Edit tour

Linux Analysis Report
yvweY4vsVq.elf

Overview

General Information

Sample Name:	yvweY4vsVq.elf
Original Sample Name:	7592df37fb3fea64a0994ac342f319f4.elf
Analysis ID:	877738
MD5:	7592df37fb3fea64a0994ac342f319f4
SHA1:	bd612669bbc816883907689411667f34b471259f
SHA256:	4e97dfb181ef3db9a59094b5f468255ee7dc5d5e52543730d8394270a434b162
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Uses known network protocols on non-standard ports

Sample tries to kill multiple processes (SIGKILL)

Sample contains only a LOAD segment without any section mappings

Deletes log files

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "systemctl" command used for controlling the systemd system and service manager

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

ELF contains segments with high entropy indicating compressed/encrypted content

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	877738
Start date and time:	2023-05-30 00:52:36 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	yvweY4vsVq.elf
Original Sample Name:	7592df37fb3fea64a0994ac342f319f4.elf
Detection:	MAL
Classification:	mal68.spre.troj.evad.linELF@0/49@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100

Runtime Messages

Command:	/tmp/yvweY4vsVq.elf
PID:	6291
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

systemd New Fork (PID: 6198, Parent: 1)

logrotate (PID: 6198, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf

logrotate New Fork (PID: 6240, Parent: 6198)

gzip (PID: 6240, Parent: 6198, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6241, Parent: 6198)

sh (PID: 6241, Parent: 6198, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "

sh New Fork (PID: 6242, Parent: 6241)

invoke-rc.d (PID: 6242, Parent: 6241, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart

invoke-rc.d New Fork (PID: 6243, Parent: 6242)

runlevel (PID: 6243, Parent: 6242, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel

invoke-rc.d New Fork (PID: 6245, Parent: 6242)

systemctl (PID: 6245, Parent: 6242, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service

invoke-rc.d New Fork (PID: 6249, Parent: 6242)

ls (PID: 6249, Parent: 6242, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups

invoke-rc.d New Fork (PID: 6250, Parent: 6242)

systemctl (PID: 6250, Parent: 6242, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service

logrotate New Fork (PID: 6251, Parent: 6198)

gzip (PID: 6251, Parent: 6198, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6252, Parent: 6198)

sh (PID: 6252, Parent: 6198, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

sh New Fork (PID: 6253, Parent: 6252)

rsyslog-rotate (PID: 6253, Parent: 6252, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate

rsyslog-rotate New Fork (PID: 6254, Parent: 6253)

systemctl (PID: 6254, Parent: 6253, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service

systemd New Fork (PID: 6199, Parent: 1)

install (PID: 6199, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man

systemd New Fork (PID: 6205, Parent: 1)

find (PID: 6205, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete

systemd New Fork (PID: 6207, Parent: 1)

mandb (PID: 6207, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet

yvweY4vsVq.elf (PID: 6291, Parent: 6127, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/yvweY4vsVq.elf

yvweY4vsVq.elf New Fork (PID: 6293, Parent: 6291)

yvweY4vsVq.elf New Fork (PID: 6295, Parent: 6291)

yvweY4vsVq.elf New Fork (PID: 6297, Parent: 6291)

yvweY4vsVq.elf New Fork (PID: 6299, Parent: 6297)

yvweY4vsVq.elf New Fork (PID: 6301, Parent: 6297)

yvweY4vsVq.elf New Fork (PID: 6303, Parent: 6297)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: yvweY4vsVq.elf	ReversingLabs: Detection: 54%
Source: yvweY4vsVq.elf	Virustotal: Detection: 50%			Perma Link

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40678
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40682
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40692
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40698
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40706
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40710
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40716
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40720
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40724
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40726
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40730
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40732
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40738
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40740
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40742
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40744
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40746
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40748
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40752
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40754
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40756
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40758
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40760
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40762
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40764
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40768
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40770
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40772
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40774
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40778

Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: global traffic

TCP traffic: 192.168.2.23:48592 -> 107.189.3.153:1312

Source: /tmp/yvweY4vsVq.elf (PID: 6293)	Socket: 0.0.0.0::0
Source: /tmp/yvweY4vsVq.elf (PID: 6293)	Socket: 0.0.0.0::53413
Source: /tmp/yvweY4vsVq.elf (PID: 6293)	Socket: 0.0.0.0::80
Source: /tmp/yvweY4vsVq.elf (PID: 6293)	Socket: 0.0.0.0::37215
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	Socket: 0.0.0.0::0
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	Socket: 0.0.0.0::53413
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	Socket: 0.0.0.0::80
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	Socket: 0.0.0.0::37215

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 107.189.3.153
Source: unknown	TCP traffic detected without corresponding DNS query: 76.0.183.154
Source: unknown	TCP traffic detected without corresponding DNS query: 218.45.121.154
Source: unknown	TCP traffic detected without corresponding DNS query: 126.137.100.236
Source: unknown	TCP traffic detected without corresponding DNS query: 183.86.244.155
Source: unknown	TCP traffic detected without corresponding DNS query: 120.95.49.115
Source: unknown	TCP traffic detected without corresponding DNS query: 201.206.91.129
Source: unknown	TCP traffic detected without corresponding DNS query: 136.240.152.7
Source: unknown	TCP traffic detected without corresponding DNS query: 79.160.239.125
Source: unknown	TCP traffic detected without corresponding DNS query: 246.183.54.88
Source: unknown	TCP traffic detected without corresponding DNS query: 23.36.125.81
Source: unknown	TCP traffic detected without corresponding DNS query: 93.6.77.59
Source: unknown	TCP traffic detected without corresponding DNS query: 75.192.32.102
Source: unknown	TCP traffic detected without corresponding DNS query: 87.220.234.113
Source: unknown	TCP traffic detected without corresponding DNS query: 174.229.190.231
Source: unknown	TCP traffic detected without corresponding DNS query: 153.190.168.241
Source: unknown	TCP traffic detected without corresponding DNS query: 216.202.192.22
Source: unknown	TCP traffic detected without corresponding DNS query: 23.233.187.152
Source: unknown	TCP traffic detected without corresponding DNS query: 97.77.143.147
Source: unknown	TCP traffic detected without corresponding DNS query: 155.226.78.146
Source: unknown	TCP traffic detected without corresponding DNS query: 90.225.231.43
Source: unknown	TCP traffic detected without corresponding DNS query: 104.13.239.230
Source: unknown	TCP traffic detected without corresponding DNS query: 167.152.63.108
Source: unknown	TCP traffic detected without corresponding DNS query: 247.136.170.47
Source: unknown	TCP traffic detected without corresponding DNS query: 166.11.184.189
Source: unknown	TCP traffic detected without corresponding DNS query: 149.168.18.245
Source: unknown	TCP traffic detected without corresponding DNS query: 93.214.165.127
Source: unknown	TCP traffic detected without corresponding DNS query: 151.171.214.178
Source: unknown	TCP traffic detected without corresponding DNS query: 16.229.95.68
Source: unknown	TCP traffic detected without corresponding DNS query: 252.75.153.96
Source: unknown	TCP traffic detected without corresponding DNS query: 18.99.237.72
Source: unknown	TCP traffic detected without corresponding DNS query: 67.42.182.45
Source: unknown	TCP traffic detected without corresponding DNS query: 190.36.146.59
Source: unknown	TCP traffic detected without corresponding DNS query: 195.175.152.36
Source: unknown	TCP traffic detected without corresponding DNS query: 211.116.191.67
Source: unknown	TCP traffic detected without corresponding DNS query: 35.27.252.236
Source: unknown	TCP traffic detected without corresponding DNS query: 192.228.72.55
Source: unknown	TCP traffic detected without corresponding DNS query: 125.152.129.219
Source: unknown	TCP traffic detected without corresponding DNS query: 85.64.190.7
Source: unknown	TCP traffic detected without corresponding DNS query: 83.240.163.128
Source: unknown	TCP traffic detected without corresponding DNS query: 47.77.83.183
Source: unknown	TCP traffic detected without corresponding DNS query: 216.105.159.246
Source: unknown	TCP traffic detected without corresponding DNS query: 139.7.13.2
Source: unknown	TCP traffic detected without corresponding DNS query: 108.125.130.242
Source: unknown	TCP traffic detected without corresponding DNS query: 120.26.142.118
Source: unknown	TCP traffic detected without corresponding DNS query: 96.106.78.8
Source: unknown	TCP traffic detected without corresponding DNS query: 207.53.121.27
Source: unknown	TCP traffic detected without corresponding DNS query: 167.147.171.44
Source: unknown	TCP traffic detected without corresponding DNS query: 149.95.216.142

