAutonomousSystemGB	false
203.220.124.122	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	false
211.92.196.254	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
150.94.230.212	unknown	Japan	6400	CompaniaDominicanadeTelefonosSADO	false
35.87.63.27	unknown	United States	237	MERIT-AS-14US	false
34.217.111.207	unknown	United States	16509	AMAZON-02US	false
79.117.211.246	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	false
138.106.222.182	unknown	Sweden	202116	SCANIA-ASSE	false
162.177.80.187	unknown	United States	21928	T-MOBILE-AS21928US	false
73.208.247.16	unknown	United States	7922	COMCAST-7922US	false
14.122.106.86	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
102.73.57.244	unknown	Morocco	6713	IAM-ASMA	false
94.99.157.11	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
217.156.238.227	unknown	United Kingdom	3549	LVLT-3549US	false
43.188.171.218	unknown	Japan	4249	LILLY-ASUS	false
95.218.217.74	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
27.126.160.205	unknown	Japan	18136	CTAJupiterTelecommunicationsCoLtdJP	false
77.183.61.140	unknown	Germany	6805	TDDE-ASN1DE	false
1.252.254.88	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
167.33.111.196	unknown	Canada	2665	CDAGOVNCA	false
107.210.249.239	unknown	United States	7018	ATT-INTERNET4US	false
148.185.5.243	unknown	European Union	3423	ATTIS-ASN3423US	false
65.171.81.59	unknown	United States	14574	RTCCOMUS	false
118.31.165.102	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
109.102.110.68	unknown	Romania	9050	RTDBucharestRomaniaRO	false
77.137.149.132	unknown	France	12849	HOTNET-ILAMS-IXAdminLANIL	false
87.160.4.220	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
46.220.227.113	unknown	Austria	25255	H3G-AUSTRIA-ASTELE2AUSTRIAAT	false
92.233.183.87	unknown	United Kingdom	5089	NTLGB	false
203.251.232.156	unknown	Korea Republic of	4670	HYUNDAI-KRShinbiroKR	false
168.54.241.222	unknown	United States	1761	TDIR-CAPNETUS	false
176.213.216.154	unknown	Russian Federation	51645	IRKUTSK-ASRU	false
87.248.96.208	unknown	United Kingdom	34010	YAHOO-IRDGB	false
186.148.170.212	unknown	Colombia	262186	TVAZTECASUCURSALCOLOMBIACO	false
95.42.34.111	unknown	Bulgaria	8866	BTC-ASBULGARIABG	false
34.137.212.25	unknown	United States	2686	ATGS-MMD-ASUS	false
133.74.84.34	unknown	Japan	3488	JAXANETInformationSystemsDepartmentJapanAerospaceExpl	false
151.156.34.66	unknown	Sweden	205664	VATTENFALL-ABSE	false
187.4.255.134	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
36.25.171.111	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
34.63.62.104	unknown	United States	2686	ATGS-MMD-ASUS	false
64.122.113.225	unknown	United States	7385	ALLSTREAMUS	false
194.144.206.241	unknown	Iceland	12969	VODAFONE_ICELANDIS	false
116.23.217.123	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
40.158.39.96	unknown	United States	4249	LILLY-ASUS	false
84.50.189.177	unknown	Estonia	3249	ESTPAKEE	false
189.35.34.46	unknown	Brazil	28573	CLAROSABR	false
97.206.178.30	unknown	United States	6167	CELLCO-PARTUS	false
76.233.154.253	unknown	United States	7018	ATT-INTERNET4US	false
69.222.238.0	unknown	United States	7018	ATT-INTERNET4US	false
71.107.114.137	unknown	United States	701	UUNETUS	false
211.76.83.31	unknown	Taiwan; Republic of China (ROC)	9676	SAVECOM-TWSaveComInternationIncTW	false
173.72.114.191	unknown	United States	701	UUNETUS	false
88.116.83.42	unknown	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
148.38.9.227	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
208.41.137.87	unknown	United States	4565	MEGAPATH2-US	false
32.149.172.222	unknown	United States	2686	ATGS-MMD-ASUS	false
45.12.142.175	unknown	Latvia	35913	DEDIPATH-LLCUS	false
192.63.149.28	unknown	United States	unknown	unknown	false
40.128.249.36	unknown	United States	7029	WINDSTREAMUS	false
157.182.220.56	unknown	United States	12118	WVUUS	false
103.183.119.94	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
161.12.105.187	unknown	United Kingdom	61231	SSE-TELECOMSGB	false
38.123.47.200	unknown	United States	40166	DAEMEN-COLLEGEUS	false
157.77.88.7	unknown	Japan	4678	FINECanonITSolutionsIncJP	false
64.37.144.131	unknown	United States	13720	SONYONLINEUS	false
105.10.82.96	unknown	South Africa	37168	CELL-CZA	false
113.161.130.102	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
48.49.138.120	unknown	United States	2686	ATGS-MMD-ASUS	false
86.44.104.208	unknown	Ireland	5466	EIRCOMInternetHouseIE	false
19.161.5.47	unknown	United States	3	MIT-GATEWAYSUS	false
117.12.214.166	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
196.241.209.180	unknown	Seychelles	37518	FIBERGRIDSC	false
164.9.224.4	unknown	Sweden	29217	WM-DATASE	false
58.81.27.74	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
77.182.11.56	unknown	Germany	6805	TDDE-ASN1DE	false
37.24.114.121	unknown	Germany	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
213.83.85.152	unknown	United Kingdom	8586	OBSL-ASTalkTalk-BusinessdivisionGB	false
177.72.156.107	unknown	Brazil	52821	TorreseAnselmiLtdaBR	false
204.140.211.89	unknown	United States	226	LOS-NETTOS-ASUS	false
105.11.128.173	unknown	South Africa	37168	CELL-CZA	false

