Create Interactive Tour

Linux Analysis Report
cutie.arm7

Overview

General Information

Sample Name:	cutie.arm7
Analysis ID:	649221
MD5:	46694d76e53225e65f8213519ba44145
SHA1:	068c29054d42763b9fea35403b932e6c07a5600a
SHA256:	0058aff1db7f17a2b675528d0a3d156196ae1bc38dc26fec9ca7e93d62409bc1
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Moves files to same location but with an extension indicative for ransomware

Searches for CPU information (likely indicative for DDoS capability)

Sample deletes itself

Contains symbols with names commonly found in malware

Sample tries to kill multiple processes (SIGKILL)

Performs DNS queries to domains with low reputation

Yara signature match

Yara detected Mirai

Executes the "grep" command used to find patterns in files or piped streams

Executes the "wget" command typically used for HTTP/S downloading

Reads system information from the proc file system

Uses the "uname" system call to query kernel version information (possible evasion)

Executes the "uname" command used to read OS and architecture name

Enumerates processes within the "proc" file system

Executes the "systemctl" command used for controlling the systemd system and service manager

Detected TCP or UDP traffic on non-standard ports

Executes the "mktemp" command used to create a temporary unique file name

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Deletes log files

Creates hidden files and/or directories

Executes commands using a shell command-line interpreter

Sample and/or dropped files contains symbols with suspicious names

Reads CPU information from /proc indicative of miner or evasive malware

Executes the "rm" command used to delete files or directories

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	649221
Start date and time: 21/06/202200:50:28	2022-06-21 00:50:28 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	cutie.arm7
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal80.rans.spre.troj.evad.mine.linARM7@0/57@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/cutie.arm7
PID:	6267
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	InfectedNight did its job
Standard Error:

Process Tree

system is lnxubuntu20

systemd New Fork (PID: 6194, Parent: 1)

logrotate (PID: 6194, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf

logrotate New Fork (PID: 6236, Parent: 6194)

gzip (PID: 6236, Parent: 6194, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6237, Parent: 6194)

sh (PID: 6237, Parent: 6194, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "

sh New Fork (PID: 6238, Parent: 6237)

invoke-rc.d (PID: 6238, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart

invoke-rc.d New Fork (PID: 6239, Parent: 6238)

runlevel (PID: 6239, Parent: 6238, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel

invoke-rc.d New Fork (PID: 6243, Parent: 6238)

systemctl (PID: 6243, Parent: 6238, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service

invoke-rc.d New Fork (PID: 6245, Parent: 6238)

ls (PID: 6245, Parent: 6238, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups

invoke-rc.d New Fork (PID: 6246, Parent: 6238)

systemctl (PID: 6246, Parent: 6238, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service

logrotate New Fork (PID: 6247, Parent: 6194)

gzip (PID: 6247, Parent: 6194, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6248, Parent: 6194)

sh (PID: 6248, Parent: 6194, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

sh New Fork (PID: 6249, Parent: 6248)

rsyslog-rotate (PID: 6249, Parent: 6248, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate

rsyslog-rotate New Fork (PID: 6250, Parent: 6249)

systemctl (PID: 6250, Parent: 6249, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service

systemd New Fork (PID: 6196, Parent: 1)

install (PID: 6196, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man

systemd New Fork (PID: 6216, Parent: 1)

find (PID: 6216, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete

systemd New Fork (PID: 6240, Parent: 1)

mandb (PID: 6240, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet

cutie.arm7 (PID: 6267, Parent: 6121, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/cutie.arm7

cutie.arm7 New Fork (PID: 6269, Parent: 6267)

cutie.arm7 New Fork (PID: 6270, Parent: 6267)

cutie.arm7 New Fork (PID: 6272, Parent: 6267)

xfce4-panel New Fork (PID: 6276, Parent: 2063)

wrapper-2.0 (PID: 6276, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6277, Parent: 2063)

wrapper-2.0 (PID: 6277, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6278, Parent: 2063)

wrapper-2.0 (PID: 6278, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6279, Parent: 2063)

wrapper-2.0 (PID: 6279, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-panel New Fork (PID: 6280, Parent: 2063)

wrapper-2.0 (PID: 6280, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6281, Parent: 2063)

wrapper-2.0 (PID: 6281, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 6287, Parent: 6286)

xfconfd (PID: 6287, Parent: 6286, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 6339, Parent: 1)

50-motd-news (PID: 6339, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/update-motd.d/50-motd-news --force

50-motd-news New Fork (PID: 6353, Parent: 6339)

mktemp (PID: 6353, Parent: 6339, MD5: e117ed1c2172d436fa31cc9d263131e8) Arguments: mktemp

50-motd-news New Fork (PID: 6354, Parent: 6339)

mktemp (PID: 6354, Parent: 6339, MD5: e117ed1c2172d436fa31cc9d263131e8) Arguments: mktemp

50-motd-news New Fork (PID: 6355, Parent: 6339)

mktemp (PID: 6355, Parent: 6339, MD5: e117ed1c2172d436fa31cc9d263131e8) Arguments: mktemp

50-motd-news New Fork (PID: 6356, Parent: 6339)

50-motd-news New Fork (PID: 6357, Parent: 6356)

dpkg (PID: 6357, Parent: 6356, MD5: 5e18156b434fc45062eec2f28b9147be) Arguments: dpkg -l wget

dpkg-query (PID: 6357, Parent: 6356, MD5: bf81745ea62201f11bc674cc7c1935fc) Arguments: dpkg-query --list -- wget

50-motd-news New Fork (PID: 6358, Parent: 6356)

awk (PID: 6358, Parent: 6356, MD5: 7e9b2ed1272331cfbd2aac2e5eb3f84b) Arguments: awk "$1 == \"ii\" { print($3); exit(0); }"

50-motd-news New Fork (PID: 6359, Parent: 6339)

50-motd-news New Fork (PID: 6360, Parent: 6359)

