Edit tour

Linux Analysis Report
EatRCJ6tNe.elf

Overview

General Information

Sample Name:	EatRCJ6tNe.elf
Original Sample Name:	e521f0731bd62f953898e9a5614d01eb.elf
Analysis ID:	834296
MD5:	e521f0731bd62f953898e9a5614d01eb
SHA1:	2decbd11e6ba175313c3df84b238b2f1afc0d40b
SHA256:	dcaa798d2ebaa6d35cfd0ada1fa67271f87975ed1b85fb7ac3239b4d96c8c72c
Tags:	32elfmiraisparc
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Reads system files that contain records of logged in users

Sample tries to kill multiple processes (SIGKILL)

Sample reads /proc/mounts (often used for finding a writable filesystem)

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Yara signature match

Executes the "grep" command used to find patterns in files or piped streams

Reads system information from the proc file system

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Deletes log files

Creates hidden files and/or directories

Sample has stripped symbol table

Sample tries to set the executable flag

HTTP GET or POST without a user agent

Executes commands using a shell command-line interpreter

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	834296
Start date and time:	2023-03-24 17:05:21 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	EatRCJ6tNe.elf
Original Sample Name:	e521f0731bd62f953898e9a5614d01eb.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/48@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/EatRCJ6tNe.elf
PID:	6229
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

EatRCJ6tNe.elf (PID: 6229, Parent: 6120, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/EatRCJ6tNe.elf

EatRCJ6tNe.elf New Fork (PID: 6231, Parent: 6229)

EatRCJ6tNe.elf New Fork (PID: 6232, Parent: 6229)

EatRCJ6tNe.elf New Fork (PID: 6233, Parent: 6229)

EatRCJ6tNe.elf New Fork (PID: 6237, Parent: 6233)

EatRCJ6tNe.elf New Fork (PID: 6238, Parent: 6233)

EatRCJ6tNe.elf New Fork (PID: 6241, Parent: 6233)

systemd New Fork (PID: 6252, Parent: 1)

journalctl (PID: 6252, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6281, Parent: 1)

dbus-daemon (PID: 6281, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6284, Parent: 1320)

Default (PID: 6284, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6287, Parent: 1860)

pulseaudio (PID: 6287, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6288, Parent: 1)

systemd-journald (PID: 6288, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

gdm3 New Fork (PID: 6289, Parent: 1320)

Default (PID: 6289, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6290, Parent: 1)

rsyslogd (PID: 6290, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 6291, Parent: 1320)

Default (PID: 6291, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gvfsd-fuse New Fork (PID: 6297, Parent: 2038)

fusermount (PID: 6297, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6305, Parent: 1)

systemd-logind (PID: 6305, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6362, Parent: 1)

rtkit-daemon (PID: 6362, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6366, Parent: 1)

gpu-manager (PID: 6366, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6368, Parent: 6366)

sh (PID: 6368, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6371, Parent: 6368)

grep (PID: 6371, Parent: 6368, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6376, Parent: 6366)

sh (PID: 6376, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6378, Parent: 6376)

grep (PID: 6378, Parent: 6376, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6379, Parent: 6366)

sh (PID: 6379, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6380, Parent: 6379)

grep (PID: 6380, Parent: 6379, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6381, Parent: 6366)

sh (PID: 6381, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6382, Parent: 6381)

grep (PID: 6382, Parent: 6381, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6383, Parent: 6366)

sh (PID: 6383, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6384, Parent: 6383)

grep (PID: 6384, Parent: 6383, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6385, Parent: 6366)

sh (PID: 6385, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6386, Parent: 6385)

grep (PID: 6386, Parent: 6385, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6389, Parent: 6366)

sh (PID: 6389, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6390, Parent: 6389)

grep (PID: 6390, Parent: 6389, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6391, Parent: 6366)

sh (PID: 6391, Parent: 6366, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6392, Parent: 6391)

grep (PID: 6392, Parent: 6391, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6367, Parent: 1)

polkitd (PID: 6367, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6377, Parent: 1)

agetty (PID: 6377, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6398, Parent: 1)

generate-config (PID: 6398, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6399, Parent: 6398)

pkill (PID: 6399, Parent: 6398, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6400, Parent: 1)

journalctl (PID: 6400, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6405, Parent: 1)

gdm-wait-for-drm (PID: 6405, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6410, Parent: 1)

gdm3 (PID: 6410, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6413, Parent: 6410)

plymouth (PID: 6413, Parent: 6410, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6423, Parent: 6410)

gdm-session-worker (PID: 6423, Parent: 6410, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6429, Parent: 6423)

gdm-wayland-session (PID: 6429, Parent: 6423, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6431, Parent: 6429)

dbus-daemon (PID: 6431, Parent: 6429, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6433, Parent: 6431)

dbus-daemon New Fork (PID: 6434, Parent: 6433)

false (PID: 6434, Parent: 6433, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6435, Parent: 6429)

dbus-run-session (PID: 6435, Parent: 6429, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6436, Parent: 6435)

dbus-daemon (PID: 6436, Parent: 6435, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6437, Parent: 6410)

Default (PID: 6437, Parent: 6410, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6438, Parent: 6410)

Default (PID: 6438, Parent: 6410, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6414, Parent: 1)

accounts-daemon (PID: 6414, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6418, Parent: 6414)

language-validate (PID: 6418, Parent: 6414, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6419, Parent: 6418)

language-options (PID: 6419, Parent: 6418, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6420, Parent: 6419)

sh (PID: 6420, Parent: 6419, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6421, Parent: 6420)

locale (PID: 6421, Parent: 6420, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6422, Parent: 6420)

grep (PID: 6422, Parent: 6420, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6462, Parent: 1860)

dbus-daemon (PID: 6462, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6463, Parent: 1860)