Contacted Domains

Name	IP	Active
daisy.ubuntu.com	162.213.33.132	true

AV Detection:

Multi AV Scanner detection for submitted file

Source: iKuUJ0F8Du	Virustotal: Detection: 37%			Perma Link
Source: iKuUJ0F8Du	ReversingLabs: Detection: 25%

Bitcoin Miner:

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/lib/xorg/Xorg (PID: 5393)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5441)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5502)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5512)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5542)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5422)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5856)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: unknown

HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:37342 version: TLS 1.2

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 222.252.187.30:23 -> 192.168.2.23:37590
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 222.252.187.30:23 -> 192.168.2.23:37590
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:50990
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:50990
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51010
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51010
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51032
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51032
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51080
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51080
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51118
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51118
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51138
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51138
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.235.162.242:23 -> 192.168.2.23:51578
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51146
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51146
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51162
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51162
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51176
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51176
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51196
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51196
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.217.174.74:23 -> 192.168.2.23:35172
Source: Traffic	Snort IDS: 716 INFO TELNET access 45.226.126.212:23 -> 192.168.2.23:39786
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51242
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51242
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51308
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51308
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.235.162.242:23 -> 192.168.2.23:51760
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 116.50.205.58:23 -> 192.168.2.23:49738
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 116.50.205.58:23 -> 192.168.2.23:49738
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51392
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51392
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 185.139.182.130:23 -> 192.168.2.23:48178
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 185.139.182.130:23 -> 192.168.2.23:48178
Source: Traffic	Snort IDS: 716 INFO TELNET access 45.226.126.212:23 -> 192.168.2.23:40012
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51490
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51490
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51556
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51556
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51622
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51622
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 222.252.187.30:23 -> 192.168.2.23:38616
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 222.252.187.30:23 -> 192.168.2.23:38616
Source: Traffic	Snort IDS: 716 INFO TELNET access 45.226.126.212:23 -> 192.168.2.23:40236
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.235.162.242:23 -> 192.168.2.23:52088
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51680
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 14.247.39.69:23 -> 192.168.2.23:43366
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 14.247.39.69:23 -> 192.168.2.23:43366
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51680
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51714
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51714
Source: Traffic	Snort IDS: 716 INFO TELNET access 1.181.80.102:23 -> 192.168.2.23:48134
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51740
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 5.28.158.153:23 -> 192.168.2.23:33022
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 5.28.158.153:23 -> 192.168.2.23:33022
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51740
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 185.139.182.130:23 -> 192.168.2.23:48606
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 185.139.182.130:23 -> 192.168.2.23:48606
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51762
Source: Traffic	Snort IDS: 716 INFO TELNET access 45.226.126.212:23 -> 192.168.2.23:40332
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51762
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.181.80.102:23 -> 192.168.2.23:48134
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51782
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51782
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 116.50.205.58:23 -> 192.168.2.23:50268
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 116.50.205.58:23 -> 192.168.2.23:50268
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51800
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51800
Source: Traffic	Snort IDS: 716 INFO TELNET access 1.181.80.102:23 -> 192.168.2.23:48214
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 114.98.62.185:23 -> 192.168.2.23:37096
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51812
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51812
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51830
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51830
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.181.80.102:23 -> 192.168.2.23:48214
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51842
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.235.162.242:23 -> 192.168.2.23:52290
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51842
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 185.139.182.130:23 -> 192.168.2.23:48734
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 185.139.182.130:23 -> 192.168.2.23:48734
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 5.28.158.153:23 -> 192.168.2.23:33156
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 5.28.158.153:23 -> 192.168.2.23:33156
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51860
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51860
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 114.98.62.185:23 -> 192.168.2.23:37160
Source: Traffic	Snort IDS: 716 INFO TELNET access 1.181.80.102:23 -> 192.168.2.23:48284
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51886
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.181.80.102:23 -> 192.168.2.23:48284
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.217.174.74:23 -> 192.168.2.23:35884
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51886
Source: Traffic	Snort IDS: 716 INFO TELNET access 83.12.207.50:23 -> 192.168.2.23:51940
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 83.12.207.50:23 -> 192.168.2.23:51940
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 116.50.205.58:23 -> 192.168.2.23:50444
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 116.50.205.58:23 -> 192.168.2.23:50444
Source: Traffic	Snort IDS: 716 INFO TELNET access 1.181.80.102:23 -> 192.168.2.23:48366
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 89.21.217.221:23 -> 192.168.2.23:51464
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 89.21.217.221:23 -> 192.168.2.23:51464
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 185.139.182.130:23 -> 192.168.2.23:48846
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 185.139.182.130:23 -> 192.168.2.23:48846
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 5.28.158.153:23 -> 192.168.2.23:33282
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 5.28.158.153:23 -> 192.168.2.23:33282
Source: Traffic	Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.23:52414 -> 124.235.162.242:23
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.235.162.242:23 -> 192.168.2.23:52414
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 114.98.62.185:23 -> 192.168.2.23:37276
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.181.80.102:23 -> 192.168.2.23:48366
Source: Traffic	Snort IDS: 716 INFO TELNET access 1.181.80.102:23 -> 192.168.2.23:48450
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 114.98.62.185:23 -> 192.168.2.23:37348
Source: Traffic	Snort IDS: 716 INFO TELNET access 42.112.23.219:23 -> 192.168.2.23:42172
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 1.181.80.102:23 -> 192.168.2.23:48450
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 185.139.182.130:23 -> 192.168.2.23:48964
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 185.139.182.130:23 -> 192.168.2.23:48964
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 5.28.158.153:23 -> 192.168.2.23:33402
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 5.28.158.153:23 -> 192.168.2.23:33402
Source: Traffic	Snort IDS: 716 INFO TELNET access 45.226.126.212:23 -> 192.168.2.23:40678
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 124.235.162.242:23 -> 192.168.2.23:52550
Source: Traffic	Snort IDS: 716 INFO TELNET access 1.181.80.102:23 -> 192.168.2.23:48528