Source: yvweY4vsVq.elf

String found in binary or memory: http://upx.sf.net

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/yvweY4vsVq.elf (PID: 6293)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 6293, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 720, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 759, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 788, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 800, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 847, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 884, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 1334, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 1335, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 1860, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 1872, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 2096, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 2097, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 2102, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 2180, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 2208, result: successful

Source: LOAD without section mappings

Program segment: 0x8000

Source: /tmp/yvweY4vsVq.elf (PID: 6293)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 6293, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 720, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 759, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 788, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 800, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 847, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 884, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 1334, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 1335, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 1860, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 1872, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 2096, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 2097, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 2102, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 2180, result: successful
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	SIGKILL sent: pid: 2208, result: successful

Source: classification engine

Classification label: mal68.spre.troj.evad.linELF@0/49@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2033/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2033/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1582/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1582/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2275/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/6191/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/6192/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1612/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1612/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1579/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1579/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1699/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1699/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1335/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1335/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1698/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1698/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2028/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2028/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1334/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1334/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1576/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1576/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2302/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/3236/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2025/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2025/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2146/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2146/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/910/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/912/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/912/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/912/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/759/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/759/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/759/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/517/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2307/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/918/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/918/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/918/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1594/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1594/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2285/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2281/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1349/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1349/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1623/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1623/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/761/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/761/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/761/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1622/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1622/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/884/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/884/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/884/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1983/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1983/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2038/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2038/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1586/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1586/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1465/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1465/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1344/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1344/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1860/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1860/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1463/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1463/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2156/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2156/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/800/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/800/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/800/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/801/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/801/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/801/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1629/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1629/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1627/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1627/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1900/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1900/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/491/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/491/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/491/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2294/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2050/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/2050/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1877/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1877/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/772/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/772/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/772/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1633/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1633/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1599/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1599/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1632/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1632/exe
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1477/fd
Source: /tmp/yvweY4vsVq.elf (PID: 6299)	File opened: /proc/1477/exe

Source: /usr/sbin/logrotate (PID: 6241)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
Source: /usr/sbin/logrotate (PID: 6252)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

Source: /usr/sbin/invoke-rc.d (PID: 6245)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service
Source: /usr/sbin/invoke-rc.d (PID: 6250)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 6254)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40678
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40682
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40692
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40698
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40706
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40710
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40716
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40720
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40724
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40726
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40730
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40732
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40738
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40740
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40742
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40744
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40746
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40748
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40752
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40754
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40756
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40758
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40760
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40762
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40764
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40768
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40770
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40772
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40774
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40778

Source: yvweY4vsVq.elf

Submission file: segment LOAD with 7.9335 entropy (max. 8.0)

Source: /usr/sbin/logrotate (PID: 6198)	Truncated file: /var/log/cups/access_log.1			Jump to behavior
Source: /usr/sbin/logrotate (PID: 6198)	Truncated file: /var/log/syslog.1			Jump to behavior

Source: /tmp/yvweY4vsVq.elf (PID: 6291)

Queries kernel information via 'uname':