50-motd-news New Fork (PID: 6361, Parent: 6359)

sed (PID: 6361, Parent: 6359, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e "s/ /\\//g"

50-motd-news New Fork (PID: 6362, Parent: 6339)

uname (PID: 6362, Parent: 6339, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -o

50-motd-news New Fork (PID: 6363, Parent: 6339)

uname (PID: 6363, Parent: 6339, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

50-motd-news New Fork (PID: 6364, Parent: 6339)

uname (PID: 6364, Parent: 6339, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

50-motd-news New Fork (PID: 6365, Parent: 6339)

uname (PID: 6365, Parent: 6339, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

50-motd-news New Fork (PID: 6366, Parent: 6339)

50-motd-news New Fork (PID: 6367, Parent: 6366)

grep (PID: 6367, Parent: 6366, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -m1 "^model name" /proc/cpuinfo

50-motd-news New Fork (PID: 6368, Parent: 6366)

sed (PID: 6368, Parent: 6366, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e "s/.*: //" -e s:\\s\\+:/:g

50-motd-news New Fork (PID: 6369, Parent: 6339)

cloud-id (PID: 6369, Parent: 6339, MD5: 69f442c3e33b5f9a66b722c29ad89435) Arguments: /usr/bin/cloud-id

cloud-id New Fork (PID: 6374, Parent: 6369)

uname (PID: 6374, Parent: 6369, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -p

50-motd-news New Fork (PID: 6375, Parent: 6339)

50-motd-news New Fork (PID: 6376, Parent: 6375)

cut (PID: 6376, Parent: 6375, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -40 /tmp/tmp.DKQFxLxvy6

50-motd-news New Fork (PID: 6377, Parent: 6375)

tr (PID: 6377, Parent: 6375, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -c -d [:alnum:]

50-motd-news New Fork (PID: 6380, Parent: 6339)

wget (PID: 6380, Parent: 6339, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget --timeout 60 -U "wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none" -O- --content-on-error https://motd.ubuntu.com

50-motd-news New Fork (PID: 6381, Parent: 6339)

cat (PID: 6381, Parent: 6339, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.Z4Cz7dCtjj

50-motd-news New Fork (PID: 6382, Parent: 6339)

head (PID: 6382, Parent: 6339, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

50-motd-news New Fork (PID: 6383, Parent: 6339)

tr (PID: 6383, Parent: 6339, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

50-motd-news New Fork (PID: 6384, Parent: 6339)

cut (PID: 6384, Parent: 6339, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

50-motd-news New Fork (PID: 6385, Parent: 6339)

cat (PID: 6385, Parent: 6339, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.Z4Cz7dCtjj

50-motd-news New Fork (PID: 6386, Parent: 6339)

head (PID: 6386, Parent: 6339, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

50-motd-news New Fork (PID: 6387, Parent: 6339)

tr (PID: 6387, Parent: 6339, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

50-motd-news New Fork (PID: 6388, Parent: 6339)

cut (PID: 6388, Parent: 6339, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

50-motd-news New Fork (PID: 6389, Parent: 6339)

rm (PID: 6389, Parent: 6339, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.Z4Cz7dCtjj /tmp/tmp.MWgcl0tvlH /tmp/tmp.DKQFxLxvy6

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
cutie.arm7	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x19af0:$xo1: \x19;.=885{azd 0x19b60:$xo1: \x19;.=885{azd 0x19bd0:$xo1: \x19;.=885{azd 0x19c40:$xo1: \x19;.=885{azd 0x19cb0:$xo1: \x19;.=885{azd
cutie.arm7	MAL_ARM_LNX_Mirai_Mar13_2022	Detects new ARM Mirai variant	Mehmet Ali Kerimoglu a.k.a. CYB3RMX	0x250a5:$attck1: attack.c 0x250e3:$attck3: anti_gdb_entry 0x250f2:$attck4: resolve_cnc_addr 0x25d53:$attck7: attack_get_opt_ip
cutie.arm7	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
cutie.arm7	JoeSecurity_Mirai_2	Yara detected Mirai	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6267.1.0000000052282b48.00000000e9088d09.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x3a68:$xo1: \x19;.=885{azd 0x3ae0:$xo1: \x19;.=885{azd 0x3b58:$xo1: \x19;.=885{azd 0x3bd0:$xo1: \x19;.=885{azd 0x3c48:$xo1: \x19;.=885{azd
6267.1.00000000c125abc9.000000001765290f.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0x19af0:$xo1: \x19;.=885{azd 0x19b60:$xo1: \x19;.=885{azd 0x19bd0:$xo1: \x19;.=885{azd 0x19c40:$xo1: \x19;.=885{azd 0x19cb0:$xo1: \x19;.=885{azd

Joe Sandbox Signatures

• Bitcoin Miner
• Networking
• Spam, unwanted Advertisements and Ransom Demands
• DDoS
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

Bitcoin Miner

Searches for CPU information (likely indicative for DDoS capability)

Source: /etc/update-motd.d/50-motd-news (PID: 6367)

Executable: /usr/bin/grep -> grep -m1 "^model name" /proc/cpuinfo

Jump to behavior

Source: /usr/bin/grep (PID: 6367)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Networking

Performs DNS queries to domains with low reputation

Source:

DNS query: cnc.vruhshabla.xyz

Source: /etc/update-motd.d/50-motd-news (PID: 6380)