pulseaudio (PID: 6463, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
EatRCJ6tNe.elf	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x16ae0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16b50:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16bc0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16c30:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16ca0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f20:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f78:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16fd0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17028:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17080:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17770:$xo1: zXM^[[V\x18\x02\x19\x07 0x177e0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17850:$xo1: zXM^[[V\x18\x02\x19\x07 0x178c0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17930:$xo1: zXM^[[V\x18\x02\x19\x07
EatRCJ6tNe.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth (Nextron Systems)	0x158c8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
EatRCJ6tNe.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
EatRCJ6tNe.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15a50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15aa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ab4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15adc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15af0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15be0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6238.1.00007f5840011000.00007f5840029000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x16ae0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16b50:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16bc0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16c30:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16ca0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f20:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f78:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16fd0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17028:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17080:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17770:$xo1: zXM^[[V\x18\x02\x19\x07 0x177e0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17850:$xo1: zXM^[[V\x18\x02\x19\x07 0x178c0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17930:$xo1: zXM^[[V\x18\x02\x19\x07
6238.1.00007f5840011000.00007f5840029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth (Nextron Systems)	0x158c8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6238.1.00007f5840011000.00007f5840029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6238.1.00007f5840011000.00007f5840029000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15a50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15aa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ab4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15adc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15af0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15be0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6232.1.00007f584003a000.00007f584003e000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x25d4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2648:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x26bc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2730:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x27a4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2a24:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2a7c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2ad4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2b2c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2b84:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2f9c:$xo1: zXM^[[V\x18\x02\x19\x07 0x3010:$xo1: zXM^[[V\x18\x02\x19\x07 0x3084:$xo1: zXM^[[V\x18\x02\x19\x07 0x30f8:$xo1: zXM^[[V\x18\x02\x19\x07 0x316c:$xo1: zXM^[[V\x18\x02\x19\x07
6233.1.00007f5840011000.00007f5840029000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x16ae0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16b50:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16bc0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16c30:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16ca0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f20:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f78:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16fd0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17028:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17080:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17770:$xo1: zXM^[[V\x18\x02\x19\x07 0x177e0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17850:$xo1: zXM^[[V\x18\x02\x19\x07 0x178c0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17930:$xo1: zXM^[[V\x18\x02\x19\x07
6233.1.00007f5840011000.00007f5840029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth (Nextron Systems)	0x158c8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6233.1.00007f5840011000.00007f5840029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6233.1.00007f5840011000.00007f5840029000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15a50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15aa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ab4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15adc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15af0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15be0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6229.1.00007f5840011000.00007f5840029000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x16ae0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16b50:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16bc0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16c30:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16ca0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f20:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f78:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16fd0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17028:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17080:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17770:$xo1: zXM^[[V\x18\x02\x19\x07 0x177e0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17850:$xo1: zXM^[[V\x18\x02\x19\x07 0x178c0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17930:$xo1: zXM^[[V\x18\x02\x19\x07
6229.1.00007f5840011000.00007f5840029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth (Nextron Systems)	0x158c8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6229.1.00007f5840011000.00007f5840029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6229.1.00007f5840011000.00007f5840029000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15a50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15aa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ab4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15adc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15af0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15be0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6238.1.00007f584003a000.00007f584003e000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x25d4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2648:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x26bc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2730:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x27a4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2a24:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2a7c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2ad4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2b2c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2b84:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2f9c:$xo1: zXM^[[V\x18\x02\x19\x07 0x3010:$xo1: zXM^[[V\x18\x02\x19\x07 0x3084:$xo1: zXM^[[V\x18\x02\x19\x07 0x30f8:$xo1: zXM^[[V\x18\x02\x19\x07 0x316c:$xo1: zXM^[[V\x18\x02\x19\x07
6232.1.00007f5840011000.00007f5840029000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x16ae0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16b50:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16bc0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16c30:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16ca0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f20:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f78:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16fd0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17028:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17080:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17770:$xo1: zXM^[[V\x18\x02\x19\x07 0x177e0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17850:$xo1: zXM^[[V\x18\x02\x19\x07 0x178c0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17930:$xo1: zXM^[[V\x18\x02\x19\x07
6232.1.00007f5840011000.00007f5840029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth (Nextron Systems)	0x158c8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6232.1.00007f5840011000.00007f5840029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6232.1.00007f5840011000.00007f5840029000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15a50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15aa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ab4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15adc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15af0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15be0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6229.1.00007f584003a000.00007f584003e000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x25d4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2648:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x26bc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2730:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x27a4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2a24:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2a7c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2ad4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2b2c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2b84:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2f9c:$xo1: zXM^[[V\x18\x02\x19\x07 0x3010:$xo1: zXM^[[V\x18\x02\x19\x07 0x3084:$xo1: zXM^[[V\x18\x02\x19\x07 0x30f8:$xo1: zXM^[[V\x18\x02\x19\x07 0x316c:$xo1: zXM^[[V\x18\x02\x19\x07
6237.1.00007f5840011000.00007f5840029000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x16ae0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16b50:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16bc0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16c30:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16ca0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f20:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f78:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16fd0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17028:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17080:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17770:$xo1: zXM^[[V\x18\x02\x19\x07 0x177e0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17850:$xo1: zXM^[[V\x18\x02\x19\x07 0x178c0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17930:$xo1: zXM^[[V\x18\x02\x19\x07
6237.1.00007f5840011000.00007f5840029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth (Nextron Systems)	0x158c8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6237.1.00007f5840011000.00007f5840029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6237.1.00007f5840011000.00007f5840029000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15a50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15aa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ab4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15adc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15af0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15be0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6237.1.00007f584003a000.00007f584003e000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x25d4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2648:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x26bc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2730:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x27a4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2a24:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2a7c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2ad4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2b2c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2b84:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2f9c:$xo1: zXM^[[V\x18\x02\x19\x07 0x3010:$xo1: zXM^[[V\x18\x02\x19\x07 0x3084:$xo1: zXM^[[V\x18\x02\x19\x07 0x30f8:$xo1: zXM^[[V\x18\x02\x19\x07 0x316c:$xo1: zXM^[[V\x18\x02\x19\x07
6233.1.00007f584003a000.00007f584003e000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x25d4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2648:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x26bc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2730:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x27a4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2a24:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2a7c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2ad4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2b2c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2b84:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2f9c:$xo1: zXM^[[V\x18\x02\x19\x07 0x3010:$xo1: zXM^[[V\x18\x02\x19\x07 0x3084:$xo1: zXM^[[V\x18\x02\x19\x07 0x30f8:$xo1: zXM^[[V\x18\x02\x19\x07 0x316c:$xo1: zXM^[[V\x18\x02\x19\x07
6231.1.00007f5840011000.00007f5840029000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x16ae0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16b50:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16bc0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16c30:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16ca0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f20:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16f78:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x16fd0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17028:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17080:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x17770:$xo1: zXM^[[V\x18\x02\x19\x07 0x177e0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17850:$xo1: zXM^[[V\x18\x02\x19\x07 0x178c0:$xo1: zXM^[[V\x18\x02\x19\x07 0x17930:$xo1: zXM^[[V\x18\x02\x19\x07
6231.1.00007f5840011000.00007f5840029000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth (Nextron Systems)	0x158c8:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
6231.1.00007f5840011000.00007f5840029000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
6231.1.00007f5840011000.00007f5840029000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15a50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15aa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ab4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15adc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15af0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15be0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6231.1.00007f584003a000.00007f584003e000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x25d4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2648:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x26bc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2730:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x27a4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2a24:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2a7c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2ad4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2b2c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2b84:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x2f9c:$xo1: zXM^[[V\x18\x02\x19\x07 0x3010:$xo1: zXM^[[V\x18\x02\x19\x07 0x3084:$xo1: zXM^[[V\x18\x02\x19\x07 0x30f8:$xo1: zXM^[[V\x18\x02\x19\x07 0x316c:$xo1: zXM^[[V\x18\x02\x19\x07
Process Memory Space: EatRCJ6tNe.elf PID: 6229	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4be1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4bf5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c31:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c95:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ca9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cbd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cd1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ce5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cf9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d0d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d21:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d49:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d5d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d71:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: EatRCJ6tNe.elf PID: 6231	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x112f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11309:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1131d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11331:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11345:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11359:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1136d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11381:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11395:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x113f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1140d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11421:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11435:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11449:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1145d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11471:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11485:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: EatRCJ6tNe.elf PID: 6232	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe7e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe92:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xece:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf32:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf46:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf82:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf96:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfaa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: EatRCJ6tNe.elf PID: 6233	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x662:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x676:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x68a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x69e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x702:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x716:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x72a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x73e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x752:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x766:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x77a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x78e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: EatRCJ6tNe.elf PID: 6237	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x159ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15aa3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ab7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15acb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15adf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15af3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: EatRCJ6tNe.elf PID: 6238	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x34c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 31 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38096
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 145.214.217.132
Source: unknown	TCP traffic detected without corresponding DNS query: 37.161.255.146
Source: unknown	TCP traffic detected without corresponding DNS query: 250.95.182.253
Source: unknown	TCP traffic detected without corresponding DNS query: 171.16.4.67
Source: unknown	TCP traffic detected without corresponding DNS query: 95.155.139.215
Source: unknown	TCP traffic detected without corresponding DNS query: 194.23.187.53
Source: unknown	TCP traffic detected without corresponding DNS query: 158.43.34.132
Source: unknown	TCP traffic detected without corresponding DNS query: 83.193.48.247
Source: unknown	TCP traffic detected without corresponding DNS query: 125.85.227.145
Source: unknown	TCP traffic detected without corresponding DNS query: 119.200.45.151
Source: unknown	TCP traffic detected without corresponding DNS query: 185.157.109.238
Source: unknown	TCP traffic detected without corresponding DNS query: 157.147.89.205
Source: unknown	TCP traffic detected without corresponding DNS query: 119.220.117.184
Source: unknown	TCP traffic detected without corresponding DNS query: 189.152.36.88
Source: unknown	TCP traffic detected without corresponding DNS query: 34.200.3.44
Source: unknown	TCP traffic detected without corresponding DNS query: 247.125.94.73
Source: unknown	TCP traffic detected without corresponding DNS query: 72.234.128.137
Source: unknown	TCP traffic detected without corresponding DNS query: 43.42.100.109
Source: unknown	TCP traffic detected without corresponding DNS query: 141.181.159.104
Source: unknown	TCP traffic detected without corresponding DNS query: 88.22.23.25
Source: unknown	TCP traffic detected without corresponding DNS query: 220.247.119.63
Source: unknown	TCP traffic detected without corresponding DNS query: 195.40.78.238
Source: unknown	TCP traffic detected without corresponding DNS query: 170.96.141.157
Source: unknown	TCP traffic detected without corresponding DNS query: 154.1.202.240
Source: unknown	TCP traffic detected without corresponding DNS query: 130.39.236.114
Source: unknown	TCP traffic detected without corresponding DNS query: 98.57.208.191
Source: unknown	TCP traffic detected without corresponding DNS query: 157.237.237.188
Source: unknown	TCP traffic detected without corresponding DNS query: 218.26.251.29
Source: unknown	TCP traffic detected without corresponding DNS query: 158.39.19.100
Source: unknown	TCP traffic detected without corresponding DNS query: 194.150.126.22
Source: unknown	TCP traffic detected without corresponding DNS query: 70.4.174.115
Source: unknown	TCP traffic detected without corresponding DNS query: 71.59.2.118
Source: unknown	TCP traffic detected without corresponding DNS query: 175.231.2.56
Source: unknown	TCP traffic detected without corresponding DNS query: 145.249.64.135
Source: unknown	TCP traffic detected without corresponding DNS query: 192.164.158.224
Source: unknown	TCP traffic detected without corresponding DNS query: 188.157.227.30
Source: unknown	TCP traffic detected without corresponding DNS query: 165.24.253.234
Source: unknown	TCP traffic detected without corresponding DNS query: 109.251.119.64
Source: unknown	TCP traffic detected without corresponding DNS query: 32.166.168.198
Source: unknown	TCP traffic detected without corresponding DNS query: 8.71.82.114
Source: unknown	TCP traffic detected without corresponding DNS query: 68.254.161.20
Source: unknown	TCP traffic detected without corresponding DNS query: 121.204.16.40
Source: unknown	TCP traffic detected without corresponding DNS query: 19.248.192.139
Source: unknown	TCP traffic detected without corresponding DNS query: 205.235.243.64
Source: unknown	TCP traffic detected without corresponding DNS query: 136.70.90.26
Source: unknown	TCP traffic detected without corresponding DNS query: 218.178.12.12
Source: unknown	TCP traffic detected without corresponding DNS query: 163.149.250.227
Source: unknown	TCP traffic detected without corresponding DNS query: 254.24.144.93
Source: unknown	TCP traffic detected without corresponding DNS query: 27.68.232.143

Source: syslog.32.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: EatRCJ6tNe.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth (Nextron Systems)
Source: EatRCJ6tNe.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6238.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth (Nextron Systems)
Source: 6238.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6233.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth (Nextron Systems)
Source: 6233.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6229.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth (Nextron Systems)
Source: 6229.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6232.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth (Nextron Systems)
Source: 6232.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6237.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth (Nextron Systems)
Source: 6237.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6231.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth (Nextron Systems)
Source: 6231.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: EatRCJ6tNe.elf PID: 6229, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: EatRCJ6tNe.elf PID: 6231, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: EatRCJ6tNe.elf PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: EatRCJ6tNe.elf PID: 6233, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: EatRCJ6tNe.elf PID: 6237, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: EatRCJ6tNe.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 6231, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 6045, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 6187, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 6188, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 6233, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 6237, result: unknown	Jump to behavior