Source: yvweY4vsVq.elf, 6291.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp, yvweY4vsVq.elf, 6293.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp, yvweY4vsVq.elf, 6295.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp, yvweY4vsVq.elf, 6301.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp	Binary or memory string: Dx86_64/usr/bin/qemu-arm/tmp/yvweY4vsVq.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yvweY4vsVq.elf
Source: yvweY4vsVq.elf, 6291.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp, yvweY4vsVq.elf, 6293.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp, yvweY4vsVq.elf, 6295.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp, yvweY4vsVq.elf, 6301.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: yvweY4vsVq.elf, 6291.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp, yvweY4vsVq.elf, 6293.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp, yvweY4vsVq.elf, 6295.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp, yvweY4vsVq.elf, 6301.1.000055d7e0edc000.000055d7e10ea000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: yvweY4vsVq.elf, 6291.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp, yvweY4vsVq.elf, 6293.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp, yvweY4vsVq.elf, 6295.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp, yvweY4vsVq.elf, 6301.1.00007fffb98e5000.00007fffb9906000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	1 Systemd Service	1 Systemd Service	1 Scripting	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Service Stop
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Indicator Removal on Host	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yvweY4vsVq.elf	54%	ReversingLabs	Linux.Trojan.Mirai
yvweY4vsVq.elf	51%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	yvweY4vsVq.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.72.178.153	unknown	United Arab Emirates	15802	DU-AS1AE	false
19.194.56.75	unknown	United States	3	MIT-GATEWAYSUS	false
176.81.232.119	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
75.131.165.178	unknown	United States	20115	CHARTER-20115US	false
66.44.1.18	unknown	United States	6079	RCN-ASUS	false
216.151.48.52	unknown	United States	31869	LL-BEANUS	false
119.70.232.53	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
186.223.112.108	unknown	Brazil	28573	CLAROSABR	false
1.119.108.59	unknown	China	23724	CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation	false
245.31.144.9	unknown	Reserved	unknown	unknown	false
144.24.166.220	unknown	Greece	58541	CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN	false
118.17.139.140	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
71.82.115.201	unknown	United States	20115	CHARTER-20115US	false
152.38.145.32	unknown	United States	81	NCRENUS	false
161.212.230.79	unknown	Venezuela	6306	TELEFONICAVENEZOLANACAVE	false
146.74.158.132	unknown	United States	30051	SCCGOVUS	false
94.40.89.117	unknown	Poland	20960	TKTELEKOM-ASPL	false
95.23.180.230	unknown	Spain	12479	UNI2-ASES	false
195.249.12.67	unknown	Denmark	3292	TDCTDCASDK	false
198.207.62.225	unknown	United States	17007	OATK-AS1US	false
196.167.93.110	unknown	South Africa	328065	Vast-Networks-ASZA	false
120.64.203.192	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
241.71.207.167	unknown	Reserved	unknown	unknown	false
136.25.206.10	unknown	United States	19165	WEBPASSUS	false
204.214.223.26	unknown	United States	1239	SPRINTLINKUS	false
161.165.43.90	unknown	United States	10695	WAL-MARTUS	false
74.199.29.180	unknown	United States	12083	WOW-INTERNETUS	false
195.205.241.144	unknown	Poland	5617	TPNETPL	false
38.229.203.53	unknown	United States	23028	TEAM-CYMRUUS	false
23.121.55.94	unknown	United States	7018	ATT-INTERNET4US	false
27.231.45.76	unknown	Japan	9605	DOCOMONTTDOCOMOINCJP	false
205.198.24.195	unknown	United States	133847	ICT-AS-APAnppleTechEnterpriseMY	false
171.190.191.247	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
117.79.59.230	unknown	China	55990	HWCSNETHuaweiCloudServicedatacenterCN	false
48.162.218.62	unknown	United States	2686	ATGS-MMD-ASUS	false
191.45.88.178	unknown	Brazil	7738	TelemarNorteLesteSABR	false
116.62.52.238	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
181.55.62.16	unknown	Colombia	10620	TelmexColombiaSACO	false
60.204.107.202	unknown	China	9595	XEPHIONNTT-MECorporationJP	false
105.217.216.229	unknown	South Africa	16637	MTNNS-ASZA	false
78.216.161.1	unknown	France	12322	PROXADFR	false
94.104.57.239	unknown	Belgium	47377	ORANGE_BELGIUM_SAKPNBelgiumBusinessNVhasbeenacquired	false
251.32.191.44	unknown	Reserved	unknown	unknown	false
155.14.152.106	unknown	United States	40155	APLLIUS	false
113.230.156.33	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
169.203.96.4	unknown	United States	22920	BIAEDNET-INTERNETUS	false
103.224.219.136	unknown	India	135226	JEECOM-ASJeecommunicationsIN	false
110.162.48.72	unknown	Japan	9605	DOCOMONTTDOCOMOINCJP	false
190.139.248.21	unknown	Argentina	7303	TelecomArgentinaSAAR	false
23.234.164.53	unknown	United States	54905	DIGITAL-LANDSCAPEUS	false
243.11.93.252	unknown	Reserved	unknown	unknown	false
156.190.95.246	unknown	Egypt	36992	ETISALAT-MISREG	false
86.143.83.13	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
148.72.226.86	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
105.37.93.217	unknown	Egypt	37069	MOBINILEG	false
13.40.198.228	unknown	United States	7018	ATT-INTERNET4US	false
37.250.156.26	unknown	Sweden	44034	HI3GSE	false
19.175.149.177	unknown	United States	3	MIT-GATEWAYSUS	false
144.95.227.31	unknown	Netherlands	32023	ANADARKOUS	false
121.243.246.201	unknown	India	17908	TCISLTataCommunicationsIN	false
57.98.26.31	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
245.51.97.122	unknown	Reserved	unknown	unknown	false
145.221.28.61	unknown	Netherlands	15625	ING-ASAmsterdamNL	false
190.150.134.219	unknown	El Salvador	27773	MILLICOMCABLEELSALVADORSADECVSV	false
84.155.227.30	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
194.142.114.69	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
104.157.219.169	unknown	Canada	36493	295CA-TOR-ASNCA	false
53.18.189.84	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
82.147.226.38	unknown	Denmark	15516	DK-DANSKKABELTVDK	false
207.123.162.138	unknown	United States	3356	LEVEL3US	false
194.47.5.189	unknown	Sweden	1653	SUNETSUNETSwedishUniversityNetworkEU	false
255.65.102.126	unknown	Reserved	unknown	unknown	false
195.76.65.49	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
207.136.225.200	unknown	United States	5738	SOVER-ASNUS	false
93.85.251.206	unknown	Belarus	6697	BELPAK-ASBELPAKBY	false
164.150.30.65	unknown	South Africa	37130	SITA-ASZA	false
152.36.229.246	unknown	United States	31715	ABTME-ASUS	false
63.195.7.190	unknown	United States	7018	ATT-INTERNET4US	false
170.115.152.134	unknown	United States	11205	CITY-OF-PHILADELPHIAUS	false
2.73.95.133	unknown	Kazakhstan	29355	KCELL-ASKZ	false
248.133.109.69	unknown	Reserved	unknown	unknown	false
197.53.207.221	unknown	Egypt	8452	TE-ASTE-ASEG	false
216.95.76.109	unknown	United States	701	UUNETUS	false
91.41.111.144	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
139.174.47.177	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
110.156.82.185	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
95.120.112.167	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
57.124.200.251	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
217.85.150.41	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
246.109.142.99	unknown	Reserved	unknown	unknown	false
163.130.240.50	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
125.108.202.31	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
111.69.66.133	unknown	New Zealand	23655	SNAP-NZ-ASSnapInternetLimitedNZ	false
78.216.67.239	unknown	France	12322	PROXADFR	false
246.211.208.229	unknown	Reserved	unknown	unknown	false
12.253.252.114	unknown	United States	8030	WORLDNET5-10US	false
188.81.116.228	unknown	Portugal	3243	MEO-RESIDENCIALPT	false
116.189.252.212	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
71.246.41.123	unknown	United States	5650	FRONTIER-FRTRUS	false
74.80.40.146	unknown	United States	25921	LUS-FIBER-LCGUS	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/var/cache/man/cs/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.6070136442091312
Encrypted:	false
SSDEEP:	48:bhVGQeUzGLIsWUMZJ5CggJHtheYdiKNHTlJ8NK:bhVGaGLIWMZXZgxeYtzll
MD5:	D0CA2EBA9E7A17D4680AA9DDC5F88946
SHA1:	270F443EFF85209052AE8FFA86660AFB0FAAD39B
SHA-256:	9504DC65F8B4E057D0939FA3B2C640FC703D0290EE19381836BAA5EB3EFBADBD
SHA-512:	9F999B0467E396E78A91F0BFE56E191DB9D9AFA6DC47858F3427CB44A39D5A13A206542A471CE15C8851674A234B9A7A49AAB7E6D5AF8D080BBC99C2BA3C56D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/cs/index.db.rLDrkz

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/da/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.24195239843379
Encrypted:	false
SSDEEP:	96:bhHY2DzMnpU0QMiloesQdUTn3WVE0UnknJfsWdv0SBpEVvsb6eZeGfRL+:dYKM+oagn3WW5nkniWdv0SAVE6eZee6
MD5:	4DF08004EE4C5384C02376841F2B50BC
SHA1:	C02E58212CA012913390B4C1CCD64DD3353009EE
SHA-256:	F4D6A62A734E2844B99F3AD0EB480373AFBE56B29C0CFC9C70D9DFDF19D95C02
SHA-512:	6146001CA7028F58595235F244AE8FC4ECAEA3E95C83276514FC704E91B7596678E74CDE9963D680F2493F9C04AFDEBC4DB5094E2AB7C1A949E9378307AE0116
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/da/index.db.Wu1kvv

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/de/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.162766517160536
Encrypted:	false
SSDEEP:	768:gMGrknsA3KVtOOcmGMrTJDEEf5R/OHPiVDdtq5:/GrkncXD+qgHPGLq
MD5:	D12A7C09F569FFDD26D39A344485BD78
SHA1:	5394670B70BBACCC89CF3444561D26387D1BD2B7
SHA-256:	357468D824DE84AFC6FA790661FEEEFE44EF473209C0D6480E9E9C061931C041
SHA-512:	A6D6795A03A12BD8DD6E0F9EEC693A2DCC358C378D24CFE6076968A11660E074E61A8311DCF0524E55D989BAB8526C3DE0F1BED9634E903F39923B431FEF2710
Malicious:	false
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/de/index.db.jdb2Cv