Wget executable: /usr/bin/wget -> wget --timeout 60 -U "wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none" -O- --content-on-error https://motd.ubuntu.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34614
Source: unknown	Network traffic detected: HTTP traffic on port 34614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 209.50.65.235
Source: unknown	TCP traffic detected without corresponding DNS query: 206.122.191.12
Source: unknown	TCP traffic detected without corresponding DNS query: 126.234.149.75
Source: unknown	TCP traffic detected without corresponding DNS query: 168.161.25.210
Source: unknown	TCP traffic detected without corresponding DNS query: 209.239.120.69
Source: unknown	TCP traffic detected without corresponding DNS query: 129.94.198.115
Source: unknown	TCP traffic detected without corresponding DNS query: 144.127.82.29
Source: unknown	TCP traffic detected without corresponding DNS query: 34.148.72.147
Source: unknown	TCP traffic detected without corresponding DNS query: 41.49.203.251
Source: unknown	TCP traffic detected without corresponding DNS query: 191.250.161.235
Source: unknown	TCP traffic detected without corresponding DNS query: 126.146.171.22
Source: unknown	TCP traffic detected without corresponding DNS query: 52.250.245.84
Source: unknown	TCP traffic detected without corresponding DNS query: 1.209.254.99
Source: unknown	TCP traffic detected without corresponding DNS query: 69.122.240.67
Source: unknown	TCP traffic detected without corresponding DNS query: 44.195.139.142
Source: unknown	TCP traffic detected without corresponding DNS query: 185.212.120.123
Source: unknown	TCP traffic detected without corresponding DNS query: 80.58.235.234
Source: unknown	TCP traffic detected without corresponding DNS query: 124.142.138.6
Source: unknown	TCP traffic detected without corresponding DNS query: 176.246.75.152
Source: unknown	TCP traffic detected without corresponding DNS query: 87.246.143.146
Source: unknown	TCP traffic detected without corresponding DNS query: 78.29.148.8
Source: unknown	TCP traffic detected without corresponding DNS query: 106.167.21.13
Source: unknown	TCP traffic detected without corresponding DNS query: 138.251.146.185
Source: unknown	TCP traffic detected without corresponding DNS query: 75.172.153.53
Source: unknown	TCP traffic detected without corresponding DNS query: 2.204.145.93
Source: unknown	TCP traffic detected without corresponding DNS query: 134.119.198.202
Source: unknown	TCP traffic detected without corresponding DNS query: 95.249.79.44
Source: unknown	TCP traffic detected without corresponding DNS query: 60.54.102.141
Source: unknown	TCP traffic detected without corresponding DNS query: 175.32.173.253
Source: unknown	TCP traffic detected without corresponding DNS query: 78.237.75.153
Source: unknown	TCP traffic detected without corresponding DNS query: 31.32.141.246
Source: unknown	TCP traffic detected without corresponding DNS query: 177.32.19.36
Source: unknown	TCP traffic detected without corresponding DNS query: 1.155.77.219
Source: unknown	TCP traffic detected without corresponding DNS query: 126.176.4.82
Source: unknown	TCP traffic detected without corresponding DNS query: 48.16.118.44
Source: unknown	TCP traffic detected without corresponding DNS query: 168.46.58.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.37.164.105
Source: unknown	TCP traffic detected without corresponding DNS query: 196.96.60.194
Source: unknown	TCP traffic detected without corresponding DNS query: 203.182.47.189
Source: unknown	TCP traffic detected without corresponding DNS query: 203.219.50.123
Source: unknown	TCP traffic detected without corresponding DNS query: 170.193.230.70
Source: unknown	TCP traffic detected without corresponding DNS query: 5.108.211.119
Source: unknown	TCP traffic detected without corresponding DNS query: 81.208.4.36
Source: unknown	TCP traffic detected without corresponding DNS query: 212.75.181.235
Source: unknown	TCP traffic detected without corresponding DNS query: 98.189.238.66
Source: unknown	TCP traffic detected without corresponding DNS query: 166.242.125.219
Source: unknown	TCP traffic detected without corresponding DNS query: 82.151.197.225
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.50.176
Source: unknown	TCP traffic detected without corresponding DNS query: 81.176.128.104
Source: unknown	TCP traffic detected without corresponding DNS query: 100.54.44.89

Source: tmp.MWgcl0tvlH.99.dr	String found in binary or memory: https://motd.ubuntu.com/
Source: motd-news.115.dr, tmp.Z4Cz7dCtjj.99.dr	String found in binary or memory: https://ubuntu.com/blog/microk8s-memory-optimisation

Source: /usr/sbin/logrotate (PID: 6194)	File moved: /var/log/cups/access_log -> /var/log/cups/access_log.1			Jump to behavior
Source: /usr/sbin/logrotate (PID: 6194)	File moved: /var/log/syslog -> /var/log/syslog.1			Jump to behavior

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_app.c
Source: ELF static info symbol of initial sample	Name: attack_app_http
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_method.c
Source: ELF static info symbol of initial sample	Name: attack_method_greeth

Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 6276, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 6277, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 6279, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 6280, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 6281, result: successful	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	SIGKILL sent: pid: 6287, result: successful	Jump to behavior

Source: cutie.arm7, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: cutie.arm7, type: SAMPLE	Matched rule: MAL_ARM_LNX_Mirai_Mar13_2022 date = 2022-03-16, hash1 = 0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68, author = Mehmet Ali Kerimoglu a.k.a. CYB3RMX, description = Detects new ARM Mirai variant
Source: 6267.1.0000000052282b48.00000000e9088d09.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6267.1.00000000c125abc9.000000001765290f.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13

Source: cutie.arm7	ELF static info symbol of initial sample: __gnu_unwind_execute
Source: cutie.arm7	ELF static info symbol of initial sample: add_scanner_process

Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2275/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1612/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/3236/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2025/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2146/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/517/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/759/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6401/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/4465/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6400/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2285/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2281/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1623/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/761/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1622/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1983/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2038/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2156/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1629/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1627/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6257/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/3021/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2294/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2050/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6371/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1877/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/772/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1633/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1632/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/774/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/896/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2048/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2289/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/4466/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6403/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/4467/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6402/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/4468/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6405/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6404/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1639/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6407/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1638/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6406/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6408/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2180/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6147/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1890/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2063/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/2062/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1888/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1886/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/420/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1489/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/785/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1642/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/788/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/667/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/789/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/1648/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/4491/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6153/cmdline	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6269)	File opened: /proc/6274/cmdline	Jump to behavior