Source: EatRCJ6tNe.elf, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: EatRCJ6tNe.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth (Nextron Systems), description = Detects ELF malware Mirai related, reference = Internal Research
Source: EatRCJ6tNe.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6238.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6238.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth (Nextron Systems), description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6238.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6232.1.00007f584003a000.00007f584003e000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6233.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6233.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth (Nextron Systems), description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6233.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6229.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6229.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth (Nextron Systems), description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6229.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6238.1.00007f584003a000.00007f584003e000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6232.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6232.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth (Nextron Systems), description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6232.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6229.1.00007f584003a000.00007f584003e000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6237.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6237.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth (Nextron Systems), description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6237.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6237.1.00007f584003a000.00007f584003e000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6233.1.00007f584003a000.00007f584003e000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6231.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6231.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth (Nextron Systems), description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6231.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6231.1.00007f584003a000.00007f584003e000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: Process Memory Space: EatRCJ6tNe.elf PID: 6229, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: EatRCJ6tNe.elf PID: 6231, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: EatRCJ6tNe.elf PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: EatRCJ6tNe.elf PID: 6233, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: EatRCJ6tNe.elf PID: 6237, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: EatRCJ6tNe.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 6231, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 6045, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 6187, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 6188, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 6233, result: successful	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	SIGKILL sent: pid: 6237, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/48@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6281)	File: /proc/6281/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6297)	File: /proc/6297/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6431)	File: /proc/6431/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6462)	File: /proc/6462/mounts	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6399)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /bin/sh (PID: 6371)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6378)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6380)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6382)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6384)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6386)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6390)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6392)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6422)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6288)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/88/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/89/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/115/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/116/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/117/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/91/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/118/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/92/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/119/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/93/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/94/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/95/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/96/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/97/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/98/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/11/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/99/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/12/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/13/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/14/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/15/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/16/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/17/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/18/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/120/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/121/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/122/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/123/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/124/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/125/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/126/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/127/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/128/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/20/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/21/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/22/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/23/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/24/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/25/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/26/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/27/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/28/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/29/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/130/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/132/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/30/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/35/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/141/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/144/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/785/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/788/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/789/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/793/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/157/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/796/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/797/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/799/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/201/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/202/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/720/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/203/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/721/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/204/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/205/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/206/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/207/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/208/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/847/fd	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/209/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/210/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/211/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/212/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/213/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/214/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/215/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/216/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/217/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/218/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/219/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/77/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/78/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/79/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/220/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/100/maps	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	File opened: /proc/221/maps	Jump to behavior

Source: /usr/lib/policykit-1/polkitd (PID: 6367)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6429)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6414)	Directory: /root/.cache	Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6410)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6410)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6414)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6414)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6368)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6376)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6379)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6381)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6383)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6385)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6389)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6391)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6420)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6290)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6290)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6366)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Source: /usr/bin/pulseaudio (PID: 6287)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6399)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6463)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: /tmp/EatRCJ6tNe.elf (PID: 6229)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6287)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6288)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6290)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6366)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6377)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6423)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6463)	Queries kernel information via 'uname':	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6366)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: EatRCJ6tNe.elf, 6229.1.000055851ad24000.000055851ada9000.rw-.sdmp, EatRCJ6tNe.elf, 6231.1.000055851ad24000.000055851ada9000.rw-.sdmp, EatRCJ6tNe.elf, 6232.1.000055851ad24000.000055851ada9000.rw-.sdmp, EatRCJ6tNe.elf, 6233.1.000055851ad24000.000055851ada9000.rw-.sdmp, EatRCJ6tNe.elf, 6237.1.000055851ad24000.000055851ada9000.rw-.sdmp, EatRCJ6tNe.elf, 6238.1.000055851ad24000.000055851ada9000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: EatRCJ6tNe.elf, 6229.1.000055851ad24000.000055851ada9000.rw-.sdmp, EatRCJ6tNe.elf, 6231.1.000055851ad24000.000055851ada9000.rw-.sdmp, EatRCJ6tNe.elf, 6232.1.000055851ad24000.000055851ada9000.rw-.sdmp, EatRCJ6tNe.elf, 6233.1.000055851ad24000.000055851ada9000.rw-.sdmp, EatRCJ6tNe.elf, 6237.1.000055851ad24000.000055851ada9000.rw-.sdmp, EatRCJ6tNe.elf, 6238.1.000055851ad24000.000055851ada9000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: EatRCJ6tNe.elf, 6237.1.00007fffe3955000.00007fffe3976000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.REcFDM
Source: EatRCJ6tNe.elf, 6237.1.00007fffe3955000.00007fffe3976000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.REcFDM
Source: EatRCJ6tNe.elf, 6229.1.00007fffe3955000.00007fffe3976000.rw-.sdmp, EatRCJ6tNe.elf, 6231.1.00007fffe3955000.00007fffe3976000.rw-.sdmp, EatRCJ6tNe.elf, 6232.1.00007fffe3955000.00007fffe3976000.rw-.sdmp, EatRCJ6tNe.elf, 6233.1.00007fffe3955000.00007fffe3976000.rw-.sdmp, EatRCJ6tNe.elf, 6237.1.00007fffe3955000.00007fffe3976000.rw-.sdmp, EatRCJ6tNe.elf, 6238.1.00007fffe3955000.00007fffe3976000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/EatRCJ6tNe.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/EatRCJ6tNe.elf
Source: EatRCJ6tNe.elf, 6229.1.00007fffe3955000.00007fffe3976000.rw-.sdmp, EatRCJ6tNe.elf, 6231.1.00007fffe3955000.00007fffe3976000.rw-.sdmp, EatRCJ6tNe.elf, 6232.1.00007fffe3955000.00007fffe3976000.rw-.sdmp, EatRCJ6tNe.elf, 6233.1.00007fffe3955000.00007fffe3976000.rw-.sdmp, EatRCJ6tNe.elf, 6237.1.00007fffe3955000.00007fffe3976000.rw-.sdmp, EatRCJ6tNe.elf, 6238.1.00007fffe3955000.00007fffe3976000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6414)

Logged in records file read: /var/log/wtmp

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: EatRCJ6tNe.elf, type: SAMPLE
Source: Yara match	File source: 6238.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6231.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: EatRCJ6tNe.elf, type: SAMPLE
Source: Yara match	File source: 6238.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6233.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6231.1.00007f5840011000.00007f5840029000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Service Stop
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Scripting	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Hidden Files and Directories	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Indicator Removal on Host	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
EatRCJ6tNe.elf	68%	ReversingLabs	Linux.Trojan.Mirai
EatRCJ6tNe.elf	61%	Virustotal		Browse
EatRCJ6tNe.elf	100%	Avira	LINUX/Mirai.bonb