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.20558603354177746
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	55880A8B73FD160B73198E09A21C83DB
SHA1:	5EB780702D2501747AF46F7525EF5C635EC5E64C
SHA-256:	66BD4C98AF40E2E208AC102ACD0F555A6C118E7258D91B833BE1D53EBFFB7BBB
SHA-512:	388924B8CAE80CCA6CA8E5109D0239A963A66CC0454450223EC7FB2A188F6F05E49632E535DC06E49DF6D007B221AA6B3D5F23C80203BCC861FF95EFA10AC1F9
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/es/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.469907427008948
Encrypted:	false
SSDEEP:	96:bhj9SeW/8iDdO/tktuGWTaZxzn3zbHGc2WjAXGBCgfd6Dgzs30z8ztvpWF4DXst:99PGo9Tmn3zbNBSw/fd6Oz8ztQSDXo
MD5:	3DBF4FF017D406F407BFBC2011BCAE9E
SHA1:	FF64864ACA18DFA7869715CE8AA5ECC3DABA54B6
SHA-256:	640C040F364061A5825E913682798C9BC8E1081088894D3FEB2C3EC39D02A379
SHA-512:	3DCC8F432487C532A1F69D321EB57EFE5CFE65AA3C99B81EA1A56613F8F460EA9ED7D2031615F2E60A3F2EE279D411848E5387CC8B8D5F28D8F8D0055D72489B
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/es/index.db.sQb6Uw

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fi/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.5882948808594274
Encrypted:	false
SSDEEP:	12:Ey20yaajjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjjjjjp:bhjz+9Ab
MD5:	09F6ED1A60B8A4203EA97CF5926C6AFF
SHA1:	C28F4E393D55AD057E3C7608741904B796F67076
SHA-256:	56664D61D0BB8BF34CCA28C73CB314CB73EA1C4FAC64D2208B43F63C009FC855
SHA-512:	476EAE37D827C8BB322213799AB52DBE8FA43274DB3447BC5FEDFED64ECCEAF2C11DA375FDA09B37977D03CA1910E22443B22A3EEA875CE6F3BC698F8ADCC0E2
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fi/index.db.apftZv

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.ISO8859-1/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.9312184489410064
Encrypted:	false
SSDEEP:	12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
MD5:	43ADE2E40B8B5A0DFA0A155FC9A02F7F
SHA1:	3D04BDFFD0E2A8433150C87D334014099336A5C5
SHA-256:	81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
SHA-512:	C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.ISO8859-1/index.db.CCD6Ox

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.UTF-8/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.9312184489410064
Encrypted:	false
SSDEEP:	12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
MD5:	43ADE2E40B8B5A0DFA0A155FC9A02F7F
SHA1:	3D04BDFFD0E2A8433150C87D334014099336A5C5
SHA-256:	81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
SHA-512:	C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr.UTF-8/index.db.ccta5y

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	3.8299165976379577
Encrypted:	false
SSDEEP:	768:A4VX6Bd+dla5HmdT8qHl87BaIPay4uz8HksKHnwNO:A4ROd+dStM83PavKHC
MD5:	49CE47363E2A1014F55BAA8A3C8BED80
SHA1:	B7FC8B0B8BD4F8D45B029E12D79FE66583DAD9A4
SHA-256:	35055D7EC4F22C34FA90DF538FD8B142E152B52036530767CB1AB3C4F0355BF2
SHA-512:	E99410D659526455172BF95B23AEE2CDD5D409375279D35D9AD7BB098521C9C9E597ECCBD0B356EC73FF160C73D3095DC4F1189C53A295ABEB0C694DE653862F
Malicious:	false
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/fr/index.db.KxVL9x

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.22208993462959856
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	425CB57CD9B42556C8089FE7A7A3E495
SHA1:	4F33F9A9897218FDED958FD8F8D7AF7CD8BC48F3
SHA-256:	85E01EFF2AC0C83C827E118D5CE2CD1E1A19E059688B6E0D09CB3CC131F065D3
SHA-512:	8C7D4DACF5C5C5C4B78775048427AF99ED8057590AA3A69FD5B3F875B6DDD249A6DB0AF3A51BB96A7F629D1017B272317583A8DFF89FB3968FFE2F246F040F33
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/hu/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.9419610786280751
Encrypted:	false
SSDEEP:	24:bh04IR9rYz9kvNQFl46MdnqfPE9eTuF0Ce:bhXIHakVQmnqXqeT/Ce
MD5:	18F02B57872A97DE1E82FF5348A5AF1B
SHA1:	52F332343B120B1C950AC02B3C923556C70DC62A
SHA-256:	5C605DE68B3E05754698485F73413F4052AEA8C3AAE6012AC6416B3B6B056DF7
SHA-512:	E33A8412F52D26BDE55E4D72E0D9D09EB777F4B882F5BB1C4625AB392EE321D6ACD8795001BF50CCDACFAC131A1263B1398F208799F753554C43349136EB8BEC
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/hu/index.db.CuSdly

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/it/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.3621193886235408
Encrypted:	false
SSDEEP:	384:Jtp0q5d98n3SaMfhtxfmbMy+HseeNwoMbHf:JDd9QSBf
MD5:	B228DE097081AF360D337CF8C8FF2C6F
SHA1:	7DD2C4640925B225F98014566F73C35F4E960940
SHA-256:	1056CECADA78542B173EE469C9BEAF61F81298EBBD21B54EA6EE449028E18B3F
SHA-512:	F61D7F9040E452C4B1B77F3657BE4252475C3BF23D78EED903A5E55FA97BA0571BA3AD90DBA7F77C334DF5B721F909B12720515034421A4AAB0450D1D43B32E4
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/it/index.db.F21dcx

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ja/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.667488020062395
Encrypted:	false
SSDEEP:	192:CF4pPRfAgFn35FF1veUMjGiEGBuPhiB0PUKwA+U:5PRfAgFn35MSeAPUjN
MD5:	D3CD7D67F8155491493BB7235FB9AA57
SHA1:	5A7AE62A7AFE50EFCCED06CBD56AE2A0A284EFF3
SHA-256:	6958349ECA637F99AABC419B5E402CFB50BC5B8867F31BCB67F064F47A209929
SHA-512:	1168BF697CDE563F7D82A71EAE1CD496EA81D178B26F87EAAF2EDEED13274B1E3500CE1C981647717598495EBE1FF8F8AC54AD33547506E566C925D7002F5CFF
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ja/index.db.2C2iJw

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ko/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.7847786157292606
Encrypted:	false
SSDEEP:	12:Ey20yYn0jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjmjj7:bhXYznMk31RFe6f
MD5:	FBA25855E1C99D8F87E8AC13E2E2ECB1
SHA1:	D99351AC40D6CC4C9BE54E0E018C44A9A88983D7
SHA-256:	C0E18ED1CEFF427FD4D57D1B79CE1AF7320AC8453BAF8A0349C08267464C4D71
SHA-512:	0969DF6506E083A4995A18518BC3C4472157E7790EEC26C08221B0FC6DE9C7DA0ADB11CF92C56BC35B89BC60447F3D991F935E352552B58FB9BD1D4B2579FBB0
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ko/index.db.B4yPiz

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/nl/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.554204221242331
Encrypted:	false
SSDEEP:	192:H8Y5a2oquB2aCYn3lvu3whjXVobdbs7dq1KJGbtf0Hoa:hoquYaCYn3Q8jXqbdbs7dGbKHoa
MD5:	27FED1CA8EB0101C459D9A617C833293
SHA1:	503B2A3E33FE79FF2CD58F831ED33DB358849BEA
SHA-256:	C3033C4F7CF0D6108611EF5A62CA893F98EE6463DDCFF7100D3BAFDEB0036D9E
SHA-512:	7BD630F5E0C5A91C34D2E48D0053923C9F2F5BAA07D21FDA79E60F3AFDF759E594E6639562C1F3EE68DD080D417009DC3AFB7DA534E3B8C29FF7B10438C3FD4E
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/nl/index.db.0onckz