Source: /usr/sbin/invoke-rc.d (PID: 6243)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service	Jump to behavior
Source: /usr/sbin/invoke-rc.d (PID: 6246)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service	Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 6250)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service	Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 209.50.65.235:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 52.250.245.84:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 134.119.198.202:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 78.237.75.153:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 212.75.181.235:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 148.37.122.163:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 36.222.252.216:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 9.247.8.99:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 60.124.185.215:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 188.35.69.137:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 187.228.179.72:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 17.127.168.174:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 217.153.149.83:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 125.210.41.102:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 181.61.192.70:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 220.168.96.183:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 219.102.129.69:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 88.236.214.194:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 31.240.138.87:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 131.71.165.183:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 68.93.245.153:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 223.164.51.53:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 176.237.5.105:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 203.164.202.55:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 129.138.192.116:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 65.41.62.216:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 204.163.92.181:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 37.17.134.228:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 141.108.58.228:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 98.104.97.157:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 120.204.250.104:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 106.190.12.55:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 46.231.176.227:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 159.228.102.6:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 57.126.98.112:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 88.16.215.31:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 205.158.85.53:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 1.115.25.183:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 169.218.1.96:2323
Source: global traffic	TCP traffic: 192.168.2.23:9511 -> 117.123.1.185:2323

Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6287)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6287)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6287)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6287)	Directory: /home/saturnino/.config	Jump to behavior

Source: /etc/update-motd.d/50-motd-news (PID: 6353)	Mktemp executable: /usr/bin/mktemp -> mktemp	Jump to behavior
Source: /etc/update-motd.d/50-motd-news (PID: 6354)	Mktemp executable: /usr/bin/mktemp -> mktemp	Jump to behavior
Source: /etc/update-motd.d/50-motd-news (PID: 6355)	Mktemp executable: /usr/bin/mktemp -> mktemp	Jump to behavior

Source: /usr/sbin/logrotate (PID: 6237)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "			Jump to behavior
Source: /usr/sbin/logrotate (PID: 6248)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog			Jump to behavior

Source: /etc/update-motd.d/50-motd-news (PID: 6361)	Sed executable: /usr/bin/sed -> sed -e "s/ /\\//g"			Jump to behavior
Source: /etc/update-motd.d/50-motd-news (PID: 6368)	Sed executable: /usr/bin/sed -> sed -e "s/.*: //" -e s:\\s\\+:/:g			Jump to behavior

Source: /usr/bin/find (PID: 6216)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/cutie.arm7 (PID: 6267)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6363)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6364)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6365)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/cloud-id (PID: 6369)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6374)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/wget (PID: 6380)	Queries kernel information via 'uname':	Jump to behavior

Source: /usr/sbin/logrotate (PID: 6194)	Truncated file: /var/log/cups/access_log.1			Jump to behavior
Source: /usr/sbin/logrotate (PID: 6194)	Truncated file: /var/log/syslog.1			Jump to behavior

Source: 6240.18.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: 6240.18.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 6240.18.dr	Binary or memory string: qemu-or1k
Source: 6240.18.dr	Binary or memory string: qemu-riscv64
Source: 6240.18.dr	Binary or memory string: {cqemu
Source: 6240.18.dr	Binary or memory string: qemu-arm
Source: 6240.18.dr	Binary or memory string: (qemu
Source: 6240.18.dr	Binary or memory string: qemu-tilegx
Source: 6240.18.dr	Binary or memory string: qemu-hppa
Source: 6240.18.dr	Binary or memory string: q{rqemu%
Source: 6240.18.dr	Binary or memory string: )qemu
Source: 6240.18.dr	Binary or memory string: vmware-toolbox-cmd
Source: 6240.18.dr	Binary or memory string: qemu-ppc
Source: 6240.18.dr	Binary or memory string: Tqemu9
Source: 6240.18.dr	Binary or memory string: qemu-aarch64_be
Source: 6240.18.dr	Binary or memory string: 0qemu9
Source: 6240.18.dr	Binary or memory string: qemu-sparc64
Source: 6240.18.dr	Binary or memory string: qemu-mips64
Source: 6240.18.dr	Binary or memory string: vV:qemu9
Source: 6240.18.dr	Binary or memory string: qemu-ppc64le
Source: 6240.18.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
Source: 6240.18.dr	Binary or memory string: vmware
Source: 6240.18.dr	Binary or memory string: qemu-cris
Source: 6240.18.dr	Binary or memory string: libvmtools
Source: 6240.18.dr	Binary or memory string: qemu-m68k
Source: 6240.18.dr	Binary or memory string: qemu-xtensa
Source: 6240.18.dr	Binary or memory string: 9qemu
Source: 6240.18.dr	Binary or memory string: qemu-sh4
Source: 6240.18.dr	Binary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: cutie.arm7, 6267.1.00000000290b6856.000000003c8b2659.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: 6240.18.dr	Binary or memory string: .qemu{
Source: 6240.18.dr	Binary or memory string: qemu-ppc64abi32
Source: 6240.18.dr	Binary or memory string: qemu-ppc64
Source: 6240.18.dr	Binary or memory string: qemu-i386
Source: 6240.18.dr	Binary or memory string: qemu-x86_64
Source: cutie.arm7, 6267.1.00000000b3a3e129.0000000085a1043a.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/cutie.arm7SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/cutie.arm7
Source: 6240.18.dr	Binary or memory string: H~6\nqemu*q
Source: 6240.18.dr	Binary or memory string: @qemu
Source: 6240.18.dr	Binary or memory string: Fqqemu
Source: 6240.18.dr	Binary or memory string: N4qemu
Source: 6240.18.dr	Binary or memory string: ~6\nqemu*q
Source: 6240.18.dr	Binary or memory string: qemu-mips64el
Source: 6240.18.dr	Binary or memory string: hqemu
Source: 6240.18.dr	Binary or memory string: &mqemu
Source: 6240.18.dr	Binary or memory string: $qemu
Source: 6240.18.dr	Binary or memory string: qemu-sparc
Source: 6240.18.dr	Binary or memory string: qemu-microblaze
Source: 6240.18.dr	Binary or memory string: qemu-user
Source: 6240.18.dr	Binary or memory string: qemu-aarch64
Source: 6240.18.dr	Binary or memory string: qemu-sh4eb
Source: 6240.18.dr	Binary or memory string: iqemu
Source: 6240.18.dr	Binary or memory string: qemu-mipsel
Source: 6240.18.dr	Binary or memory string: qemuP`
Source: 6240.18.dr	Binary or memory string: qemu-alpha
Source: 6240.18.dr	Binary or memory string: qemu-microblazeel
Source: 6240.18.dr	Binary or memory string: \qemu
Source: 6240.18.dr	Binary or memory string: qemu-xtensaeb
Source: 6240.18.dr	Binary or memory string: qemu-mipsn32el
Source: 6240.18.dr	Binary or memory string: SAqemu
Source: 6240.18.dr	Binary or memory string: Vqemu
Source: 6240.18.dr	Binary or memory string: qemu-mipsn32
Source: 6240.18.dr	Binary or memory string: qemuAU
Source: 6240.18.dr	Binary or memory string: qemu-riscv32
Source: 6240.18.dr	Binary or memory string: qemu-sparc32plus
Source: 6240.18.dr	Binary or memory string: 7,qemu
Source: 6240.18.dr	Binary or memory string: qemu-s390x
Source: 6240.18.dr	Binary or memory string: vmware-checkvm
Source: 6240.18.dr	Binary or memory string: qemu-nios2
Source: 6240.18.dr	Binary or memory string: qemu-armeb
Source: 6240.18.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 6240.18.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 6240.18.dr	Binary or memory string: I_qemu
Source: cutie.arm7, 6267.1.00000000b3a3e129.0000000085a1043a.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: 6240.18.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 6240.18.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 6240.18.dr	Binary or memory string: qemu-mips
Source: 6240.18.dr	Binary or memory string: qemuj\
Source: cutie.arm7, 6267.1.00000000290b6856.000000003c8b2659.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: 6240.18.dr	Binary or memory string: {qemuQ&
Source: 6240.18.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 6240.18.dr	Binary or memory string: vmware-xferlogs