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58492
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58518
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58542
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58544
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58546
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58550
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58552
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58562
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58576
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58592
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58614
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58634
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58654
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58664
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58676
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58728
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58738
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58746
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58760
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58770
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58760
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58788
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58802
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58812
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58824
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58840
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58850
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58856
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58864
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33326
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33336
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33342
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33356
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33368
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33382
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33396
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33404
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33420
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33440
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33454
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33474
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33498
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33518
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33534
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33554
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33576
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33598
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33618
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33634
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33646
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33660
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33674
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33688
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33704
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33716
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33728
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33744

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.23:48594 -> 144.172.71.18:40485

Sample listens on a socket

Source: /tmp/iKuUJ0F8Du (PID: 5240)	Socket: 0.0.0.0::23	Jump to behavior
Source: /usr/sbin/sshd (PID: 5294)	Socket: 0.0.0.0::22	Jump to behavior
Source: /usr/sbin/sshd (PID: 5294)	Socket: [::]::22	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5337)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5338)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5393)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5440)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/bin/ibus-daemon (PID: 5797)	Socket: <unknown socket type>:unknown	Jump to behavior

Source: unknown	Network traffic detected: HTTP traffic on port 37342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37342
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 174.89.72.56
Source: unknown	TCP traffic detected without corresponding DNS query: 149.86.186.166
Source: unknown	TCP traffic detected without corresponding DNS query: 47.93.131.56
Source: unknown	TCP traffic detected without corresponding DNS query: 222.162.189.165
Source: unknown	TCP traffic detected without corresponding DNS query: 181.233.194.143
Source: unknown	TCP traffic detected without corresponding DNS query: 79.225.197.57
Source: unknown	TCP traffic detected without corresponding DNS query: 19.153.60.212
Source: unknown	TCP traffic detected without corresponding DNS query: 217.68.165.104
Source: unknown	TCP traffic detected without corresponding DNS query: 122.1.8.220
Source: unknown	TCP traffic detected without corresponding DNS query: 145.88.187.20
Source: unknown	TCP traffic detected without corresponding DNS query: 39.131.192.57
Source: unknown	TCP traffic detected without corresponding DNS query: 68.182.107.90
Source: unknown	TCP traffic detected without corresponding DNS query: 139.101.34.94
Source: unknown	TCP traffic detected without corresponding DNS query: 39.171.8.54
Source: unknown	TCP traffic detected without corresponding DNS query: 204.211.193.128
Source: unknown	TCP traffic detected without corresponding DNS query: 47.129.59.188
Source: unknown	TCP traffic detected without corresponding DNS query: 203.235.112.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.32.204.136
Source: unknown	TCP traffic detected without corresponding DNS query: 119.26.140.105
Source: unknown	TCP traffic detected without corresponding DNS query: 168.2.60.189
Source: unknown	TCP traffic detected without corresponding DNS query: 204.245.58.135
Source: unknown	TCP traffic detected without corresponding DNS query: 79.99.54.155
Source: unknown	TCP traffic detected without corresponding DNS query: 70.84.6.13
Source: unknown	TCP traffic detected without corresponding DNS query: 38.128.235.150
Source: unknown	TCP traffic detected without corresponding DNS query: 91.9.8.196
Source: unknown	TCP traffic detected without corresponding DNS query: 185.145.196.5
Source: unknown	TCP traffic detected without corresponding DNS query: 31.83.16.4
Source: unknown	TCP traffic detected without corresponding DNS query: 130.130.3.105
Source: unknown	TCP traffic detected without corresponding DNS query: 135.43.119.37
Source: unknown	TCP traffic detected without corresponding DNS query: 130.140.189.113
Source: unknown	TCP traffic detected without corresponding DNS query: 120.229.202.123
Source: unknown	TCP traffic detected without corresponding DNS query: 174.154.191.221
Source: unknown	TCP traffic detected without corresponding DNS query: 45.11.237.188
Source: unknown	TCP traffic detected without corresponding DNS query: 195.63.65.9
Source: unknown	TCP traffic detected without corresponding DNS query: 132.239.155.245
Source: unknown	TCP traffic detected without corresponding DNS query: 112.245.99.73
Source: unknown	TCP traffic detected without corresponding DNS query: 160.108.198.216
Source: unknown	TCP traffic detected without corresponding DNS query: 211.49.175.121
Source: unknown	TCP traffic detected without corresponding DNS query: 120.178.136.178
Source: unknown	TCP traffic detected without corresponding DNS query: 220.94.27.254
Source: unknown	TCP traffic detected without corresponding DNS query: 113.81.101.237
Source: unknown	TCP traffic detected without corresponding DNS query: 212.131.174.251
Source: unknown	TCP traffic detected without corresponding DNS query: 97.80.128.84
Source: unknown	TCP traffic detected without corresponding DNS query: 17.89.244.78
Source: unknown	TCP traffic detected without corresponding DNS query: 12.147.182.29
Source: unknown	TCP traffic detected without corresponding DNS query: 13.165.74.106
Source: unknown	TCP traffic detected without corresponding DNS query: 182.166.187.219
Source: unknown	TCP traffic detected without corresponding DNS query: 221.119.150.172
Source: unknown	TCP traffic detected without corresponding DNS query: 206.101.173.175
Source: unknown	TCP traffic detected without corresponding DNS query: 164.160.248.135