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	185.125.188.137	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.32.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
17.242.98.83	unknown	United States	714	APPLE-ENGINEERINGUS	false
61.161.203.230	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
32.143.82.85	unknown	United States	7018	ATT-INTERNET4US	false
190.234.215.28	unknown	Peru	6147	TelefonicadelPeruSAAPE	false
218.115.38.154	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
154.45.54.140	unknown	United States	394973	AARKIUS	false
2.43.111.212	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
158.145.14.203	unknown	United States	3724	ALASKA-ANETUS	false
117.129.57.183	unknown	China	56048	CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN	false
154.132.93.253	unknown	Egypt	37069	MOBINILEG	false
220.138.36.140	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
169.144.157.115	unknown	United States	158	ERI-ASUS	false
219.65.148.170	unknown	India	4755	TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP	false
245.150.196.0	unknown	Reserved	unknown	unknown	false
212.247.40.133	unknown	Sweden	1257	TELE2EU	false
73.213.84.195	unknown	United States	7922	COMCAST-7922US	false
75.162.57.130	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
58.99.132.250	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
163.99.32.203	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
122.155.208.245	unknown	Thailand	9335	CAT-CLOUD-APCATTelecomPublicCompanyLimitedTH	false
74.17.2.167	unknown	United States	7922	COMCAST-7922US	false
241.220.131.153	unknown	Reserved	unknown	unknown	false
174.240.132.135	unknown	United States	22394	CELLCOUS	false
67.5.191.161	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
81.126.212.97	unknown	Italy	3269	ASN-IBSNAZIT	false
200.130.123.146	unknown	Brazil	1916	AssociacaoRedeNacionaldeEnsinoePesquisaBR	false
216.245.143.18	unknown	United States	7381	SRS-6-Z-7381US	false
45.255.61.59	unknown	China	132116	ANINETWORK-INAniNetworkPvtLtdIN	false
68.143.83.49	unknown	United States	7029	WINDSTREAMUS	false
169.128.203.83	unknown	United States	37611	AfrihostZA	false
108.54.12.57	unknown	United States	701	UUNETUS	false
101.160.60.73	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
250.253.208.229	unknown	Reserved	unknown	unknown	false
12.190.125.143	unknown	United States	7018	ATT-INTERNET4US	false
109.219.140.24	unknown	France	3215	FranceTelecom-OrangeFR	false
35.187.106.196	unknown	United States	15169	GOOGLEUS	false
162.107.19.10	unknown	United States	395660	EDMONTON-CA	false
60.151.246.19	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
4.247.191.193	unknown	United States	3356	LEVEL3US	false
240.4.210.132	unknown	Reserved	unknown	unknown	false
150.223.46.131	unknown	China	58519	CHINATELECOM-CTCLOUDCloudComputingCorporationCN	false
163.34.66.54	unknown	Norway	2830	MCI-DUAL-HOMED-CUSTOMERSGB	false
41.17.0.109	unknown	South Africa	29975	VODACOM-ZA	false
186.170.214.64	unknown	Colombia	3816	COLOMBIATELECOMUNICACIONESSAESPCO	false
80.212.30.62	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
94.22.136.77	unknown	Finland	15527	ANVIASilmukkatie6VaasaFinlandFI	false
162.221.96.216	unknown	United States	2386	INS-ASUS	false
211.23.120.169	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
89.0.8.177	unknown	Germany	8422	NETCOLOGNEDE	false
27.196.155.17	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
155.255.220.11	unknown	unknown	394387	VUUUS	false
70.68.87.240	unknown	Canada	6327	SHAWCA	false
188.202.191.245	unknown	Netherlands	1136	KPNKPNNationalEU	false
19.190.82.247	unknown	United States	3	MIT-GATEWAYSUS	false
254.73.235.247	unknown	Reserved	unknown	unknown	false
54.95.166.211	unknown	United States	16509	AMAZON-02US	false
176.145.187.177	unknown	France	5410	BOUYGTEL-ISPFR	false
74.57.30.234	unknown	Canada	5769	VIDEOTRONCA	false
31.112.34.19	unknown	United Kingdom	12576	EELtdGB	false
2.104.76.141	unknown	Denmark	3292	TDCTDCASDK	false
35.210.65.87	unknown	United States	19527	GOOGLE-2US	false
252.225.175.190	unknown	Reserved	unknown	unknown	false
172.226.192.168	unknown	United States	16625	AKAMAI-ASUS	false
169.220.248.149	unknown	Korea Republic of	37611	AfrihostZA	false
122.202.179.26	unknown	Korea Republic of	9946	CABLENET-AS-KRKCTVJEJUBROADCASTINGKR	false
213.90.218.180	unknown	France	8437	UTA-ASAT	false
116.74.225.10	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	false
160.122.115.26	unknown	South Africa	137951	CLAYERLIMITED-AS-APClayerLimitedHK	false
170.173.173.220	unknown	United States	46790	PHS-WAUS	false
178.130.158.118	unknown	Palestinian Territory Occupied	51407	MADA-ASPS	false
66.231.162.33	unknown	Puerto Rico	11992	CENTENNIAL-PR	false
245.160.116.243	unknown	Reserved	unknown	unknown	false
99.193.167.157	unknown	United States	855	CANET-ASN-4CA	false
77.218.102.164	unknown	Sweden	1257	TELE2EU	false
206.90.144.43	unknown	United States	3549	LVLT-3549US	false
9.226.99.116	unknown	United States	3356	LEVEL3US	false
107.55.192.12	unknown	United States	16567	NETRIX-16567US	false
122.61.143.112	unknown	New Zealand	4771	SPARKNZSparkNewZealandTradingLtdNZ	false
65.253.254.227	unknown	United States	701	UUNETUS	false
53.68.196.57	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
197.90.25.91	unknown	South Africa	10474	OPTINETZA	false
164.23.138.220	unknown	Germany	29355	KCELL-ASKZ	false
111.89.130.235	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
174.63.114.247	unknown	United States	7922	COMCAST-7922US	false
38.248.71.139	unknown	United States	174	COGENT-174US	false
151.217.115.58	unknown	unknown	11003	PANDGUS	false
17.254.136.252	unknown	United States	714	APPLE-ENGINEERINGUS	false
4.65.235.89	unknown	United States	3356	LEVEL3US	false
191.233.72.135	unknown	Brazil	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
221.139.139.255	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
94.211.242.40	unknown	Netherlands	33915	TNF-ASNL	false
253.107.206.31	unknown	Reserved	unknown	unknown	false
115.156.10.65	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
182.88.248.139	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
119.61.205.39	unknown	China	23724	CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation	false
88.28.86.25	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
166.54.30.31	unknown	United States	22423	ALTIMA-TELECOMCA	false
2.94.141.93	unknown	Russian Federation	8402	CORBINA-ASOJSCVimpelcomRU	false
23.51.50.57	unknown	United States	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
106.118.37.225	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
32.143.82.85	AieUWMVuRp	Get hash	malicious	Mirai Moobot	Browse
218.115.38.154	TF4VDeTwit	Get hash	malicious	Unknown	Browse
75.162.57.130	jKira.arm7	Get hash	malicious	Mirai	Browse
122.155.208.245	zyboZGRyFW	Get hash	malicious	Mirai	Browse
122.155.208.245	lvyr5dba4i	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	fnhMEUxYhq.elf	Get hash	malicious	Mirai	Browse	185.125.188.137
	lZeef6fL4G.elf	Get hash	malicious	Mirai	Browse	185.125.188.136
	lHb3Vvmlxg.elf	Get hash	malicious	Mirai	Browse	185.125.188.136
	Q5QuwXOwrT.elf	Get hash	malicious	Mirai	Browse	185.125.188.137
	sora.x86.elf	Get hash	malicious	Mirai	Browse	185.125.188.136
	Paralysis.x86_64.elf	Get hash	malicious	Mirai	Browse	185.125.188.137
	z2H8jaZbYg.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.188.136
	1xkJBhWlOY.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.188.137
	o726x137VU.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.188.137
	iHPBoIXXUj.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.188.137
	lOVWBcdPyr.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.188.136
	2iQmBFGOCt.elf	Get hash	malicious	Moobot	Browse	185.125.188.137
	LkCjOLO6hm.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.188.136
	MSObMZB4a6.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.188.136
	imCzF4AwDG.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.188.137
	1DQAkJ0DdR.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.188.137
	YUI3lBwC8a.elf	Get hash	malicious	Mirai	Browse	185.125.188.136
	fc3rg4bRFc.elf	Get hash	malicious	Unknown	Browse	185.125.188.137
	PVbOO02JiF.elf	Get hash	malicious	Mirai	Browse	185.125.188.137
	AVpGrgzqpb.elf	Get hash	malicious	Mirai	Browse	185.125.188.136

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATT-INTERNET4US	fnhMEUxYhq.elf	Get hash	malicious	Mirai	Browse	107.108.28.198
	lZeef6fL4G.elf	Get hash	malicious	Mirai	Browse	70.224.168.148
	https://goat.app.link/?$urlString=airgoat://home&$desktop_url=https%3A%2F%2Fnancysupo.com%2FNew%2FAuth%2F/ztehk0%2F%2F%2F%2Fservice.na@gelita.com	Get hash	malicious	HTMLPhisher	Browse	13.32.27.77
	37NzdJwc9p.exe	Get hash	malicious	RedLine	Browse	172.174.202.77
	X2YKyxfsoh.exe	Get hash	malicious	RedLine	Browse	172.174.202.77
	https://indd.adobe.com/view/f43faf03-1165-4134-ba9d-7811b6a94c0a	Get hash	malicious	Unknown	Browse	13.37.25.97
	https://logs.cluster013.hosting.ovh.net:443	Get hash	malicious	Phisher	Browse	13.37.50.218
	https://logs.cluster013.hosting.ovh.net:443	Get hash	malicious	Phisher	Browse	13.37.50.218
	6wa3Rdfaeh.elf	Get hash	malicious	Mirai, Moobot	Browse	45.28.72.116
	evqwx1t0Kz.elf	Get hash	malicious	Mirai, Moobot	Browse	12.198.36.119
	tqhuUjbyxe.elf	Get hash	malicious	Mirai, Moobot	Browse	99.169.158.32
	b2ERLHkrbl.elf	Get hash	malicious	Mirai, Moobot	Browse	13.167.21.208
	kObOAV0CHY.elf	Get hash	malicious	Mirai, Moobot	Browse	157.234.71.182
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	199.69.232.46
	https://dev-wo687912317.pantheonsite.io/wo68	Get hash	malicious	Unknown	Browse	13.32.27.44
	ommegaonline.org_1.one	Get hash	malicious	Emotet	Browse	76.227.68.115
	ommegaonline.org_2.one	Get hash	malicious	Emotet	Browse	76.227.68.115
	Ommega_Online_Publishers.one	Get hash	malicious	Emotet	Browse	76.227.68.115
	Ommega_Publishers.one	Get hash	malicious	Emotet	Browse	76.227.68.115
	imedpub.com.one	Get hash	malicious	Emotet	Browse	76.227.68.115
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	fnhMEUxYhq.elf	Get hash	malicious	Mirai	Browse	120.13.218.101
	lZeef6fL4G.elf	Get hash	malicious	Mirai	Browse	27.10.114.111
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	157.0.211.10
	J9Um3DtBY9.elf	Get hash	malicious	Mirai, Moobot	Browse	61.162.105.178
	z7khQUMqSd.elf	Get hash	malicious	Mirai, Moobot	Browse	157.11.48.8
	tqhuUjbyxe.elf	Get hash	malicious	Mirai, Moobot	Browse	157.8.19.8
	b2ERLHkrbl.elf	Get hash	malicious	Mirai, Moobot	Browse	157.2.250.241
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	157.2.250.229
	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse	157.0.158.226
	eHpTip2abR.elf	Get hash	malicious	Mirai, Moobot	Browse	157.8.58.143
	sKPG2Jah5i.elf	Get hash	malicious	Mirai	Browse	175.163.237.170
	oge7YKY5Nn.elf	Get hash	malicious	Mirai, Moobot	Browse	157.9.138.180
	uZyghEDOKK.elf	Get hash	malicious	Unknown	Browse	42.236.88.247
	Fzs8l8pUdW.elf	Get hash	malicious	Unknown	Browse	119.7.67.250
	3fqW7J4FaU.elf	Get hash	malicious	Mirai, Moobot	Browse	157.2.17.68
	DUI76KxwNZ.elf	Get hash	malicious	Mirai, Moobot	Browse	220.195.159.25
	So3Wubm3yB.elf	Get hash	malicious	Mirai, Moobot	Browse	157.9.162.49
	DWXhr3gIjb.elf	Get hash	malicious	Unknown	Browse	110.247.65.171
	HBB1Dchsmh.elf	Get hash	malicious	Unknown	Browse	222.160.183.172
	4AUfUn5o8C.elf	Get hash	malicious	Mirai	Browse	221.0.56.123

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6434/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:c:c
MD5:	D30A93591D51BE9E4C4242CAEEED87DF
SHA1:	9A33B9066BED311494257CFB026674C9B49156CF
SHA-256:	DEB16BAFB8C8693A8318190EDC66195779970482C6E797E9393AE8BE3583F4A7
SHA-512:	7230ABBA52D79EEBFE8714332B9F2BF9335CC2FFB1F815D6E082093928A160FAC0A4859776F56F2F93231E14E22229B017947D0BA5BEC72B0EB59748FFD9B8FC
Malicious:	false
Reputation:	low
Preview:	6410.