Source: Yara match	File source: cutie.arm7, type: SAMPLE
Source: Yara match	File source: dump.pcap, type: PCAP

Source: /etc/update-motd.d/50-motd-news (PID: 6362)	Uname executable: /usr/bin/uname -> uname -o	Jump to behavior
Source: /etc/update-motd.d/50-motd-news (PID: 6363)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /etc/update-motd.d/50-motd-news (PID: 6364)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /etc/update-motd.d/50-motd-news (PID: 6365)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /usr/bin/cloud-id (PID: 6374)	Uname executable: /usr/bin/uname -> uname -p	Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	1 Systemd Service	1 Systemd Service	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	1 Jamming or Denial of Service	Remotely Track Device Without Authorization	1 Service Stop
Default Accounts	1 Scripting	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hide Artifacts	LSASS Memory	3 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Scripting	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Hidden Files and Directories	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	12 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Indicator Removal on Host	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 File Deletion	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Name	Source	Malicious	Antivirus Detection	Reputation
https://motd.ubuntu.com/	tmp.MWgcl0tvlH.99.dr	false		high
https://ubuntu.com/blog/microk8s-memory-optimisation	motd-news.115.dr, tmp.Z4Cz7dCtjj.99.dr	false		high

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report cutie.arm7

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

Bitcoin Miner

Networking

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/tmp.DKQFxLxvy6

/tmp/tmp.MWgcl0tvlH

/tmp/tmp.Z4Cz7dCtjj

/var/cache/man/6240

/var/cache/man/cs/6240

/var/cache/man/cs/index.db.sdkB10

/var/cache/man/da/6240

/var/cache/man/da/index.db.a0TRC2

/var/cache/man/de/6240

/var/cache/man/de/index.db.sLzlx0

/var/cache/man/es/6240

/var/cache/man/es/index.db.NMgHP0

/var/cache/man/fi/6240

/var/cache/man/fi/index.db.cuRlw3

/var/cache/man/fr.ISO8859-1/6240

/var/cache/man/fr.ISO8859-1/index.db.GFVF12

/var/cache/man/fr.UTF-8/6240

/var/cache/man/fr.UTF-8/index.db.JAnJI4

/var/cache/man/fr/6240

/var/cache/man/fr/index.db.NErhv3

/var/cache/man/hu/6240

/var/cache/man/hu/index.db.rMFr52

/var/cache/man/id/6240

/var/cache/man/id/index.db.AsWss3

Linux Analysis Report
cutie.arm7

IP	Domain	Country	ASN	ASN Name	Malicious
46.28.115.207	unknown	Germany	197208	MSGDE	false
163.26.127.146	unknown	Taiwan; Republic of China (ROC)	1659	ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC	false
152.159.178.37	unknown	United States	2686	ATGS-MMD-ASUS	false
52.66.239.9	unknown	United States	16509	AMAZON-02US	false
78.30.113.37	unknown	Poland	8374	PLUSNETPlusnetworkoperatorinPolandPL	false
137.238.255.228	unknown	United States	3755	NYSERNET3-ASUS	false
153.16.222.240	unknown	United States	3943	DMMUS	false
148.198.222.121	unknown	Austria	31382	KAPSCH-ASAT	false
174.130.97.152	unknown	United States	7029	WINDSTREAMUS	false
53.32.132.187	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
95.248.196.18	unknown	Italy	3269	ASN-IBSNAZIT	false
174.20.119.71	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
172.157.75.118	unknown	United States	7018	ATT-INTERNET4US	false
101.155.167.120	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
208.144.203.121	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
40.29.213.205	unknown	United States	4249	LILLY-ASUS	false
184.135.161.159	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
77.30.231.90	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
92.126.10.122	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
131.184.139.36	unknown	United States	22696	CBI-ASUS	false
181.10.135.184	unknown	Argentina	7303	TelecomArgentinaSAAR	false
116.100.100.230	unknown	Viet Nam	24086	VIETTEL-AS-VNViettelCorporationVN	false
116.135.238.170	unknown	China	139007	UNICOM-NM-WULANCHABU-IDCUNICOMInnerMongoliaprovincenetwo	false
173.31.99.171	unknown	United States	30036	MEDIACOM-ENTERPRISE-BUSINESSUS	false
121.101.75.11	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
167.170.223.167	unknown	United States	59447	SAYFANETTR	false
34.73.30.1	unknown	United States	15169	GOOGLEUS	false
105.63.39.235	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
91.21.93.138	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
87.212.98.20	unknown	Netherlands	13127	VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo	false
176.20.55.156	unknown	Denmark	3292	TDCTDCASDK	false
180.82.164.81	unknown	Korea Republic of	9316	DACOM-PUBNETPLUS-AS-KRDACOM-PUBNETPLUSKR	false