Source: Xorg.0.log.86.dr	String found in binary or memory: http://wiki.x.org
Source: Xorg.0.log.86.dr	String found in binary or memory: http://www.ubuntu.com/support)

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

Source: unknown

HTTPS traffic detected: 162.213.33.108:443 -> 192.168.2.23:37342 version: TLS 1.2

System Summary:

Sample tries to kill many processes (SIGKILL)

Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1888, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	SIGKILL sent: pid: 5495, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	SIGKILL sent: pid: 5845, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	SIGKILL sent: pid: 6079, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	SIGKILL sent: pid: 5879, result: successful	Jump to behavior

Sample tries to kill a process (SIGKILL)

Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 904, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	SIGKILL sent: pid: 1888, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	SIGKILL sent: pid: 5495, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	SIGKILL sent: pid: 5845, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	SIGKILL sent: pid: 6079, result: successful	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	SIGKILL sent: pid: 5879, result: successful	Jump to behavior

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Source: iKuUJ0F8Du

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: classification engine

Classification label: mal80.spre.troj.lin@0/51@3/0

Persistence and Installation Behavior:

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 5337)	File: /proc/5337/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File: /proc/5439/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File: /proc/5501/mounts	Jump to behavior
Source: /usr/bin/gjs (PID: 6080)	File: /proc/6080/mounts	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5542)	File: /proc/5542/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5443)	File: /proc/5443/mounts

Executes the "grep" command used to find patterns in files or piped streams

Source: /bin/sh (PID: 5326)

Grep executable: /usr/bin/grep -> grep -F .utf8

Jump to behavior

Enumerates processes within the "proc" file system

Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1582/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2033/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/670/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/793/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1579/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1699/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/674/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1335/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2028/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/675/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/796/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1334/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1532/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1576/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/797/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/676/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/677/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2025/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/799/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/910/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/912/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/517/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/759/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/918/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1594/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1349/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/761/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/840/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/884/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1389/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1983/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2038/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/720/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1344/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1465/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1586/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/721/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1463/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/800/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/801/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/847/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1900/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/491/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1877/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2009/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/772/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1599/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/774/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1477/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/654/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/896/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1476/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1872/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/655/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1475/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/656/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/777/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/657/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/658/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/419/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/936/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1809/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1494/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1890/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1888/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1601/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/420/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1886/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2018/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1489/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/785/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/2014/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1320/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/788/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/667/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/789/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/904/exe	Jump to behavior
Source: /tmp/iKuUJ0F8Du (PID: 5240)	File opened: /proc/1207/exe	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/6100/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5441/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/6102/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/6112/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/6123/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5542/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5883/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/6103/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5501/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5501/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5512/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5501)	File opened: /proc/5844/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6098/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6111/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5440/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5440/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6113/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5441/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6112/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5542/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5883/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6106/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5797/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6105/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/6108/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5439/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5439)	File opened: /proc/5439/attr/current	Jump to behavior

Creates hidden files and/or directories

Source: /usr/bin/whoopsie (PID: 5286)	Directory: /nonexistent/.cache			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5307)	Directory: /root/.cache			Jump to behavior

Sample tries to set the executable flag

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5307)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5307)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)			Jump to behavior

Executes commands using a shell command-line interpreter

Source: /usr/share/language-tools/language-options (PID: 5324)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5427)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5849)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""	Jump to behavior

Source: /usr/lib/xorg/Xorg (PID: 5393)

Log file created: /var/log/Xorg.0.log

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58492
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58518
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58542
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58544
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58546
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58550
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58552
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58562
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58576
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58592
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58614
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58634
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58654
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58664
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58676
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58728
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58738
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58746
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58760
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58770
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58760
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58788
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58802
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58812
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58824
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58840
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58850
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58856
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58864
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33326
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33336
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33342
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33356
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33368
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33382
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33396
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33404
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33420
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33440
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33454
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33474
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33498
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33518
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33534
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33554
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33576
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33598
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33618
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33634
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33646
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33660
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33674
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33688
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33704
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33716
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33728
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33744

Malware Analysis System Evasion:

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/lib/xorg/Xorg (PID: 5393)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5441)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5502)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5512)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5542)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 5422)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 5856)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/iKuUJ0F8Du (PID: 5234)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/whoopsie (PID: 5286)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5327)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5338)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 5386)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-x-session (PID: 5391)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/xorg/Xorg (PID: 5393)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/at-spi-bus-launcher (PID: 5496)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/at-spi2-registryd (PID: 5883)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-binary (PID: 5440)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated (PID: 5441)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gl-helper (PID: 5502)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gnome-session-check-accelerated-gles-helper (PID: 5512)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5542)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 5844)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-wacom (PID: 6100)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-color (PID: 6102)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-keyboard (PID: 6103)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-smartcard (PID: 6108)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6112)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-power (PID: 6123)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5422)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 5856)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-hostnamed (PID: 6148)	Queries kernel information via 'uname':
Source: /usr/libexec/fprintd (PID: 6753)	Queries kernel information via 'uname':

Deletes log files

Source: /usr/lib/xorg/Xorg (PID: 5393)