/run/systemd/journal/streams/.#9:74556YmyPHF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.527809218450001
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+P8a17y8c2rxsjs77:SbFuFyLVIg1BG+f+M+P8a1Zc2rqji4s
MD5:	03F9900F564EAEE31628022E59486778
SHA1:	82268FEB63861E7DD8D8E1E8D94931FD2E06F179
SHA-256:	724AB9E56C462F53FB7A867C7A19ED2AECA9E7DB039392F4206AD132ADAFBE55
SHA-512:	5503B6D9C8388E6D0EF7DF2E01B6513181416EBF3EA70FD65D5902F268EC51A1908E40966B88800FCF994EEF82F58289C64F8A40ECC71605653A4899604A23A0
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=452e6b9384fb4e179ddcbab0d062faba.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:74577BnAMBE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.425857652757733
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsA0bBn87ojshTjs16:SbFuFyLVIg1BG+f+Ms3buoj8josQu
MD5:	222EDCAEFF56F7D6D874E70C5963140E
SHA1:	3B5C9974CF0A5F5F5A16C10621F694E04A796249
SHA-256:	835FE755A7CCC514606DD587992270968984F7F0B9A1AB5C26904E0F4B49FBD5
SHA-512:	36E5D03D57F11495D42F720BD2E2DD3AFCFCE3192BFCABF55BBFE2CEA34BCD6FBC1C16DC44E65A86680D98D1F34A90778E3EA7BF14006F1912D36CD3A101C489
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fe7b281d9dc8494682da1948fde897b6.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:74584ELdXmD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3950444338241486
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8FaiQ6fFc1jdCLKzK:qgFq6g10+f+M8FaixfQCLAK
MD5:	E2EA2386DC264782A2B981F95F3E6CDE
SHA1:	BD3D3F7E9024541AC7F88A75A56656D0E2BEC2EC
SHA-256:	E1CAB233869C478BB93ADD33A5279F289DDF7B3DC420360F53612F6CFE678A3D
SHA-512:	BB843F77A87105258A68EEFFE0779919E24DACE00B7044003B791F6E1B16B9E3E552BE1521AD217A80F5ED304839036B2FAC999C0778FB82D0BD8FBB0B1A8AF0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6e23ba674d3047b495eb9d3af121d954.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:745919KbUiF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.430251232854837
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MkMLBHR4fC0jFmzXvn:qgFqo6g7/+0+f+MbLHExQXvn
MD5:	0348490B487B9F5A48839B329E60BA6D
SHA1:	50B5AAF56B6D40915EB7E3FC0E58C0A8F0ED5EAA
SHA-256:	EF648838F0466862F56F2C71790E9AD75E2E75633D60ED42AC14BED4CC29EE3B
SHA-512:	21D965AD6CB37A960F2DF42D8B2C2FD31E583112964C4B5E3CD0859B9F9BFDF1AE7C54C9E5D58549FB3E923E0AEF7DB67B60A1E02C48182558851D8BD4526920
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e737d39d35af48fb9b00ce85bc088818.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:74600vRIgAH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.418508655126853
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4nQwK1GhjFmzXvn:qgFqdg7/+0+f+M4QwKQQXvn
MD5:	D3F7DE2BD28F80E47D19F9C79486E893
SHA1:	A3C3408FFEFDA815DDC79BDD0CD0E13D22D117E7
SHA-256:	17A7C216B948E18C57888D9702AB138F129C5E0384BE5ADBC0CE45FD83326955
SHA-512:	A99A9BAB7628B5D88897A9B3CDF311D8D9B9D3E7222DC67B5637574B2B3378F22EDB32294B923E61BE18B90B29149D7E4E71224B460ED6ADBA18BD52ECC20585
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2626287ad56b436cb35476278e73dcaa.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:7460154XDgE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.38618673787254
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuEoRUjH9AyW6ATjsO:SbFuFyLVIg1BG+f+MudU7S6ATjtWL0
MD5:	C4AB7C3EB1738704CBF9D0C920C85890
SHA1:	F97A2EFB9351380D2BA859A30705773A664366C7
SHA-256:	BFF57A8974CCC2DCA8E27D82B3585A1563F456DB1A2E5329BAE8CC18ACBCAC44
SHA-512:	B31F1205EAAF413F1B49D0C4B2809456266551E4EA581E3EBA7F45C86E2A508C719A77ECD6EC575590ED8996B5FB9DF235185070F4CAB0164F9BE16029256850
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dec856b23990417c92a6466ba1e9fcd5.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:74602W5WUEH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.515365706432506
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp4EDnTFBtF2jsicWg:SbFuFyLVIg1BG+f+MqEDT+jZcHcljX+
MD5:	AB4DDAE98AF436CCA3AC0F594CE1EDCB
SHA1:	1530CFC7EE6EAD44E749DB8F150E5386CAE70FA6
SHA-256:	0FF08218AEC4CF146E7A3950E52C3544491ADC1A1F2C74A41B8CD9EC916D7534
SHA-512:	6E9849A60B3445440B647EF89C003474FC9448036B6849953CF2AB5236A3800B46A1B972AA8816B1C2C4CBCC67874F9CB429BADAA05D8932DF2C23861034831F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ca454fab61754152867f56356f3a8f59.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:74603O7Y6dE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.407375213455333
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8HRIQrgEDDBLr4Rx5:SbFuFyLVIg1BG+f+M8HzsEfh+qjNE
MD5:	A5C855DA179922FD2AAD0D5C6B259F5A
SHA1:	D40514BE0F79A03131E5F052A1042AAC5095A226
SHA-256:	8873EA95DEE20246F24F3CA2EA6F3396486045600E8C040178CA1B3C5D3B8D57
SHA-512:	572A00718624D25AA6A2D5441715FE27C639E94B59F64E24CBDFCBC76AA56AFF4CCB51403C5F4754F251D7168036953C9E97497251F2DDF3BD60CEB2B73D1E66
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6b4ca0455dfa4194affd9b1f6aa58d1c.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:746059N9h4E