183.70.181.240	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
222.200.103.18	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
116.133.14.230	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
66.238.197.240	unknown	United States	2828	XO-AS15US	false
180.31.13.187	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
77.148.110.148	unknown	France	15557	LDCOMNETFR	false
135.176.208.138	unknown	United States	14962	NCR-252US	false
135.143.33.164	unknown	United States	10455	LUCENT-CIOUS	false
39.176.217.226	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
148.223.139.65	unknown	Mexico	8151	UninetSAdeCVMX	false
115.5.239.130	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
85.2.87.130	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
138.146.30.64	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
112.70.148.186	unknown	Japan	17511	OPTAGEOPTAGEIncJP	false
52.166.110.250	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
150.203.91.25	unknown	Australia	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
104.0.140.248	unknown	United States	7018	ATT-INTERNET4US	false
149.218.41.223	unknown	Germany	8319	NETHINKS-ASNETHINKSGmbHDE	false
35.51.52.81	unknown	United States	36375	UMICH-AS-5US	false
84.251.65.140	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
176.67.118.180	unknown	Palestinian Territory Occupied	51407	MADA-ASPS	false
41.105.231.121	unknown	Algeria	36947	ALGTEL-ASDZ	false
221.38.109.153	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
118.138.229.101	unknown	Australia	56132	MONASHUNI-AU-AS-APMonashUniversityAU	false
60.252.194.186	unknown	China	17968	DQTNETDaqingzhongjipetroleumtelecommunicationconstructi	false
216.121.161.41	unknown	Canada	7992	COGECOWAVECA	false
193.55.40.46	unknown	France	2200	FR-RENATERReseauNationaldetelecommunicationspourlaTec	false
66.62.203.11	unknown	United States	19092	360NETWORKS-US	false
190.72.15.46	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	false
34.48.25.15	unknown	United States	2686	ATGS-MMD-ASUS	false
36.234.139.120	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
66.85.144.85	unknown	United States	20454	SSASN2US	false
186.190.103.242	unknown	Haiti	27759	ACCESSHAITISAHT	false
170.219.209.110	unknown	United States	8103	STATE-OF-FLAUS	false
194.158.255.193	unknown	Switzerland	6730	SUNRISECH	false
212.167.23.91	unknown	European Union	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
44.232.80.36	unknown	United States	16509	AMAZON-02US	false
205.81.48.160	unknown	United States	647	DNIC-ASBLK-00616-00665US	false
31.94.62.206	unknown	United Kingdom	12576	EELtdGB	false
136.253.136.239	unknown	United States	72	SCHLUMBERGER-ASUS	false
110.155.6.247	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
47.69.209.85	unknown	United States	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
162.206.35.193	unknown	United States	7018	ATT-INTERNET4US	false
109.131.127.171	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
216.225.25.187	unknown	United States	53540	PRODEGE-LAUS	false
84.22.255.9	unknown	Saudi Arabia	25233	AWALNET-ASNSA	false
139.187.112.255	unknown	United States	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
174.185.188.82	unknown	United States	7922	COMCAST-7922US	false
190.248.105.50	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	false
68.1.111.253	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
32.247.143.62	unknown	United States	2686	ATGS-MMD-ASUS	false
140.205.153.175	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
177.215.3.179	unknown	Brazil	26599	TELEFONICABRASILSABR	false
143.219.16.196	unknown	United States	4739	INTERNODE-ASInternodePtyLtdAU	false
115.16.161.19	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
132.185.252.158	unknown	United Kingdom	31459	BBC-RD-ASBritishBroadcastingCorporationGB	false
37.104.233.233	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
1.147.27.154	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
221.251.101.206	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
190.35.174.224	unknown	Panama	11556	CableWirelessPanamaPA	false
136.9.166.202	unknown	United States	10146	FORD-MOTOR-CO-SG-APFordMotorCompanySG	false
159.106.85.44	unknown	United States	16050	REUTERS-DOCKLANDS-RES-ASReutersDocklandsresiliancyGB	false
101.0.66.226	unknown	Australia	55803	DIGITALPACIFIC-AUDigitalPacificPtyLtdAustraliaAU	false
100.43.91.168	unknown	United States	13238	YANDEXRU	false
129.206.24.194	unknown	Germany	553	BELWUEBelWue-KoordinationEU	false
91.16.113.153	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
62.206.192.252	unknown	Germany	20676	PLUSNETDE	false
150.216.202.48	unknown	United States	10952	ECU-ASUS	false