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pl/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.880948418505059
Encrypted:	false
SSDEEP:	192:7Sf8026LXqn3ZTV6pXAmA44BRqvc3X3GVAjvAk/AvdWjWftxA:E802uXqn3/6pxARqr8kdWjW1
MD5:	37CEBCD3F5BF6322785FFF568EE33131
SHA1:	201298C827C77C60CD314BF721DC4C27EF95BD64
SHA-256:	012C5597C5DD8654EB14432AFCEFD9B131F2CE75AD21488991A5A688929AAEA6
SHA-512:	CCC8A8CCF4ACA332CAF610155DE9E7C4A12D1C45C98D20766B86098A3D2EF332189F159E3956944CD302DF652FE7A6F0D07CA39CBE7DF4A655D3211452487582
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pl/index.db.8E68Xx

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.4110695640960995
Encrypted:	false
SSDEEP:	192:mva8yGn35+0+eo8TAnBW4VppKP8qtRJI:Sa8Rn35+peo8T8V/fqlI
MD5:	782FF89B6FA5932F7019AF9CF3F82E43
SHA1:	2ECE8DC134E3A292E2545AA2DCD24114A5FC5749
SHA-256:	01E77D9235C524F2A61EA03953607C13831C391A5B9AB0D9094F9C38F0EEB02E
SHA-512:	2305BEC024CA5D8B43267F5487B02081A0A746B73608E11217D19C91AD857B6A5D8E935194AC4228DA3A5383086E60D593095309E64BAF38841A6E32D7EA7805
Malicious:	false
Preview:	.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt/index.db.HAXyNv

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3847690842836057
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	F0B902DEA5EF122A0B1F0F496DDC781B
SHA1:	90176D320A9C3601787D53CC346DC743367D53F1
SHA-256:	CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
SHA-512:	3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt_BR/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.7510008687365202
Encrypted:	false
SSDEEP:	48:bhX6G+IwvnUZe4Gv/KSmGROqAQAuSe0dDOfInYbmucrm3QEAvJBFIz:bhq5bnUY4Gn3P+/Z1tvJDQ
MD5:	A11F5E85A2A07AF84255570AE29318FB
SHA1:	D06BF25E5FD4A17BCF7C5BD77ACD747F0FE181E8
SHA-256:	8FFA8BC408B254217275A622D054853CB72B08409A11AA49C4C664C0DABFB62F
SHA-512:	059F3CBC93750B68942D88EDD4AD2531B2291CEC421EB903280B9105010D1C8AD70F9F3CFA1B1A50D5110DCBFDB807A6E7A3F9EBC9A48AC8C3A49DEC4B6B3899
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/pt_BR/index.db.EkCw1w

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ru/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	3.440634655325007
Encrypted:	false
SSDEEP:	384:SpjHrhEon3PRekEF3PS6y13Vi6w5TlmmcOB:Q3hNEk23MuxrB
MD5:	DF5C1114538C5D8EA1EE929FFAC24E3C
SHA1:	B6331AF77566B63EA8204BE85F5DC99FAF51479E
SHA-256:	F238C75DAD82E10AB011A9BF79775B2A5F5889644A5A06835933340845A08555
SHA-512:	9514A424CC2A9290F749F527F515B35E45C6A829CB3930DBFB39DC9D70A684640A31686EC77258FF285FE89B6DD44BB01A478848FF9B3EBD764741A6F7856704
Malicious:	false
Preview:	.W..............................`......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/ru/index.db.7KBHmx

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	0.3337394253577246
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	5B66CE03BFE548DEE335E0518E4E0554
SHA1:	65397845DC679AA972454B0FF237A513C0F490CB
SHA-256:	C38BB21B1D92166794DC09807C9A55B67B0A760C684FEEDD0C931F8415DD6D29
SHA-512:	A31C3D23F25607333250443490F0EE295BB702B46A636905FD413E8AEAA8ED23AAB42106868D2938718555C9DEEFB69FB416CAF5228A422F64D6CA8DB438FEE8
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sl/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.8558400366712392
Encrypted:	false
SSDEEP:	12:Ey20y8jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjKuV0jjjjjjjjjjjjjjjjjjjjjjje:bhaVZjx6ot7m13SmZQs
MD5:	67697BEA7C23E4805A82FE9755BB3CAE
SHA1:	14ACAFF0BECBDB116E4C0BC329E59DEF68CF46D1
SHA-256:	553DA7FF76999B7CCC4450498B11E6BD98B3B1E5FF81D82A53568F84B0D270D5
SHA-512:	D966DD6430003E708C6EE10764DC072A1ED0A252E6E1C822CBD28271A2EDD4B1F61C7F9AA7D1D442D6175791A104A365DE25B9C2598500AE705C9250C8BA46A1
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sl/index.db.WQMMfz

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sr/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.3868484511023333
Encrypted:	false
SSDEEP:	48:bhLSUCt/WFekRv/KSmGWqApnEVyfNsu+tBNGg2PgULLE2vRy2QwfoQEDiR2e3iRj:bhLVC48cn3Vu2FtBv7AtboQIqb3qwK
MD5:	0DD75ECC81E4E564EA56A57FF32A24D3
SHA1:	859C0FE5F86A2C5A32BAD7920787BE845F34C4FB
SHA-256:	DB778B175D19DEFA4180D0B12D675AD0B8B22CC4BB77702D9EC8510F894EB3B1
SHA-512:	7B0C56A76797383527509F8036EB4911F8925E7ACC005CDC3269F0A43231479E3A0A9887BF4D2979F05CBFE18324997DEF715FDA6921EEF827B385C9D902C708
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sr/index.db.ssllBx

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sv/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.5432558448090097
Encrypted:	false
SSDEEP:	96:bhk/+fz7b9ldxbe2Vn3iwkVJIB0D6c6aZ4+1Wrzbxpl4/tMe1:imrn9lHbe2Vn3iwKhD6cvTAbl4/tMe
MD5:	D97454D6B1F39F39966A809BCA3D9647
SHA1:	276931CED8F34B7651C1BDFC8522FF0560E2C377
SHA-256:	DCB8CE7F4F21595D851100F315C56B717541DB898AEB9ED9C0CCC9FF217A5801
SHA-512:	3E014F3EA8EEE79B87726EDA6291AC2D0BD9B22803EE848F61CA2AAD39D5FB87704410C57C648EE4AF8A1B78EFB0D766524F6DB750208C9BAC346079FD8EE69E
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/sv/index.db.JL2zSv

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/tr/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.7558188637474321
Encrypted:	false
SSDEEP:	96:bhWV1OIM7cn3UZiPU1wywyoEpJmz6W2Mzgg:YDOL4n3fPvywrzgMU
MD5:	5F905B930E7310E72BC3DF5C50F8E579
SHA1:	50B1AD3115F095C743CB26F87ECCE406FAC3523B
SHA-256:	1DB72BA77CA01F25CA9768999825D8F97F5ED4D00E17C9130D6F7CDE34130270
SHA-512:	A6066F4DF4097DB93673CD156BBE5F910C3F64D01E1671E481BC9FBDD720DBD6F8CEF337E20404F7C6AE97B2FA1F5E67088041ACBB6EA85D6758924D5740D06C
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/tr/index.db.dHLmPw

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_CN/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.6210042560348144
Encrypted:	false
SSDEEP:	48:bh5roGafX8XKu5YIoBHtF2YekDsv/KSmGWNmA/y0uJNI/oyjaOUUfEHKn9nnjoEJ:bhdoLfX8N9oBNF2XFn3UD/9FZiy0aoN
MD5:	39398A15564A55EB7BFE895D7668A5A3
SHA1:	28DA677435B87176E08AFABBF8B51F7B93E22948
SHA-256:	A4C0216476E357ED3A23E71333DBE7DE91E04370EF049032EE8E47BB1EDBD83B
SHA-512:	B4E69212338C742F8C83194552078A86E4BED59375D82563C0B4059B7E0D6A58D6317151AB1F2A6FB20D2FF6DB7C550DF6A6984B2BB873A111D58AF9AEB7D95E
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_CN/index.db.Z4jDnz