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.416004762268388
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmys314svGRQvs22js1:SbFuFyLVIg1BG+f+Mys3GWGRQN2jbVC
MD5:	727BF656E6789E5D758F00282CD8E4CD
SHA1:	6BFAC932764A96641A08BF59CABF6EC819CC9472
SHA-256:	D57669BA1F056410B745FD1B96F364CD358A1201C824DC258E2A8184D57F8D29
SHA-512:	755604B08B56F90A6B4CABC19702C15109836C48F338771A900709851AA6CEEAB8AD05E52B322BC085B043FEFDBD107B491BBC2A32D6BF7FFC5110BA4D53F45F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=80cd5e42650b4b7e8587d5f1c4735645.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:74606WqD7IG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.425767316158589
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm94mjGHhGS1glz8jsV:SbFuFyLVIg1BG+f+MumSGF4jLkGq
MD5:	B127A1550E07E7337F74BC89756DDBDA
SHA1:	AD9FAE753E277CADBDC15F9FB8CC253725A9448F
SHA-256:	1D3A0F1BF8C3CA2B737D4197F48AADF06906F368D096BFAA6E4BAF98D79DEE9D
SHA-512:	C74E54392C22C713CFFD3D417687A30D2B8594C99677E70B6DC1EE87C0F7BD2CF0A72696CFEFD3AA48F7018FCBB72D8025371F11DFB806521CB37961C973EE75
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7786075d3bf9425cbeac788e3dbc273f.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:74607HMYCmG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.442258351865369
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M7UTNp8jdCt/rRMtq:qgFq6g10+f+M7sNwCDL
MD5:	272D18D3D922167A3C2059E74137F688
SHA1:	43A7C86AF6DA5E0C88343026B0159B2F5808940A
SHA-256:	252A3030692CC40770C9C0F57D331EEB12B39672337DDD821B90B903EB9E5D15
SHA-512:	29C2E0842C4B7F1FFDFD2035B3E3DEBD4F5A232FC1264605F9701A63BF8A76326CE6E256996906137BBAFA501D8CCA84287A1CFA2C4F5F084178AC1682B166A4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c8e4c241b3194fe29960129e1f9f7990.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:74608KWLeRE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.428781172107424
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M8DgQgkaRdBTjNALyAZD:qgFq6g1af+M8EQrEBFIZD
MD5:	47AFCB7D4380B549ABC76F5C37DF2597
SHA1:	B8D327CA07E7335198BE6BE3069499EA0754F1D2
SHA-256:	377901FD67C390928BEEC7F3698298A6ACFD02B839FA567546E25BE550C5BD74
SHA-512:	30B54217A0BADC78D9B46F94C1A24809B8731F63087A66EE48A69CC0DBF71E83EFD3A52C26E9A7540F7B5D7B928476F2579D0A02AE05A05A20000650F41FF20B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6ad6ff8dafbf45b5989a81790e55cc85.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:74609IA7VCG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.501006920630738
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvPeSqZERxWQq3h+s+:SbFuFyLVIg1BG+f+MO3Z4QQqpji4s
MD5:	6AF3D13B1C6FA13298BD61DEEA91F94E
SHA1:	DC9B3828FFEABA00B1E313AA38F1577B42A09F0B
SHA-256:	D892B706358756EAD1189788D37E42FDA6504CC6B021935440E7720AB6EC4696
SHA-512:	121DCDEF2DD27A01F26D7B69644B961C91E9AB316C940B2DB8EAB5221736BA9C210FF2B17F8CF91EF4947D73B75780413EB4F6416682D15C9FE50D1ED0A62C9F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e136770e1e8c4b4384bde0a16330e562.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:746286sguBH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.452963155292889
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MSPV+Ezf0ZjNdQIeXD:qgFq6g1af+MSodn2D
MD5:	8E1481ECFC5349BCCF1522E61BA04FC8
SHA1:	82B677AED83C9BC86AB6EAA6852993927BCB9FEE
SHA-256:	443202C4BD19DC22F795FA8B48E26EB4F28131D2A5D22169290BC9E249B6CD43
SHA-512:	0C2F92EA1AFE5AEB3CECC744831C70F7AAC9694592D242EDECB4FDD45E9CF27B440151B491B27E29C427C1161FADEA695D47576C881616D46904B43FE7D4DA29
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7faca127407e4522ab78d8ec47670245.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:763710RYPIF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.396437755713916
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpeDRSTEZvJjsZjswq:SbFuFyLVIg1BG+f+M60ShIjLTTIWTIL
MD5:	9FED5308B477E1455898066B4F1BF3C6
SHA1:	52D98474C37AD61378EBC71551271E100A63D166
SHA-256:	CD72A602C703BF1357DAA5853C444D8B98FC4E7B011678EB223A0911D6CFBD37
SHA-512:	20AE652D1692FE6B3515109F8689DA4D23B4D22EC613294D767319BE5DE6BE6EA15B299CF086C69C7FEA3165F12ECB70F6266CF2D08C48B570C11764A10036B0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cb01edaf688f4784a4a3678e71af7d46.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:76806bTS1nD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.361026080244326
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmy24mQHBnSbegRxsjs2R:SbFuFyLVIg1BAf+My24U8jNTZD
MD5:	32D5F0892A2AB0F9C958811AECF5A74D
SHA1:	7D1643266004B43324731936C69CBDBB1BFD1CFA
SHA-256:	BF22FEF8361E00050F1DD786590DDBD5FD7232378573324F0B6C23407590A335
SHA-512:	FB996D4819AC971BBA1A9FD91F1C6B0B9319EF17756D2FC355EA3E3069E2BE855ED96D82C25DDF245CCC32AAA163D97517D9711A3BF8E2954FDD1B9746FC72E0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8de7fddef0ce424cbd3c47ad105c7472.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76837OCw0oF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.413871190869466
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MvcnDNxOyRF0jNq:qgFqo6g7/+0+f+MvcnDvOdq
MD5:	C64972F1AD7FD5B8B69851991C622094
SHA1:	8555A3EDFA8214B4A6BC58A375B4E912BC1706E5
SHA-256:	6F5744B8AC074919063B6DA56038BB1040534FD6D43AAB4500B3E0D22F59A72D
SHA-512:	FB74579BB8F127DE5BC9F41E697E6B5273F32E02F0A459B81038E92A13872F1EBA9D0E129B3422B70A0C2E6B3DAC71AFE750862003CAA5B00CF10AF769913810
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5dc79bb3a26343008a19eb78da86979e.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:76838GzwrEH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.416288132012222
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6vaeVOsGDgK00wb:SbFuFyLVI6g7/+BG+f+M6vaeIDi0jNq
MD5:	570DBAA4250B4A9B0A0D7D189A1D4C9D
SHA1:	0EABEEDD241E1F0A9A0C2471FEDA019C0A4BCC36
SHA-256:	05C203422CEDB6344B6F27D895CD6BA24347C907C6556EA5793C5D419C6D7BB6
SHA-512:	E0883EB605E47D4960EF1DE0C5756D71B612FFE8BE1B97D4FAA7C19A42502411DA831849AC778BD0260C67B076418EE8A2DFA48298BFCFDF717622502D7AF8AB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0f79d8726670418b8d5c8db5072204a2.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:768523VCaUF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.491688356642398
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M8a40qhTjFQMzKaBu:qgFqo6g7/+0+f+M8a40qvTmh
MD5:	AE2AE0C16D4DE9C1ADCC22D55074D427
SHA1:	C814F85CEC5716C31F396A5BC968A1B6BC781171
SHA-256:	1C1BDD0994EEF12A9B1045D93B9F2BD0C1C2CDDA39FD59B7E34C68CBFCC0BF03
SHA-512:	986FF127FFF53E9DC131E554258A70DBF1DE5BFB4F8A6E7E082E7B940910CE85AD7949AA5595B9CA4A33796D70CCBA001772693D01C05977865792558F32D3FD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=68050015bd7e4181bf6d4ee41cfd561b.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:76853e4rZPE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.517925380472526
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+K08qjFQMzKaBu:qgFqdg7/+0+f+Mn0/Tmh
MD5:	651765E10D4D7A70B123A7DFFA29DEE3
SHA1:	65BF3AAB4FA41774AD076CBD780248933AD0E0B9
SHA-256:	E900C06B7AE9BEB24CFBB8FBEA18B5683BFAC968398B7AC6BE99445A47294DE0
SHA-512:	E13668732F722A47C095434FC54F0993C133C4F3CBBF42CD2A0331F8B4B84CF064B8378564E8DEA92DAA3F3E3AED1E4B5AFF646E8FB8F7870C41F8033234D8D0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=46ce91f7c6a34b26b00f86c39cd330d1.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77094JwJfGE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.3912656018538145
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsgTZuTnDwGT4Auxs9:SbFuFyLVIg1BG+f+Msg9u/bT4Rqjoa
MD5:	BDA391B9BA1AD9A17C74733219C7D6D1
SHA1:	A1A51C42EA4BBFB85F8778B2B7670E7FE9295DBF
SHA-256:	F76775B55863D2F93922B330D0AB7FC3A562575E8D69125C337A2DD1122544A7
SHA-512:	E1215B33A461E4AE767C4147A1EB4422C008E2F1A0BAFC0A58469DC7AD06FE206B9C006A0BE284AA6C483D4DBE490097F648FADFE9F17934DF1B00D41D79402B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f62a660bf72f4d9db014c88a49384b6c.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:77150DaY0OD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.385001532944222
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm72SZRtBiQMYuxsjsO:SbFuFyLVIg1BG+f+MDRtBDuqjtWL0
MD5:	64C181DA99D5168D2A878E9F643258E2
SHA1:	4C8A78D1E1470453BB64A786B0EFDE98549B0FF5
SHA-256:	2CA0E3DE19AE742DE4FD22022BF674C7C7F741E3712745645E1594B11602EC67
SHA-512:	E3D881AE3DFD9EE9E56BD0B7410474841B034CC129B651556F8B0A62FB983FDE0DDE40D767610521ABB1D5B91EE1D9728992917B7AE8DECF0BCA5822FA063785
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1729584762df4079b40bdd7cb4987913.IDENTIFIER=pulseaudio.

/run/systemd/seats/.#seat01Giq0W

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0PpNxTY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1276soSJX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.308681825115951
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJg3TETG39dQVg206qodFNvn:SbFuFyL3BVgdL87iesnAiRJg33Sgt679
MD5:	D0ECABB8DDAF17B757AA07937A03EA68
SHA1:	E50A6223F1DD8CCF0DCE7FF8EAA893139D00D2CC
SHA-256:	C761DAC7CB7538B69B63A581D7280A7349844B976E8AED581BCC843482C49310
SHA-512:	E82A4E16B31BF1008FA92B528D341646FCAE30617F315B0D427F0171A6B86E92E7C722B7112C4C726691593478FA99C58A06F7B2B11059DDE56D6272292A0045
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1679677621158412.MONOTONIC=470134018.LAST_SESSION_TIMESTAMP=470300911.

/run/systemd/users/.#1279kiq9U

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127UUf3pW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4618845673080205
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6HtQCg33Sgt67Nv:qgFq30dABibBygnSgIBv
MD5:	93F0F1FA502EDF5A45607BDA84D07306
SHA1:	A5F81FAF98AB15F4FD0C7BE55505BBDE849856A1
SHA-256:	C7835F9AD99EA8877035BF390F097ACE567CA9D2166D1798C7C2A17CC90C63B2
SHA-512:	66895BB75033E917421EC36C14E2008ACF62AF80B8DCFD96F3787FC19B195C98EC33501DF70152F78E7A96B8C07295021D81938A2107D3BE4F7F14891AF367D9
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12228.REALTIME=1679677621158412.MONOTONIC=470134018.LAST_SESSION_TIMESTAMP=470300911.