Truncated file: /var/log/Xorg.pid-5393.log

Jump to behavior

Source: Xorg.0.log.86.dr	Binary or memory string: [ 482.289] (II) Loading /usr/lib/xorg/modules/drivers/vmware_drv.so
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.380] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.574] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.837] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.246] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.088] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.271] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.502] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.968] (II) vmware(0): Modeline "640x350"x85.1 31.50 640 672 736 832 350 382 385 445 +hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.945] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.704] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.169] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.257] (II) vmware(0): Not using default mode "1792x1344" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.063] (II) vmware(0): Not using default mode "320x175" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.100] (II) vmware: driver for VMware SVGA: vmware0405, vmware0710
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.007] (--) vmware(0): bpp: 32
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.101] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.971] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 9)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.146] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: iKuUJ0F8Du, 5240.1.0000000069bb2f5e.00000000525e272c.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.710] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.746] (II) vmware(0): Modeline "1152x864"x100.0 143.47 1152 1232 1360 1568 864 865 868 915 -hsync +vsync (91.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.825] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.449] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.832] (**) vmware(0): Default mode "960x540": 40.8 MHz, 33.5 kHz, 59.6 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.790] (II) vmware(0): Modeline "1152x864"x60.0 81.62 1152 1216 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 494.073] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse0)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.252] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.766] (**) vmware(0): Default mode "1152x864": 108.0 MHz, 67.5 kHz, 75.0 Hz
Source: iKuUJ0F8Du, 5234.1.00000000e3ab1f20.0000000018b0d825.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.247] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.866] (II) vmware(0): Modeline "800x600"x60.3 40.00 800 840 968 1056 600 601 605 628 +hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.897] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.5 kHz, 75.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.207] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.004] (--) vmware(0): depth: 24
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.814] (**) vmware(0): Default mode "1024x768": 65.0 MHz, 48.4 kHz, 60.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.105] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.357] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.411] (II) vmware(0): Not using default mode "1600x1024" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.427] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.949] (II) vmware(0): Modeline "640x360"x59.8 18.00 640 664 720 800 360 363 368 376 -hsync +vsync (22.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.901] (II) vmware(0): Modeline "640x480"x75.0 31.50 640 656 720 840 480 481 484 500 -hsync -vsync (37.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.395] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.464] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.475] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.320] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.505] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.116] (II) vmware(0): Not using default mode "1024x768i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.266] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.461] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.649] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.376] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.098] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.826] (**) vmware(0): Default mode "832x624": 57.3 MHz, 49.7 kHz, 74.6 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.950] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.261] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.191] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.080] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.965] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.297] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.199] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.939] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.86.dr	Binary or memory string: [ 494.053] (II) event2 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.964] (**) vmware(0): Default mode "640x350": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.879] (**) vmware(0): Default mode "864x486": 32.5 MHz, 30.3 kHz, 59.9 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 486.411] (II) vmware(0): Initialized VMware Xv extension successfully.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.041] (==) vmware(0): Default visual is TrueColor
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.128] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.513] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.823] (II) vmware(0): Modeline "1024x576"x59.9 46.50 1024 1064 1160 1296 576 579 584 599 -hsync +vsync (35.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.336] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.996] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.945] (**) vmware(0): Default mode "640x360": 18.0 MHz, 22.5 kHz, 59.8 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.084] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.315] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.735] (*) vmware(0): Driver mode "vmwlegacy-default-800x600": 36.3 MHz, 36.2 kHz, 60.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.054] (==) vmware(0): Using gamma correction (1.0, 1.0, 1.0)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.179] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.845] (**) vmware(0): Default mode "800x600": 49.5 MHz, 46.9 kHz, 75.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.228] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 494.045] (II) event2 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.425] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event3)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.589] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.487] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.527] (II) vmware(0): Not using default mode "864x486" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.692] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.521] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.465] (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.133] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.414] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.279] (II) vmware(0): Not using default mode "3200x1800" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.518] (II) vmware(0): Not using default mode "720x405" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.406] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.407] (II) vmware(0): Not using default mode "720x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.424] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.430] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.310] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.524] (II) vmware(0): Not using default mode "360x202" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.699] (II) event3 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.457] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.212] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: iKuUJ0F8Du, 5234.1.00000000e3ab1f20.0000000018b0d825.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/iKuUJ0F8DuSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/iKuUJ0F8Du
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.722] (II) XINPUT: Adding extended input device "VirtualPS/2 VMware VMMouse" (type: MOUSE, id 8)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.991] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.937] (**) vmware(0): Default mode "640x400": 31.5 MHz, 37.9 kHz, 85.1 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.941] (II) vmware(0): Modeline "640x400"x85.1 31.50 640 672 736 832 400 401 404 445 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.152] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.011] (--) vmware(0): w.red: 8
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.918] (II) vmware(0): Modeline "640x480"x59.9 25.18 640 656 752 800 480 490 492 525 -hsync -vsync (31.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.794] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/mouse1)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.739] (II) vmware(0): Modeline "vmwlegacy-default-800x600"x60.0 36.25 800 801 802 1002 600 601 602 603 (36.2 kHz ez)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.045] (==) vmware(0): Using HW cursor