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_TW/6207

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.0170167917961734
Encrypted:	false
SSDEEP:	24:bhAvIZuF4ptmpzf50dhOv8WvxjMMhFmMKxevOfOots+:bhDi4p+ahOhFFKxewj
MD5:	1FC5F2B98E5BC25B10373353D91B86B1
SHA1:	D848DA35B0731328195D59C1E996B95C4952F1F9
SHA-256:	509FAD18B4454CD70D974755F6156D4A5FA9B960AB9FF468D1FC350F0B64F379
SHA-512:	95BC2E289EDE5D9A3F56C9D8AE9DD13D9379BE2ABF8927CDABBE92B9F57A8EB667E9C08E4DFD82BF9F1F57118CE6E495722ADA2668AFF4FA0540F46C0A6D5138
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/cache/man/zh_TW/index.db.5ouSHz

Download File

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.45676214072558463
Encrypted:	false
SSDEEP:	12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
MD5:	EE429C7E8B222AFF73C611A8C358B661
SHA1:	DA353E80DCF1195F259CCBC32D39F5923710453F
SHA-256:	BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
SHA-512:	DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
Malicious:	false
Preview:	.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/var/lib/logrotate/status.tmp

Download File

Process:	/usr/sbin/logrotate
File Type:	ASCII text
Category:	dropped
Size (bytes):	1593
Entropy (8bit):	4.755943061875726
Encrypted:	false
SSDEEP:	48:UYmqJNLr0HSKztq4Rpsx3csQUXA575xYVq4eBDNU1L3o9N/qJN4qJn7U4v3oUJZa:t4m4K8l4+e0QnRaUq
MD5:	3CAFAE58EA492F80B42AE5679E2E25B0
SHA1:	D5CCEEF30785B870ABDEC5CFB8BB62BA43DD35C8
SHA-256:	2F3C290E7E6F82D47DE76642B014E62A6BDB7992844D4488FCCF4E5E611E94BE
SHA-512:	927A7CBB36D32024109CBFE0CDBB229D22C12AF52ADDAE7CCF400641566F164657A4868B6DD946266A2243C68C3F8CFEA81C56F8EAA9A7DDF6D776B989BBC3AD
Malicious:	false
Preview:	logrotate state -- version 2."/var/log/syslog" 2023-5-30-0:53:8."/var/log/dpkg.log" 2023-5-29-22:52:42."/var/log/speech-dispatcher/debug-flite" 2023-5-30-0:0:0."/var/log/unattended-upgrades/unattended-upgrades.log" 2023-5-29-22:52:42."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2021-9-17-9:23:29."/var/log/auth.log" 2023-5-29-22:52:42."/var/log/apt/term.log" 2023-5-29-22:52:42."/var/log/ppp-connect-errors" 2023-5-30-0:0:0."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2023-5-30-0:0:0."/var/log/apport.log" 2021-9-17-9:23:29."/var/log/apt/history.log" 2023-5-29-22:52:42."/var/log/boot.log" 2023-5-30-0:0:0."/var/log/lightdm/*.log" 2023-5-30-0:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/debug" 2023-5-30-0:0:0."/var/log/mail.log" 2023-5-30-0:0:0."/var/log/kern.log" 2023-5-29-22:52:42."/var/log/cups/access_log" 2023-5-30-0:53:8."/var/log/ufw.log" 2023-5-30-0:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2023-5-30-0:0:0."/var/log/daemon.

/var/log/cups/access_log.1.gz

Download File

Process:	/bin/gzip
File Type:	gzip compressed data, last modified: Mon May 29 22:52:42 2023, from Unix, original size modulo 2^32 554
Category:	dropped
Size (bytes):	198
Entropy (8bit):	7.064839258913861
Encrypted:	false
SSDEEP:	6:XzfU0NX2cjVK+c02TOTnGGCl+0ktXIgggqRMtMNl:XzfvGcjVKTl6jfCTkFsNCI
MD5:	8A4A653365ACA8E6D01CEC430420E069
SHA1:	3EEE52AF78AF0D903BA08872D28F15BB7C04B502
SHA-256:	6A801A466CC2D69F307A280F720EE797E23E20521499BCF348E9D790E160379F
SHA-512:	65DD649F260BE6A43A4E7E6CC57CCC6009471A8CDFF357424D29701CDF59C3FCEF0754BD408DF1A67A29730DB6CC260A53BD83E094B6D0C7E85A41173498009F
Malicious:	false
Preview:	.....,ud......0.....a5...%teq1..f...HlzI[..^ds..p..\|.-..>(D`./2..8..J..S..l.+$.n..i.w2......6.V..E.Y=....{r......-....d~X.a.O...M..=....LH..B.:m...D._i.[....xO.9..................

/var/log/syslog.1.gz

Download File

Process:	/bin/gzip
File Type:	gzip compressed data, last modified: Mon May 29 22:52:42 2023, from Unix, original size modulo 2^32 17963
Category:	dropped
Size (bytes):	2959
Entropy (8bit):	7.924704181814173
Encrypted:	false
SSDEEP:	48:Xwa7jIfk4WPrlgRYxwAj2Id0Q/ooJ74XgiN6CKfZkrGjK3VPd2Up0/IFGgR2GI:h7UfpWPrlkivegpcmyGjKxLFh1I
MD5:	F9098A2DC26CE2A1479E5D3126F00F42
SHA1:	06FA1BF4AAE0FE61B0907172425C6E485C29FB35
SHA-256:	5E5B652110FA7D3B5F9BC28FB321ECA76DA5DAF3CA288EE6AF1BEA39B563BC4F
SHA-512:	32025F51E8D68922088EB9D24ADEBEDB1D040DCDFFEA54999295DC8449519FED9704BACD66B71B1737DA17500D6B1BDFF277698A5E2C9681E2FEBB2638936756
Malicious:	false
Preview:	.....,ud...\is...._...'...}.3...n.u.$..'.HHbM..AZv~}_..,..HIn..L<.}..G$G... 4.............M..].".&.q6). Ce.7...7R....k......;5O.....9..6Tfe..p0....b...L..".._.^../.6...d..=D..`%...Iq.D$D....I..A.'4.3...5..D.$%\r}>.9.B.(%......G...^~.q......+....A..p...J.{..2..!c.....b.M..'.)Y.M.U...q<q!..".N.`.Pa.....D.iqe:..D'e4K..e......U..6,i.. fs.2...dAR..Rm.S...S5...B.p..l.PA.....I?.y2...@}...0.........l-......&.....l..E,&../.B..Ccp...._?.?..9h..7O..(.Wi...!U.<..A.R2.[Q........0....r.......p7..6. .......n.@..4...TS.Z.....b..,..`:.$Nx..{........Mr\..+...<.!.q.....~.R.....-.....[.&1....-....O.I...kp?.9.hV':..h. Q..-..F<.H2.&?.....2D.ah..H........:....D..........X.f0.W+.`....G.....U.v\5 ....`..p.ai^B.j>....3=.-.....L.Y....jN.8.'..........K_7.........W..S..8.xs.1....[....../~~...?og.A....m...1... .h...q......^..`..@...]<..n.8...%j..G 3...ehS.:....S.J.H2a...{.l....[p7<NA0%...W^!..V.h{k.....R2.W`>.X@....}..e.%?A...).p.".c.H.fp.fl....Y...*g....>..}...`e^$.Dl....