/run/systemd/users/.#127aDcq1X

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.280092809313611
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6SxJg33R02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB7gnFthQHtPYq9M
MD5:	A695F848F037D841A904C778AB628CD7
SHA1:	D357B1BFEFD17EC8D32B36E4B0B53A5E5AE28455
SHA-256:	C71CFA1267C70036FC99D7E15208506F6B9AA077D6AEC59400167B73CBEC413E
SHA-512:	5709824FB328451B806CFF0D40A8E2C96E047E93300FE5ECE4591EA4E9007BDAA13F7F48568D0203EEB3FE75A7CF9030739FF5EE05B941BFB394CAE3D1DF78D3
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12166.REALTIME=1679677621158412.MONOTONIC=470134018.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127sWDP2U

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.280092809313611
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6SxJg33R02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB7gnFthQHtPYq9M
MD5:	A695F848F037D841A904C778AB628CD7
SHA1:	D357B1BFEFD17EC8D32B36E4B0B53A5E5AE28455
SHA-256:	C71CFA1267C70036FC99D7E15208506F6B9AA077D6AEC59400167B73CBEC413E
SHA-512:	5709824FB328451B806CFF0D40A8E2C96E047E93300FE5ECE4591EA4E9007BDAA13F7F48568D0203EEB3FE75A7CF9030739FF5EE05B941BFB394CAE3D1DF78D3
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12166.REALTIME=1679677621158412.MONOTONIC=470134018.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:a:a
MD5:	908C9D2905A04EE33CC23DCD7132183B
SHA1:	C3E809AA8FBEC7B40798E1297F715DD8B96360E0
SHA-256:	3727353C768B39B45C69F017CDAA83AA2C3D20DFC8EE14F504F442158D43AC7E
SHA-512:	A263666D673A797CD7BF59A3E04FA8E2062FA5F53D7DED4AACAEDB0DDA1D6406A602828AF4DCD19E45440B94052EF60B01DCD210F39148E864848B0B8252A862
Malicious:	false
Preview:	6463.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:GCsXlXEWtl/ulFCyk//l:Gf+yly4P/l
MD5:	BE44EE6F405D3EE67FA53A03744AC76C
SHA1:	BEDFC6226CD1E38140E90E35CFB40237A9E1DFB3
SHA-256:	E4C5BD30556DF8D0AF0C472776E887C35C415D4887023B83CA8BEC84256329C6
SHA-512:	BADEDC9BCE73AECAC36444B6E0CA286A09AFFA010E6FDE906ADCA6950E7457B6F905A1671BA8B52B9CC852DA6FA1C8893DC4B3BE35737F11CB3931D116D38F7A
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................d.W......................................

/tmp/qemu-open.REcFDM (deleted)

Download File

Process:	/tmp/EatRCJ6tNe.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	310
Entropy (8bit):	3.561262647724653
Encrypted:	false
SSDEEP:	6:MkDDF3lwQCY/VUd/vYDF3lwc1jVqY/VJ/VfKoO/VNfiY/VH:MkfNlNCZdHQNlR1jVKl
MD5:	2C69109136114F3AC15BAAD5F3D1F440
SHA1:	A9CC88D5A5DA2F5B8EE8862550A108E98664D1C7
SHA-256:	3F4BEC42B9EB9A6A36A97D74B20C4A65DBF93A5B70FB2F5C29B2BBD9A421311D
SHA-512:	F0816C6E5531FCA7DA1D3AE61F7B5B15243889109E17C2F95F5C3F1F3C0A274FF47066D8DAE3B3C9654CAD8920864E7DDA054F3D7A172D5BF8E6ADA02A4A45F7
Malicious:	false
Preview:	10000-28000 r-xp 00000000 fd:00 531606 /tmp/EatRCJ6tNe.elf.38000-39000 rw-p 00018000 fd:00 531606 /tmp/EatRCJ6tNe.elf.39000-3d000 rw-p 00000000 00:00 0 .3d000-3e000 rw-p 00000000 00:00 0 .ff7fe000-ff7ff000 ---p 00000000 00:00 0 .ff7ff000-fffff000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.CU2111

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	4.90970127788505
Encrypted:	false
SSDEEP:	24:ptRc/xnmtFd2/xztFdlJZ4ZJZeq3uLoLXL/BikX5uAvv5uA2+VVpJ0pYrnJrerC3:wxnqYx52PvxPfVsYrJrerCFf/qrCn
MD5:	6608D2234DB6525CE54E9412678D223A
SHA1:	4C9729E089A501E04F4634D51211ACC74ED1E6D6
SHA-256:	4F0EAFC20C56DFE98EE3BD14E5A3908701C3C8B8EE06F50ADD74EA75A689E5BF
SHA-512:	EF4DA4F64E11E4B994A823A26644D29D501CBDA8662B98E05A19AD12F241A0AD0CDB31B233F4C64D05B21396057FA7FE171C3DCBB2470B32EBC35A3C0250DDAE
Malicious:	false
Preview:	Mar 24 17:06:44 galassia systemd-logind[797]: Failed to abandon session scope, ignoring: Transport endpoint is not connected.Mar 24 17:06:44 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Mar 24 17:06:44 galassia systemd-logind[797]: Session 2 logged out. Waiting for processes to exit..Mar 24 17:06:46 galassia systemd-logind[797]: Failed to abandon session scope, ignoring: Transport endpoint is not connected.Mar 24 17:06:46 galassia systemd-logind[797]: Session c2 logged out. Waiting for processes to exit..Mar 24 17:06:46 galassia systemd-logind[6305]: Failed to add user by file name 127, ignoring: Invalid argument.Mar 24 17:06:46 galassia systemd-logind[6305]: Failed to add user by file name 1000, ignoring: Invalid argument.Mar 24 17:06:46 galassia systemd-logind[6305]: User enumeration failed: Invalid argument.Mar 24 17:06:46 galassia systemd-logind[6305]: User of session c2 not known..Mar 24 17:06:46 galassia systemd-logind[63

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.3807197082782185
Encrypted:	false
SSDEEP:	3:F31Hl8q5+G/lOq5+G/P//:F3zJ/lZJ/P
MD5:	FD0322941BD23C199FD7440E6EB73093
SHA1:	B3863A54F54FCAB2F307C18927EE6CF12ABDD9CA
SHA-256:	A0BB3482257AEDBA0E805009A5B164A75E42D19A11207E8C580D44744330A305
SHA-512:	45BE5AA291723D5D13561705D51ED4D61572BE54F14DC8D97F011CE3F990E3EDF93A50321E1A0BA650C992D4D42A47AAB1D130AE77FDB8A04E70338698AB40BB
Malicious:	false
Preview:	LPKSHHRH................_n.5.KN..$.%.B................................._n.5.KN..$.%.B.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838254
Encrypted:	false
SSDEEP:	3:F31HlQotn48l/Sotn4kt:F3gwn48tSwn4k
MD5:	3724BC41B5EBEBF1FA9A5AAD1773F046
SHA1:	2552D316A7619905AD4CBBD895A365656683B378
SHA-256:	4AE40E44D1AD989C0D160B2E72CEE0607302ACF8ACDB10C57A73D0125B8D0167
SHA-512:	3F9356029FC3BA47590DFA38A827F50A602EC420304CD214A68B42A34AB972C420ABDF62734F3AC42FE6E8E984847E7321984B21AA6AB0A60617F5EA1C1A97D3
Malicious:	false
Preview:	LPKSHHRH.................do...@..>.o....................................do...@..>.o...........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	8686
Entropy (8bit):	4.744908268956207
Encrypted:	false
SSDEEP:	48:RgwucPV5v2ha7qIY6SdbrcCQTxvqVrJggp71QLgIHIzywx4IXsFSTzSRHK9gM9Qq:Ugtqb94oABbHRHx6nbPVJ8T83U5cdJ3J
MD5:	2D7093EB80457CB5BFE5C9CF7AB163A5
SHA1:	772ED713CF1FEE22A5E8D0BBB7D2BA03DA1AF2D9
SHA-256:	B1BD1FDB442663DD4802E3CBF4BFF7D841234B518F2E754170C232F3ED22801F
SHA-512:	85D12B0CFD117A95425C1403102701B98C9CCFD315CC3E6CE595F0DDB30BF458B3EE402A6A5DF19F8ADCEE69F1912C09FA3256265DCD4F268DE48C5B57D52C2A
Malicious:	false
Preview:	Mar 24 17:06:24 galassia kernel: [ 432.339430] blocking signal 9: 6237 -> 797.Mar 24 17:06:24 galassia kernel: [ 432.717439] blocking signal 9: 6237 -> 936.Mar 24 17:06:24 galassia kernel: [ 432.776388] blocking signal 9: 6237 -> 1320.Mar 24 17:06:24 galassia kernel: [ 432.811464] blocking signal 9: 6237 -> 1334.Mar 24 17:06:24 galassia kernel: [ 432.836278] blocking signal 9: 6237 -> 1335.Mar 24 17:06:24 galassia kernel: [ 433.090735] New task spawned: old: (tgid 6290, tid 6290), new (tgid: 6290, tid: 6294).Mar 24 17:06:24 galassia kernel: [ 433.092065] New task spawned: old: (tgid 6290, tid 6290), new (tgid: 6290, tid: 6295).Mar 24 17:06:24 galassia kernel: [ 433.104922] New task spawned: old: (tgid 6290, tid 6295), new (tgid: 6290, tid: 6296).Mar 24 17:06:24 galassia kernel: [ 433.295028] blocking signal 9: 6237 -> 1601.Mar 24 17:06:24 galassia kernel: [ 433.403333] blocking signal 9: 6237 -> 1860.Mar 24 17:06:25 galassia kernel: [ 433.547539] blocking signal 9: 6237 -> 1

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	44457
Entropy (8bit):	5.0725078266254275
Encrypted:	false
SSDEEP:	768:6SkBeisoeisoeisoeiszOL3Z/B8/UHucgT/6UqYkm0HxF6cSnbP/1Vpr5oM+nlBj:cCWHxF6cSnbP/6
MD5:	B9D1C2248E3B1610B118B382486D34C1
SHA1:	70995EED6143602B4A04A07B3B80008AB0136E91
SHA-256:	97A988FD5FFF77D1A6A0C8EDFA23EA729DDA6A9925FDAB703424F1853F8749E7
SHA-512:	909F8F377B0281E10988F270FADBA64F57CBCB49A765447FE528E782145017AF82FF560603C67B036791474A328F5E318C2B548AE7ED104436CB1BE3EE3A49BC
Malicious:	false
Preview:	Mar 24 17:06:24 galassia kernel: [ 431.974467] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Mar 24 17:06:24 galassia kernel: [ 431.974636] systemd[1]: rsyslog.service: Failed with result 'signal'..Mar 24 17:06:24 galassia kernel: [ 432.157850] systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Mar 24 17:06:24 galassia kernel: [ 432.157910] systemd[1]: Stopped System Logging Service..Mar 24 17:06:24 galassia kernel: [ 432.161232] systemd[1]: Starting System Logging Service....Mar 24 17:06:24 galassia kernel: [ 432.339430] blocking signal 9: 6237 -> 797.Mar 24 17:06:24 galassia kernel: [ 432.717439] blocking signal 9: 6237 -> 936.Mar 24 17:06:24 galassia kernel: [ 432.776388] blocking signal 9: 6237 -> 1320.Mar 24 17:06:24 galassia kernel: [ 432.811464] blocking signal 9: 6237 -> 1334.Mar 24 17:06:24 galassia kernel: [ 432.836278] blocking signal 9: 6237 -> 1335.Mar 24 17:06:24 galassia kernel: [ 433.090735] New task sp

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:GCsXlXEWtl/ulFCyk//l:Gf+yly4P/l
MD5:	BE44EE6F405D3EE67FA53A03744AC76C
SHA1:	BEDFC6226CD1E38140E90E35CFB40237A9E1DFB3
SHA-256:	E4C5BD30556DF8D0AF0C472776E887C35C415D4887023B83CA8BEC84256329C6
SHA-512:	BADEDC9BCE73AECAC36444B6E0CA286A09AFFA010E6FDE906ADCA6950E7457B6F905A1671BA8B52B9CC852DA6FA1C8893DC4B3BE35737F11CB3931D116D38F7A
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................d.W......................................