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.137] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.469] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.450] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.325] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.301] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.442] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.887] (**) vmware(0): Default mode "640x480": 36.0 MHz, 43.3 kHz, 85.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.906] (**) vmware(0): Default mode "640x480": 31.5 MHz, 37.9 kHz, 72.8 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.045] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.800] (**) vmware(0): Default mode "1024x768": 78.8 MHz, 60.0 kHz, 75.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.211] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 486.392] (==) vmware(0): Backing store enabled
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.839] (**) vmware(0): Default mode "800x600": 56.3 MHz, 53.7 kHz, 85.1 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.222] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: iKuUJ0F8Du, 5234.1.000000009ae5eebd.0000000069bb2f5e.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.647] (WW) vmware(0): Disabling RandR12+ support.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.537] (II) vmware(0): Not using default mode "960x540" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.952] (**) vmware(0): Default mode "640x360": 17.8 MHz, 22.2 kHz, 59.3 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.862] (**) vmware(0): Default mode "800x600": 40.0 MHz, 37.9 kHz, 60.3 Hz
Source: iKuUJ0F8Du, 5240.1.000000009ae5eebd.0000000069bb2f5e.rw-.sdmp	Binary or memory string: U!/usr/bin/vmtoolsd
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.020] (--) vmware(0): w.blu: 8
Source: Xorg.0.log.86.dr	Binary or memory string: [ 482.265] (II) LoadModule: "vmware"
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.371] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.441] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.438] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.743] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.933] (II) vmware(0): Modeline "720x400"x85.0 35.50 720 756 828 936 400 401 404 446 -hsync +vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.453] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.831] (II) config/udev: Adding input device VirtualPS/2 VMware VMMouse (/dev/input/event2)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.829] (II) vmware(0): Modeline "832x624"x74.6 57.28 832 864 928 1152 624 625 628 667 -hsync -vsync (49.7 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.748] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration factor: 2.000
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.028] (II) vmware(0): Not using default mode "960x540" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 494.001] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.688] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.753] (II) vmware(0): Modeline "1152x864"x85.1 121.50 1152 1216 1344 1568 864 865 868 911 +hsync -vsync (77.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.842] (II) vmware(0): Modeline "800x600"x85.1 56.30 800 832 896 1048 600 601 604 631 +hsync +vsync (53.7 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.843] (II) Using input driver 'libinput' for 'VirtualPS/2 VMware VMMouse'
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.395] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.774] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.989] (--) vmware(0): vram: 4194304
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.494] (II) vmware(0): Not using default mode "2048x1536" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.922] (**) vmware(0): Default mode "720x405": 22.5 MHz, 25.1 kHz, 59.5 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.336] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.234] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.279] (II) vmware(0): Not using default mode "1856x1392" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.577] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.685] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.223] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.350] (II) vmware(0): Not using default mode "4096x2304" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.331] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.977] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.347] (II) vmware(0): Not using default mode "680x384" (bad mode clock/interlace/doublescan)
Source: iKuUJ0F8Du, 5240.1.000000009ae5eebd.0000000069bb2f5e.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.141] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.240] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.955] (II) vmware(0): Modeline "640x360"x59.3 17.75 640 688 720 800 360 363 368 374 +hsync -vsync (22.2 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.852] (**) vmware(0): Default mode "800x600": 50.0 MHz, 48.1 kHz, 72.2 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.600] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.015] (--) vmware(0): w.grn: 8
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.399] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.783] (II) vmware(0): Modeline "1152x864"x70.0 96.77 1152 1224 1344 1536 864 865 868 900 -hsync +vsync (63.0 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.856] (II) vmware(0): Modeline "800x600"x72.2 50.00 800 856 976 1040 600 637 643 666 +hsync +vsync (48.1 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.548] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.749] (**) vmware(0): Default mode "1152x864": 121.5 MHz, 77.5 kHz, 85.1 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.129] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.547] (II) vmware(0): Not using default mode "1024x576" (monitor doesn't support reduced blanking)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.653] (--) vmware(0): VMware SVGA regs at (0x1070, 0x1071)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.407] (II) vmware(0): Creating default Display subsection in Screen section
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.940] (II) vmware(0): Not using default mode "1368x768" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.283] (II) vmware(0): Not using default mode "928x696" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.125] (II) vmware(0): Not using default mode "512x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.951] (II) event2 - VirtualPS/2 VMware VMMouse: device removed
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.990] (**) VirtualPS/2 VMware VMMouse: (accel) selected scheme none/0
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.757] (**) vmware(0): Default mode "1152x864": 119.7 MHz, 77.1 kHz, 85.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.424] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.793] (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.742] (**) vmware(0): Default mode "1152x864": 143.5 MHz, 91.5 kHz, 100.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.292] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.262] (II) vmware(0): Not using default mode "896x672" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.810] (II) vmware(0): Modeline "1024x768"x70.1 75.00 1024 1048 1184 1328 768 771 777 806 -hsync -vsync (56.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.106] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.640] (WW) vmware(0): Disabling Render Acceleration.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.591] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.112] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.120] (II) vmware(0): Not using default mode "512x384i" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.094] (II) vmware(0): Not using default mode "320x240" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.300] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.483] (II) vmware(0): Not using default mode "960x720" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.870] (**) vmware(0): Default mode "800x600": 36.0 MHz, 35.2 kHz, 56.2 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.055] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.084] (II) vmware(0): Not using default mode "1024x576" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.687] (II) event3 - VirtualPS/2 VMware VMMouse: is tagged by udev as: Mouse
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.880] (**) VirtualPS/2 VMware VMMouse: always reports core events
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.629] (WW) vmware(0): Disabling 3D support.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.721] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.985] (--) vmware(0): bpp: 32
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.534] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.186] (II) vmware(0): Not using default mode "2880x1620" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.883] (II) vmware(0): Modeline "864x486"x59.9 32.50 864 888 968 1072 486 489 494 506 -hsync +vsync (30.3 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.434] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.707] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.717] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.059] (II) vmware(0): Clock range: 0.00 to 400000.00 MHz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.724] (II) vmware(0): Not using default mode "2560x1600" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.544] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.567] (II) vmware(0): Not using default mode "640x360" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.773] (**) vmware(0): Default mode "1152x864": 105.0 MHz, 67.6 kHz, 75.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.415] (II) vmware(0): Not using default mode "800x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.098] (II) vmware(0): Not using default mode "2048x1152" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.807] (**) vmware(0): Default mode "1024x768": 75.0 MHz, 56.5 kHz, 70.1 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.074] (II) vmware(0): Not using default mode "360x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.531] (II) vmware(0): Not using default mode "432x243" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.036] (==) vmware(0): RGB weight 888