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
Entropy (8bit):	7.929395181499569
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	yvweY4vsVq.elf
File size:	25004
MD5:	7592df37fb3fea64a0994ac342f319f4
SHA1:	bd612669bbc816883907689411667f34b471259f
SHA256:	4e97dfb181ef3db9a59094b5f468255ee7dc5d5e52543730d8394270a434b162
SHA512:	6e1d35eed67210fb5aeefeae47a876e58bcc38f233618ad1c2487db810467f0697ce5cc0825b51ff0a552c5ce9b9af2f61adc3493db9665e5021daf8ca53e8c7
SSDEEP:	384:cZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3prhymdGUop5h1:5X9nxn8o9wnBoWzEQf2EjKb3prs3UozP
TLSH:	5FB2C0717015B8B2CAE1007B6AEEDA43FB801EF8D0E873391465099DEAD5D42BAF1547
File Content Preview:	.ELF...a..........(.........4...........4. ...(......................`...`...............^..........................Q.td..............................CvUPX!........0...0.......R..........?.E.h;.}...^..........f.Z.6..(fw....&.x:.E.......oe.`.S..T.......n..

Static ELF Info

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0x60bf	0x60bf	7.9335	0x5	R E	0x8000
LOAD	0x5ee0	0x1dee0	0x1dee0	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 30, 2023 00:53:23.331244946 CEST	42516	80	192.168.2.23	109.202.202.202
May 30, 2023 00:53:25.773242950 CEST	48592	1312	192.168.2.23	107.189.3.153
May 30, 2023 00:53:25.785867929 CEST	25180	23	192.168.2.23	76.0.183.154
May 30, 2023 00:53:25.785918951 CEST	25180	23	192.168.2.23	218.45.121.154
May 30, 2023 00:53:25.785938025 CEST	25180	23	192.168.2.23	126.137.100.236
May 30, 2023 00:53:25.785940886 CEST	25180	23	192.168.2.23	183.86.244.155
May 30, 2023 00:53:25.785965919 CEST	25180	23	192.168.2.23	120.95.49.115
May 30, 2023 00:53:25.785973072 CEST	25180	23	192.168.2.23	201.206.91.129
May 30, 2023 00:53:25.786003113 CEST	25180	23	192.168.2.23	136.240.152.7
May 30, 2023 00:53:25.786003113 CEST	25180	23	192.168.2.23	79.160.239.125
May 30, 2023 00:53:25.786067009 CEST	25180	23	192.168.2.23	246.183.54.88
May 30, 2023 00:53:25.786077976 CEST	25180	23	192.168.2.23	23.36.125.81
May 30, 2023 00:53:25.786078930 CEST	25180	23	192.168.2.23	93.6.77.59
May 30, 2023 00:53:25.786078930 CEST	25180	23	192.168.2.23	75.192.32.102
May 30, 2023 00:53:25.786084890 CEST	25180	23	192.168.2.23	87.220.234.113
May 30, 2023 00:53:25.786082029 CEST	25180	23	192.168.2.23	174.229.190.231
May 30, 2023 00:53:25.786082029 CEST	25180	23	192.168.2.23	153.190.168.241
May 30, 2023 00:53:25.786108017 CEST	25180	23	192.168.2.23	216.202.192.22
May 30, 2023 00:53:25.786109924 CEST	25180	23	192.168.2.23	23.233.187.152
May 30, 2023 00:53:25.786109924 CEST	25180	23	192.168.2.23	97.77.143.147
May 30, 2023 00:53:25.786109924 CEST	25180	23	192.168.2.23	155.226.78.146
May 30, 2023 00:53:25.786161900 CEST	25180	23	192.168.2.23	90.225.231.43
May 30, 2023 00:53:25.786161900 CEST	25180	23	192.168.2.23	104.13.239.230
May 30, 2023 00:53:25.786190987 CEST	25180	23	192.168.2.23	167.152.63.108
May 30, 2023 00:53:25.786199093 CEST	25180	23	192.168.2.23	247.136.170.47
May 30, 2023 00:53:25.786205053 CEST	25180	23	192.168.2.23	166.11.184.189
May 30, 2023 00:53:25.786217928 CEST	25180	23	192.168.2.23	149.168.18.245
May 30, 2023 00:53:25.786241055 CEST	25180	23	192.168.2.23	93.214.165.127
May 30, 2023 00:53:25.786302090 CEST	25180	23	192.168.2.23	151.171.214.178
May 30, 2023 00:53:25.786307096 CEST	25180	23	192.168.2.23	16.229.95.68
May 30, 2023 00:53:25.786312103 CEST	25180	23	192.168.2.23	252.75.153.96
May 30, 2023 00:53:25.786340952 CEST	25180	23	192.168.2.23	18.99.237.72
May 30, 2023 00:53:25.786340952 CEST	25180	23	192.168.2.23	67.42.182.45
May 30, 2023 00:53:25.786340952 CEST	25180	23	192.168.2.23	190.36.146.59
May 30, 2023 00:53:25.786365032 CEST	25180	23	192.168.2.23	195.175.152.36
May 30, 2023 00:53:25.786376953 CEST	25180	23	192.168.2.23	211.116.191.67
May 30, 2023 00:53:25.786396980 CEST	25180	23	192.168.2.23	210.74.118.2
May 30, 2023 00:53:25.786396980 CEST	25180	23	192.168.2.23	35.27.252.236
May 30, 2023 00:53:25.786401987 CEST	25180	23	192.168.2.23	192.228.72.55
May 30, 2023 00:53:25.786402941 CEST	25180	23	192.168.2.23	125.152.129.219
May 30, 2023 00:53:25.786402941 CEST	25180	23	192.168.2.23	85.64.190.7
May 30, 2023 00:53:25.786457062 CEST	25180	23	192.168.2.23	83.240.163.128
May 30, 2023 00:53:25.786459923 CEST	25180	23	192.168.2.23	47.77.83.183
May 30, 2023 00:53:25.786459923 CEST	25180	23	192.168.2.23	216.105.159.246
May 30, 2023 00:53:25.786459923 CEST	25180	23	192.168.2.23	139.7.13.2
May 30, 2023 00:53:25.786480904 CEST	25180	23	192.168.2.23	108.125.130.242
May 30, 2023 00:53:25.786480904 CEST	25180	23	192.168.2.23	120.26.142.118
May 30, 2023 00:53:25.786480904 CEST	25180	23	192.168.2.23	96.106.78.8
May 30, 2023 00:53:25.786535025 CEST	25180	23	192.168.2.23	207.53.121.27
May 30, 2023 00:53:25.786536932 CEST	25180	23	192.168.2.23	167.147.171.44
May 30, 2023 00:53:25.786539078 CEST	25180	23	192.168.2.23	149.95.216.142
May 30, 2023 00:53:25.786551952 CEST	25180	23	192.168.2.23	66.171.209.35
May 30, 2023 00:53:25.786557913 CEST	25180	23	192.168.2.23	47.123.58.194
May 30, 2023 00:53:25.786557913 CEST	25180	23	192.168.2.23	72.162.187.15
May 30, 2023 00:53:25.786557913 CEST	25180	23	192.168.2.23	91.193.169.100
May 30, 2023 00:53:25.786561966 CEST	25180	23	192.168.2.23	93.35.89.73
May 30, 2023 00:53:25.786562920 CEST	25180	23	192.168.2.23	99.228.142.95
May 30, 2023 00:53:25.786566973 CEST	25180	23	192.168.2.23	190.24.132.104
May 30, 2023 00:53:25.786571026 CEST	25180	23	192.168.2.23	45.19.100.46
May 30, 2023 00:53:25.786571980 CEST	25180	23	192.168.2.23	111.43.148.81
May 30, 2023 00:53:25.786581039 CEST	25180	23	192.168.2.23	46.184.252.206
May 30, 2023 00:53:25.786600113 CEST	25180	23	192.168.2.23	47.125.173.77
May 30, 2023 00:53:25.786602020 CEST	25180	23	192.168.2.23	163.136.71.218
May 30, 2023 00:53:25.786604881 CEST	25180	23	192.168.2.23	173.226.73.43
May 30, 2023 00:53:25.786604881 CEST	25180	23	192.168.2.23	118.147.250.108
May 30, 2023 00:53:25.786613941 CEST	25180	23	192.168.2.23	72.146.138.24
May 30, 2023 00:53:25.786627054 CEST	25180	23	192.168.2.23	109.243.111.170
May 30, 2023 00:53:25.786642075 CEST	25180	23	192.168.2.23	45.20.38.104
May 30, 2023 00:53:25.786659956 CEST	25180	23	192.168.2.23	176.231.245.92
May 30, 2023 00:53:25.786673069 CEST	25180	23	192.168.2.23	74.203.9.155
May 30, 2023 00:53:25.786686897 CEST	25180	23	192.168.2.23	138.3.242.164
May 30, 2023 00:53:25.786694050 CEST	25180	23	192.168.2.23	89.218.248.26
May 30, 2023 00:53:25.786705017 CEST	25180	23	192.168.2.23	133.98.84.213
May 30, 2023 00:53:25.786720037 CEST	25180	23	192.168.2.23	121.75.184.54
May 30, 2023 00:53:25.786752939 CEST	25180	23	192.168.2.23	172.252.40.78
May 30, 2023 00:53:25.786778927 CEST	25180	23	192.168.2.23	255.132.56.124
May 30, 2023 00:53:25.786792040 CEST	25180	23	192.168.2.23	5.60.202.39
May 30, 2023 00:53:25.786793947 CEST	25180	23	192.168.2.23	105.74.41.51
May 30, 2023 00:53:25.786802053 CEST	25180	23	192.168.2.23	203.226.116.205
May 30, 2023 00:53:25.786818027 CEST	25180	23	192.168.2.23	18.59.205.70
May 30, 2023 00:53:25.786828995 CEST	25180	23	192.168.2.23	9.88.5.107
May 30, 2023 00:53:25.788420916 CEST	25180	23	192.168.2.23	186.231.252.148
May 30, 2023 00:53:25.788434982 CEST	25180	23	192.168.2.23	81.145.227.214
May 30, 2023 00:53:25.788446903 CEST	25180	23	192.168.2.23	73.244.18.129
May 30, 2023 00:53:25.788472891 CEST	25180	23	192.168.2.23	157.169.143.233
May 30, 2023 00:53:25.788472891 CEST	25180	23	192.168.2.23	75.141.170.185
May 30, 2023 00:53:25.788491011 CEST	25180	23	192.168.2.23	194.139.42.234
May 30, 2023 00:53:25.788502932 CEST	25180	23	192.168.2.23	208.153.191.90
May 30, 2023 00:53:25.788515091 CEST	25180	23	192.168.2.23	16.127.196.191
May 30, 2023 00:53:25.788526058 CEST	25180	23	192.168.2.23	85.27.135.199
May 30, 2023 00:53:25.788535118 CEST	25180	23	192.168.2.23	19.199.243.20
May 30, 2023 00:53:25.788562059 CEST	25180	23	192.168.2.23	197.87.30.9
May 30, 2023 00:53:25.788574934 CEST	25180	23	192.168.2.23	66.14.35.128
May 30, 2023 00:53:25.788587093 CEST	25180	23	192.168.2.23	169.45.4.253
May 30, 2023 00:53:25.788599014 CEST	25180	23	192.168.2.23	94.152.72.221
May 30, 2023 00:53:25.788614988 CEST	25180	23	192.168.2.23	23.18.24.119
May 30, 2023 00:53:25.788629055 CEST	25180	23	192.168.2.23	222.54.48.135
May 30, 2023 00:53:25.788641930 CEST	25180	23	192.168.2.23	19.0.22.36
May 30, 2023 00:53:25.788655043 CEST	25180	23	192.168.2.23	163.175.160.57
May 30, 2023 00:53:25.788664103 CEST	25180	23	192.168.2.23	141.47.65.229