Match	Associated Sample Name / URL	SHA 256	Detection	Link
46.28.115.207	nj6dUhYsz3	Get hash	malicious	Browse
121.101.75.11	DkTfOvsiCR	Get hash	malicious	Browse
181.10.135.184	0AQOcdTkg3	Get hash	malicious	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC	zz.ppc.vir	Get hash	malicious	Browse	163.22.84.136
	irc.arm7.vir	Get hash	malicious	Browse	192.83.202.89
	ZG9zarm.vir	Get hash	malicious	Browse	192.208.101.97
	crmpsl.vir	Get hash	malicious	Browse	163.15.191.249
	C4tqQ3quOl	Get hash	malicious	Browse	210.70.18.95
	pandora.mpsl	Get hash	malicious	Browse	163.30.211.186
	U6YXW1mibO	Get hash	malicious	Browse	203.72.200.0
	oHt25On1Gg	Get hash	malicious	Browse	163.16.221.210
	IN5bTP1t3w	Get hash	malicious	Browse	210.240.94.45
	zZssO0KQet	Get hash	malicious	Browse	163.24.219.88
	vailon.mips	Get hash	malicious	Browse	163.32.219.39
	RvorDYwpTp	Get hash	malicious	Browse	140.92.245.40
	apep.arm7	Get hash	malicious	Browse	210.70.55.68
	RkZav8Iku2	Get hash	malicious	Browse	163.14.3.7
	l0UcqTdOE7	Get hash	malicious	Browse	140.129.150.105
	IHrIOOOJnJ	Get hash	malicious	Browse	163.30.211.164
	UKgGhSkj8n	Get hash	malicious	Browse	210.240.69.77
	TjfGJU5KmC	Get hash	malicious	Browse	163.23.243.5
	dZmqK32fK4	Get hash	malicious	Browse	163.32.226.102
	BTO16Sgzzc	Get hash	malicious	Browse	163.39.10.146
ATGS-MMD-ASUS	arm	Get hash	malicious	Browse	57.157.183.45
	arm-20220620-2150	Get hash	malicious	Browse	57.211.133.78
	ZG9zx86	Get hash	malicious	Browse	32.173.179.36
	arm7	Get hash	malicious	Browse	48.227.26.63
	arm7-20220620-2150	Get hash	malicious	Browse	57.197.8.210
	zz.arm4.vir	Get hash	malicious	Browse	57.226.114.226
	zz.arm7.vir	Get hash	malicious	Browse	48.94.21.88
	zz.m68k.vir	Get hash	malicious	Browse	48.135.141.58
	root	Get hash	malicious	Browse	57.166.32.252
	rtk	Get hash	malicious	Browse	48.198.48.152
	yarn	Get hash	malicious	Browse	48.51.7.246
	zz.mips.vir	Get hash	malicious	Browse	57.10.14.209
	zz.mpsl.vir	Get hash	malicious	Browse	48.13.110.158
	zz.sh4.vir	Get hash	malicious	Browse	32.192.65.190
	zz.spc.vir	Get hash	malicious	Browse	57.150.147.138
	100617275128197521977.xls	Get hash	malicious	Browse	33.24.189.62
	Liste 3547.xls	Get hash	malicious	Browse	32.205.134.43
	Fattura 11155.xls	Get hash	malicious	Browse	57.35.171.2
	irc.x86-20220619-1341	Get hash	malicious	Browse	48.217.225.147
	irc.arm-20220619-1341	Get hash	malicious	Browse	32.3.103.223
MSGDE	sora.arm7	Get hash	malicious	Browse	46.28.115.209
	nj6dUhYsz3	Get hash	malicious	Browse	46.28.115.207
	ZURsgfqgkk	Get hash	malicious	Browse	46.28.115.208
	Y1ya41Oojz	Get hash	malicious	Browse	46.28.115.200
	pandora.arm7	Get hash	malicious	Browse	194.99.56.161

Process:	/usr/bin/cloud-id
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:x:x
MD5:	7E5B152FCF63F8DAB71A695D1DBE01FA
SHA1:	02135FF9133DB03A40AAFF586BB173E6A7A6998F
SHA-256:	FCF33DFBE13C2354BF0E1B063F9FB422747A46CEE00B7420BCEFF2B81457B345
SHA-512:	92E89A3C69C643FBB194686598193C219C1A11F07DD36F3883D63AAA867077691F193F8E89F31AE3754EA0E860E2910A3F9247927C93C0B977009FD860F812DA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	none.

Process:	/usr/bin/wget
File Type:	UTF-8 Unicode text
Category:	dropped
Size (bytes):	494
Entropy (8bit):	4.949308041010003
Encrypted:	false
SSDEEP:	6:HXPKr0AYLEHKLG13/3xg7F/uZCHKLGZgM/Tt5RhgZDl7jzisnfbLWgxdf4kpasBG:HfG0TL6OM48QTt5Rh0isXWgxdpzG
MD5:	ABC1771CF843ADD743FDCFC0264163F2
SHA1:	CCD134665F66159F2F4DAB858E567DDA98D51D29
SHA-256:	8F2B7DA403C8DAB0BFD9D1AB495A33AC64913E3CD006D1B1ED080251F5F4593A
SHA-512:	CEC0545E6D39E6F94322362E6BA66F5F3E00B369B56AD244093D038D0738413FEBE394CDE5288E8096B5D45625FF7EE371084CB3BBE5D4FE183ACAF5BC10994F
Malicious:	false
Reputation:	low
Preview:	--2022-06-21 00:52:58-- https://motd.ubuntu.com/.Resolving motd.ubuntu.com (motd.ubuntu.com)... 54.171.230.55, 34.249.145.219, 2a05:d018:91c:3200:2846:99fb:81b6:1e11, ....Connecting to motd.ubuntu.com (motd.ubuntu.com)\|54.171.230.55\|:443... connected..HTTP request sent, awaiting response... 200 OK.Length: 191 [text/plain].Saving to: .STDOUT... 0K 100% 87.7K=0.002s..2022-06-21 00:52:59 (87.7 KB/s) - written to stdout [191/191]..