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.700] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.390] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.820] (**) vmware(0): Default mode "1024x576": 46.5 MHz, 35.9 kHz, 59.9 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.836] (II) vmware(0): Modeline "960x540"x59.6 40.75 960 992 1088 1216 540 543 548 562 -hsync +vsync (33.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.776] (II) vmware(0): Modeline "1152x864"x75.0 104.99 1152 1224 1352 1552 864 865 868 902 -hsync +vsync (67.6 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.731] (II) vmware(0): Virtual size is 800x600 (pitch 1176)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.796] (II) vmware(0): Modeline "1024x768"x85.0 94.50 1024 1072 1168 1376 768 769 772 808 +hsync +vsync (68.7 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.342] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.313] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.926] (II) vmware(0): Modeline "720x405"x59.5 22.50 720 744 808 896 405 408 413 422 -hsync +vsync (25.1 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.540] (II) vmware(0): Not using default mode "480x270" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 486.154] (II) vmware(0): Initialized VMWARE_CTRL extension version 0.2
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.545] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.929] (**) vmware(0): Default mode "720x400": 35.5 MHz, 37.9 kHz, 85.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 486.170] (II) vmware(0): Initialized VMware Xinerama extension.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.288] (II) vmware(0): Not using default mode "1920x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.981] (--) vmware(0): depth: 24
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.515] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.803] (II) vmware(0): Modeline "1024x768"x75.0 78.75 1024 1040 1136 1312 768 769 772 800 +hsync +vsync (60.0 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.367] (II) vmware(0): Not using default mode "700x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.165] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.183] (II) vmware(0): Not using default mode "640x512" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.385] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.498] (II) vmware(0): Not using default mode "7680x4320" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.551] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.680] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: iKuUJ0F8Du, 5234.1.000000009ae5eebd.0000000069bb2f5e.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.305] (II) vmware(0): Not using default mode "416x312" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.884] (II) vmware(0): Not using default mode "684x384" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.352] (II) vmware(0): Not using default mode "1360x768" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.433] (II) vmware(0): Not using default mode "5120x2880" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.817] (II) vmware(0): Modeline "1024x768"x60.0 65.00 1024 1048 1184 1344 768 771 777 806 -hsync -vsync (48.4 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.512] (II) vmware(0): Not using default mode "320x180" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.203] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 486.175] (II) vmware(0): vgaHWGetIOBase: hwp->IOBase is 0x03d0
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.696] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.910] (II) vmware(0): Modeline "640x480"x72.8 31.50 640 664 704 832 480 489 492 520 -hsync -vsync (37.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.779] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.612] (EE) vmware(0): Failed to open drm.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.786] (**) vmware(0): Default mode "1152x864": 81.6 MHz, 53.7 kHz, 60.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.187] (II) vmware(0): Not using default mode "1280x1024" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.216] (II) vmware(0): Not using default mode "800x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.420] (II) vmware(0): Not using default mode "1680x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.752] (**) VirtualPS/2 VMware VMMouse: (accel) acceleration threshold: 4
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.714] (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.972] (==) vmware(0): DPI set to (96, 96)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.779] (**) vmware(0): Default mode "1152x864": 96.8 MHz, 63.0 kHz, 70.0 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.195] (II) vmware(0): Not using default mode "1600x1200" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.892] (II) vmware(0): Modeline "640x480"x85.0 36.00 640 696 752 832 480 481 484 509 -hsync -vsync (43.3 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 482.233] (==) Matched vmware as autoconfigured driver 0
Source: Xorg.0.log.86.dr	Binary or memory string: [ 482.592] (II) Module vmware: vendor="X.Org Foundation"
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.000] (--) vmware(0): mheig: 885
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.562] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.024] (--) vmware(0): vis: 4
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.160] (II) vmware(0): Not using default mode "640x480" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.292] (II) vmware(0): Not using default mode "1600x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.621] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.693] (II) event3 - VirtualPS/2 VMware VMMouse: device is a pointer
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.996] (--) vmware(0): mwidt: 1176
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.490] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.728] (II) vmware(0): Not using default mode "1280x800" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.972] (--) vmware(0): caps: 0xFDFF83E2
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.108] (II) vmware(0): Not using default mode "400x300" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.672] (II) vmware(0): Not using default mode "1400x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.050] (==) vmware(0): Will set up a driver mode with dimensions 800x600.
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.663] (II) vmware(0): Not using default mode "640x400" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.874] (II) vmware(0): Modeline "800x600"x56.2 36.00 800 824 896 1024 600 601 603 625 +hsync +vsync (35.2 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.234] (II) vmware(0): Not using default mode "1440x810" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 483.993] (--) vmware(0): pbase: 0xe8000000
Source: Xorg.0.log.86.dr	Binary or memory string: [ 493.451] (**) VirtualPS/2 VMware VMMouse: Applying InputClass "libinput pointer catchall"
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.029] (==) vmware(0): Depth 24, (==) framebuffer bpp 32
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.150] (II) vmware(0): Not using default mode "1280x720" (width requires unsupported line pitch)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.136] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.467] (II) vmware(0): Not using default mode "3840x2160" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.362] (II) vmware(0): Not using default mode "1400x1050" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.999] (II) vmware(0): Not using default mode "800x450" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.067] (II) vmware(0): Not using default mode "320x200" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.849] (II) vmware(0): Modeline "800x600"x75.0 49.50 800 816 896 1056 600 601 604 625 +hsync +vsync (46.9 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.763] (II) vmware(0): Modeline "1152x864"x85.0 119.65 1152 1224 1352 1552 864 865 868 907 -hsync +vsync (77.1 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.037] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.445] (II) vmware(0): Not using default mode "840x525" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.020] (II) vmware(0): Not using default mode "1920x1080" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.326] (II) vmware(0): Not using default mode "576x432" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.914] (**) vmware(0): Default mode "640x480": 25.2 MHz, 31.5 kHz, 59.9 Hz
Source: Xorg.0.log.86.dr	Binary or memory string: [ 486.403] (==) vmware(0): Silken mouse enabled
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.403] (II) vmware(0): Not using default mode "1440x900" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.555] (II) vmware(0): Not using default mode "512x288" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.118] (II) vmware(0): Not using default mode "2560x1440" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.156] (II) vmware(0): Not using default mode "1280x960" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.524] (II) vmware(0): Not using default mode "15360x8640" (insufficient memory for mode)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.769] (II) vmware(0): Modeline "1152x864"x75.0 108.00 1152 1216 1344 1600 864 865 868 900 +hsync +vsync (67.5 kHz d)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 484.509] (II) vmware(0): Not using default mode "1024x768" (bad mode clock/interlace/doublescan)
Source: Xorg.0.log.86.dr	Binary or memory string: [ 485.677] (II) vmware(0): Not using default mode "700x450" (bad mode clock/interlace/doublescan)