Source: EatRCJ6tNe.elf	ReversingLabs: Detection: 67%
Source: EatRCJ6tNe.elf	Virustotal: Detection: 60%			Perma Link

Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	Socket: 0.0.0.0::37215	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	Socket: 0.0.0.0::23	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6231)	Socket: 0.0.0.0::0	Jump to behavior
Source: /tmp/EatRCJ6tNe.elf (PID: 6237)	Socket: 0.0.0.0::0	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6288)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6410)	Socket: <unknown socket type>:unknown	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6431)	Socket: <unknown socket type>:unknown	Jump to behavior

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.157019754977301
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	EatRCJ6tNe.elf
File size:	99648
MD5:	e521f0731bd62f953898e9a5614d01eb
SHA1:	2decbd11e6ba175313c3df84b238b2f1afc0d40b
SHA256:	dcaa798d2ebaa6d35cfd0ada1fa67271f87975ed1b85fb7ac3239b4d96c8c72c
SHA512:	c83a0232649b05104a674a4fb54c9f3f12d8a547a35af6e87f6dd1217b427ff723570a0541c66aea68d122da86fdfa95c36966c0c9c5f83e4f2d0bc23bdd3875
SSDEEP:	1536:VLmFmdSzM30cEwEO2qbQfSqnqcbAv47SHantLk9iEr:tHSeQ9Spv4WHantQ9iEr
TLSH:	46A34C14BC791E12C0E4A17E12FBCA56B1F5328E21A4D59E3D720F8FFF516C0AA06A75
File Content Preview:	.ELF...........................4.........4. ...(......................}@..}@...........................p..&.........dt.Q................................@..(....@.U.................#.....cp..`.....!..... ...@.....".........`......$ ... ...@...........`....

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0x157f0	0x0	0x6	AX	4
.fini	PROGBITS	0x258a0	0x158a0	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x258b8	0x158b8	0x2488	0x0	0x2	A	8
.ctors	PROGBITS	0x38000	0x18000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x38008	0x18008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x38018	0x18018	0x358	0x0	0x3	WA	8
.bss	NOBITS	0x38370	0x18370	0x2290	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x18370	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x17d40	0x17d40	6.2066	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x18000	0x38000	0x38000	0x370	0x2600	2.6361	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 24, 2023 17:06:29.349634886 CET	192.168.2.23	1.1.1.1	0xdad4	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Mar 24, 2023 17:06:29.349745035 CET	192.168.2.23	1.1.1.1	0xb5b7	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Mar 24, 2023 17:06:30.648340940 CET	192.168.2.23	1.1.1.1	0xba26	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 24, 2023 17:06:29.367841959 CET	1.1.1.1	192.168.2.23	0xdad4	No error (0)	daisy.ubuntu.com		185.125.188.137	A (IP address)	IN (0x0001)	false
Mar 24, 2023 17:06:29.367841959 CET	1.1.1.1	192.168.2.23	0xdad4	No error (0)	daisy.ubuntu.com		185.125.188.136	A (IP address)	IN (0x0001)	false

Timestamp	kBytes transferred	Direction	Data
2023-03-24 16:06:38 UTC	0	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2023-03-24 16:06:38 UTC	0	IN	HTTP/1.1 100 Continue
2023-03-24 16:06:38 UTC	0	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2023-03-24 16:06:38 UTC	16	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2023-03-24 16:06:38 UTC	32	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2023-03-24 16:06:38 UTC	48	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2023-03-24 16:06:38 UTC	64	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2023-03-24 16:06:38 UTC	80	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2023-03-24 16:06:38 UTC	96	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2023-03-24 16:06:38 UTC	112	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2023-03-24 16:06:38 UTC	128	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2023-03-24 16:06:38 UTC	144	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2023-03-24 16:06:38 UTC	160	OUT	Data Raw: 66 72 6f 6d 20 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 6f 62 6a 65 63 74 2d 32 2e 30 2e 73 6f 2e 30 0a 67 5f 6f 62 6a 65 63 74 5f 6e 65 77 5f 77 69 74 68 5f 70 72 6f 70 65 72 74 69 65 73 20 28 29 20 66 72 6f 6d 20 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 6f 62 6a 65 63 74 2d 32 2e 30 2e 73 6f 2e 30 0a 67 5f 6f 62 6a 65 63 74 5f 6e 65 77 20 28 29 20 66 72 6f 6d 20 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 6f 62 6a 65 63 74 2d 32 2e 30 2e 73 6f 2e 30 00 02 50 72 6f 63 43 6d 64 6c 69 6e 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 53 74 61 63 6b 74 72 61 63 65 41 64 64 72 65 73 73 53 69 67 6e 61 74 75 72 65 00 1b 03 00 00 2f 75 73 72 Data Ascii: from /lib/x86_64-linux-gnu/libgobject-2.0.so.0g_object_new_with_properties () from /lib/x86_64-linux-gnu/libgobject-2.0.so.0g_object_new () from /lib/x86_64-linux-gnu/libgobject-2.0.so.0ProcCmdlinelight-lockerStacktraceAddressSignature/usr
2023-03-24 16:06:38 UTC	161	IN	HTTP/1.1 400 Bad Request Date: Fri, 24 Mar 2023 16:06:38 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 958 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time:	17:06:08
Start date:	24/03/2023
Path:	/tmp/EatRCJ6tNe.elf
Arguments:	/tmp/EatRCJ6tNe.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time:	17:06:21
Start date:	24/03/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	17:06:22
Start date:	24/03/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	17:06:23
Start date:	24/03/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	17:06:25
Start date:	24/03/2023
Path:	/usr/libexec/gvfsd-fuse
Arguments:	n/a
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time:	17:06:27
Start date:	24/03/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	17:06:28
Start date:	24/03/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	17:06:29
Start date:	24/03/2023
Path:	/usr/bin/gpu-manager
Arguments:	n/a
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time:	17:06:30
Start date:	24/03/2023
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	17:06:31
Start date:	24/03/2023
Path:	/usr/bin/gpu-manager
Arguments:	n/a
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time:	17:06:32
Start date:	24/03/2023
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report EatRCJ6tNe.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6434/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:74556YmyPHF

/run/systemd/journal/streams/.#9:74577BnAMBE

/run/systemd/journal/streams/.#9:74584ELdXmD

/run/systemd/journal/streams/.#9:745919KbUiF

/run/systemd/journal/streams/.#9:74600vRIgAH

/run/systemd/journal/streams/.#9:7460154XDgE

/run/systemd/journal/streams/.#9:74602W5WUEH

/run/systemd/journal/streams/.#9:74603O7Y6dE

/run/systemd/journal/streams/.#9:746059N9h4E

/run/systemd/journal/streams/.#9:74606WqD7IG

/run/systemd/journal/streams/.#9:74607HMYCmG

/run/systemd/journal/streams/.#9:74608KWLeRE

/run/systemd/journal/streams/.#9:74609IA7VCG

/run/systemd/journal/streams/.#9:746286sguBH

/run/systemd/journal/streams/.#9:763710RYPIF

/run/systemd/journal/streams/.#9:76806bTS1nD

/run/systemd/journal/streams/.#9:76837OCw0oF

/run/systemd/journal/streams/.#9:76838GzwrEH

/run/systemd/journal/streams/.#9:768523VCaUF

/run/systemd/journal/streams/.#9:76853e4rZPE

/run/systemd/journal/streams/.#9:77094JwJfGE

Linux Analysis Report
EatRCJ6tNe.elf

Start time:	17:06:33
Start date:	24/03/2023
Path:	/usr/bin/gpu-manager
Arguments:	n/a
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time:	17:06:34
Start date:	24/03/2023
Path:	/usr/bin/gpu-manager
Arguments:	n/a
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time:	17:06:35
Start date:	24/03/2023
Path:	/usr/bin/gpu-manager
Arguments:	n/a
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time:	17:06:39
Start date:	24/03/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	17:06:40
Start date:	24/03/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	17:06:45
Start date:	24/03/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	17:06:56
Start date:	24/03/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	17:06:58
Start date:	24/03/2023
Path:	/usr/sbin/gdm3
Arguments:	n/a
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time:	17:07:01
Start date:	24/03/2023
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	n/a
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time:	17:07:02
Start date:	24/03/2023
Path:	/usr/bin/dbus-daemon
Arguments:	dbus-daemon --print-address 3 --session
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c