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	4.657516417799966
Encrypted:	false
SSDEEP:	6144:rb7cWWov4H5N80nuDSyvxYCWZ0/VmpRELAR/QuU/MzUCl1NZ:H4WWoGgvSiOp2kl
MD5:	0C99179B6C5CFE82203424AD7DAD0D8F
SHA1:	CAC50B64B1352723FF8F58BB1B103B93C396539B
SHA-256:	CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
SHA-512:	4226FDE9F558FFEF2107C330DB942E7E665C51C520A840221541AD255D0995AF64101C69D42C4BD43037364CC4D152851625A53DC56CC188DC28A3DC8C5602F6
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	/usr/bin/cut
File Type:	ASCII text
Category:	dropped
Size (bytes):	191
Entropy (8bit):	4.515771857099866
Encrypted:	false
SSDEEP:	3:P2lnI+5MsqqzNLz+FRNScHUBfRau95++sZzR5woLB1Fh0VTGTl/X5kURn:OZ8uNLzDc0pR75+9Zz/woFmIT52URn
MD5:	DD514F892B5F93ED615D366E58AC58AF
SHA1:	BA75EDB3C2232CC260BC187F604DC8F25AA72C11
SHA-256:	F40D0DCE6E83DF74109FEF5E68E51CC255727783EEAE04C3E34677E23F7552CF
SHA-512:	9150BDE63F6C4850C5340D8877892B4D9BBF9EBDC98CDCF557A93FA304C1222CEE446418F5BE2ACCDBF38393778AFA5D4F3EDCB37A47BF57D3A4B2DEAD42A2D0
Malicious:	false
Preview:	* Super-optimized for small spaces - read how we shrank the memory. footprint of MicroK8s to make it the smallest full K8s around... https://ubuntu.com/blog/microk8s-memory-optimisation.

Process:	/usr/sbin/logrotate
File Type:	ASCII text
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.781275096514109
Encrypted:	false
SSDEEP:	48:U2MxqJFNhxr0NxoxK5Npq4pN+xJNcsXNU3N6NA5Rx5x2tNq4wNZNDNU1LN3o9Nlp:rryrm4puxe3MmgA4wTteJYcnCA5eC9kR
MD5:	A02A5B69184D42142A6D01CBAFE5690C
SHA1:	711B7ADD7A30B6BAF7CE12F6338D4F305A1AED12
SHA-256:	DD53083B15C0313B1EE1E3C5D07C75E4B96B50ECD32E089B8BFFDE8C66F9B1F3
SHA-512:	B092E085429323BEC37018DA19565C2050457CB97D42D21E2E6E5EF1119105E18A5D6352FABCC88D358EDB7FC3843BC9658B6E8BF94CB65314A6414EEA606042
Malicious:	false
Preview:	logrotate state -- version 2."/var/log/syslog" 2022-6-21-0:51:0."/var/log/dpkg.log" 2022-6-20-22:50:34."/var/log/speech-dispatcher/debug-flite" 2021-8-20-13:0:0."/var/log/unattended-upgrades/unattended-upgrades.log" 2022-6-20-22:50:34."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2021-9-17-9:23:29."/var/log/auth.log" 2022-6-20-22:50:34."/var/log/apt/term.log" 2022-6-20-22:50:34."/var/log/ppp-connect-errors" 2021-8-20-13:0:0."/var/log/apport.log" 2021-9-17-9:23:29."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2021-8-20-13:0:0."/var/log/apt/history.log" 2022-6-20-22:50:34."/var/log/boot.log" 2021-8-20-13:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/lightdm/*.log" 2021-8-20-13:0:0."/var/log/mail.log" 2021-8-20-13:0:0."/var/log/debug" 2021-8-20-13:0:0."/var/log/kern.log" 2022-6-20-22:50:34."/var/log/cups/access_log" 2022-6-21-0:51:0."/var/log/ufw.log" 2021-8-20-13:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2021-8-20-13:0:0."/var/lo

Process:	/bin/gzip
File Type:	gzip compressed data, last modified: Mon Jun 20 22:50:34 2022, from Unix
Category:	dropped
Size (bytes):	197
Entropy (8bit):	6.905511131659042
Encrypted:	false
SSDEEP:	6:XH4AlbXwD5WIk+TbXMEX9olozCK6ppGe3Abf99dIs3M/6ru:XXl88IS+KZK6mbbf3K+U
MD5:	56ADEEC8E2CEDEA3E4FB92844E253832
SHA1:	2B0345D2D1A227DD2C87A09B99A90B2DCF56A55D
SHA-256:	C50603D67CA96050F8C6E23A60206FDCCEEC9057828C531CBA846771E80C9EA5
SHA-512:	1454BADECB84FEC262D9A10EC069D0A1119F41568A5B5379660593CCF324E093A34D992BB9DC6120D25EB20F3A342BD9131D986D661B02906307510D68ACC32D
Malicious:	false
Preview:	.......b......0......JLr...E\,..8.b0.J~....PAz..?.#=.;..l.Y.yg...J%j....6b.......[..r.(..e.M0C2...'.X..Q..L.\|...61..1z..RO.w.<.....C5...(.RH.X@3xm...D._..lF..........H..=.x.......Y...

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.025780872310671
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	cutie.arm7
File size:	160675
MD5:	46694d76e53225e65f8213519ba44145
SHA1:	068c29054d42763b9fea35403b932e6c07a5600a
SHA256:	0058aff1db7f17a2b675528d0a3d156196ae1bc38dc26fec9ca7e93d62409bc1
SHA512:	09734f11186c5f55cff49c5350845c020e1665c09ff93a0555fa54e01702f13a3d52d065d1da1c542cdd8a3da51bc54528545c3c583e7a8191f1c402ff7fa112
SSDEEP:	3072:PrMw1NvN7yglJuM5tf9TXcWioEMLBpOxSUnfQBSB5qM/97vzV9:Prr1NvN7yglJuM5Z9L4oEMLBpeSRBSBv
TLSH:	5AF34C46EA818A13C4D727BAFAAF01493332A7A4D3DB73068D185FB43F8675E0D63645
File Content Preview:	.ELF..............(.........4...........4. ...(........p.....!...!..................................0...0...............0...0...0.......@4..............4...4...4...................Q.td..................................-...L..................@-.,@...0....S