Language, Device and Operating System Detection:

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5307)

Logged in records file read: /var/log/wtmp

Jump to behavior

Stealing of Sensitive Information:

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality:

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

ID:	519722
Product:	CloudBasic
Start time:	04:36:00
Start date:	11.11.2021
Sample:	iKuUJ0F8Du
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	5d0d54974ca6c1262372b7292ff1eb70
SHA1:	00bdfd4f35dd30e1c049648cf5d8cffaf70cddd0
SHA256:	8126a9a1a562576157434656d620574ce14b6db55b8c37bc6341c0bf1664820e
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Name	Type	MD5	SHA1	SHA256
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink	ASCII text	FF001A15CE15CF062A3704CEA2991B5F	B06F6855F376C3245B82212AC73ADED55DFE5DEF	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source	ASCII text	28FE6435F34B3367707BB1C5D5F6B430	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
/proc/5294/oom_score_adj	ASCII text	CBF282CC55ED0792C33D10003D1F760A	007DD8BD75468E6B7ABA4285E9B267202C7EAEED	FCDBAB99FCC0F4409E5F9D7D6FC497780288B4C441698126BB62832412774D22
/proc/5342/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5345/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5347/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5349/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5351/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5353/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5356/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5496/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5526/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5529/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5531/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5533/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5535/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5537/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5540/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5846/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/5883/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6080/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/proc/6143/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/run/sshd.pid	ASCII text	6241802DCBEB7C5908456B924444BB89	6A5ACBBE3C16030790F8986FC4D3F260C54D6F85	C20721BC2D0E1AC3B2DE5B79934895327A12A807206D6A5B1DA934930039491F
/run/user/1000/pulse/pid	ASCII text	4516DC9CF0F93B2D127A8649FA91487F	39DFD4ADAB3BAFFC730B164AE3B95F434A716DBE	4A9FF2D3B76A3A6E1E4487B909539E14D55E3265E0678B582C5976846C42C1E9
/run/user/127/ICEauthority	data	2FA0FBCE75C1D6701C9E2039A853071A	EB3CB5C8A550AD7F9803F35D807ADA6CF2DFF05C	B04B4DBE3ED80C87D45A47D0BCDC6215D44B74D56756D3E3DDCBD7B4B4AC1C9F
/run/user/127/dconf/user	very short file (no magic)	93B885ADFE0DA089CDF634904FD59F71	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
/run/user/127/gdm/Xauthority	X11 Xauthority data	04ACDFC76BC762CBD5D80806B686A14D	B70D3DCAE8B5C8C0BD338938D876E4994C5BEAA6	DA9EEA71445CE097F87A13F4EC0705652B012C44524EA788E8AE9FB5C65F4E2E
/run/user/127/pulse/pid	ASCII text	7230424E7D3E372FC3B7652A32CA23EA	ACE4182875EF90D5C3E88BDAE9FD0ACB22565BF2	2BCD075A0755DD77FC0D81B5AEDB64D33F5E81AF6938603334559F7F07271213
/tmp/server-0.xkm	Compiled XKB Keymap: lsb, version 15	B4E3EB0B8B6B0FC1F46740C573E18D86	7D35426357695EBA77850757E8939A62DCEFF2D1	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
/var/lib/AccountsService/users/gdm.G1IGC1	ASCII text	542BA3FB41206AE43928AF1C5E61FEBC	F56F574DAF50D609526B36B5B54FDD59EA4D6A26	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
/var/lib/AccountsService/users/gdm.W1YOC1	ASCII text	542BA3FB41206AE43928AF1C5E61FEBC	F56F574DAF50D609526B36B5B54FDD59EA4D6A26	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0	ASCII text	9A1A12B1FB2DC1E55780138634D3EB76	D80BC27D0C0037419A0FB18746B9FDC44D248DA6	855CF73D95E573A3175EF919B082CDF8151653DCED564B6F84447548DF92A1CD
/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink	very short file (no magic)	68B329DA9893E34099C7D8AD5CB9C940	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source	very short file (no magic)	68B329DA9893E34099C7D8AD5CB9C940	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
/var/lib/whoopsie/whoopsie-id.2ZXHC1	ASCII text, with no line terminators	D2B5AAF22916F8D6665CF9E835EAD5E7	AAEF3CE527B8F1E3733BCD03EF7A6C0F30881E15	FEB925D4465BF6D30A42B19112406AD1B59BA90673DC4F91B25005A90FEFEB36
/var/log/Xorg.0.log	ASCII text	FD693E30205B537968E11D507E598149	94705675CFB3ED098C26F12F06B86BF9465CC8B7	F9CB2A2D3802FCF116E135CEF588F7108DD351F3AB6614DAB285FE9170D06EE7

Linux Analysis Report iKuUJ0F8Du

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Bitcoin Miner:

Compliance:

Networking:

System Summary:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Network Map

Contacted Public IPs

Contacted Domains