System Behavior

Analysis Process: systemd PID: 6198, Parent PID: 1

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: logrotate PID: 6198, Parent PID: 1

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/usr/sbin/logrotate
Arguments:	/usr/sbin/logrotate /etc/logrotate.conf
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Analysis Process: logrotate PID: 6240, Parent PID: 6198

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Analysis Process: gzip PID: 6240, Parent PID: 6198

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/bin/gzip
Arguments:	/bin/gzip
File size:	97496 bytes
MD5 hash:	beef4e1f54ec90564d2acd57c0b0c897

Analysis Process: logrotate PID: 6241, Parent PID: 6198

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Analysis Process: sh PID: 6241, Parent PID: 6198

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/bin/sh
Arguments:	sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6242, Parent PID: 6241

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: invoke-rc.d PID: 6242, Parent PID: 6241

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/usr/sbin/invoke-rc.d
Arguments:	invoke-rc.d --quiet cups restart
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: invoke-rc.d PID: 6243, Parent PID: 6242

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: runlevel PID: 6243, Parent PID: 6242

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/sbin/runlevel
Arguments:	/sbin/runlevel
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Analysis Process: invoke-rc.d PID: 6245, Parent PID: 6242

General

Start time:	00:53:09
Start date:	30/05/2023
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: systemctl PID: 6245, Parent PID: 6242

General

Start time:	00:53:09
Start date:	30/05/2023
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-enabled cups.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Analysis Process: invoke-rc.d PID: 6249, Parent PID: 6242

General

Start time:	00:53:10
Start date:	30/05/2023
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: ls PID: 6249, Parent PID: 6242

General

Start time:	00:53:10
Start date:	30/05/2023
Path:	/usr/bin/ls
Arguments:	ls /etc/rc[S2345].d/S[0-9][0-9]cups
File size:	142144 bytes
MD5 hash:	e7793f15c2ff7e747b4bc7079f5cd4f7

Analysis Process: invoke-rc.d PID: 6250, Parent PID: 6242

General

Start time:	00:53:11
Start date:	30/05/2023
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: systemctl PID: 6250, Parent PID: 6242

General

Start time:	00:53:11
Start date:	30/05/2023
Path:	/usr/bin/systemctl
Arguments:	systemctl --quiet is-active cups.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Analysis Process: logrotate PID: 6251, Parent PID: 6198

General

Start time:	00:53:11
Start date:	30/05/2023
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Analysis Process: gzip PID: 6251, Parent PID: 6198

General

Start time:	00:53:11
Start date:	30/05/2023
Path:	/bin/gzip
Arguments:	/bin/gzip
File size:	97496 bytes
MD5 hash:	beef4e1f54ec90564d2acd57c0b0c897

Analysis Process: logrotate PID: 6252, Parent PID: 6198

General

Start time:	00:53:11
Start date:	30/05/2023
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Analysis Process: sh PID: 6252, Parent PID: 6198

General

Start time:	00:53:11
Start date:	30/05/2023
Path:	/bin/sh
Arguments:	sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6253, Parent PID: 6252

General

Start time:	00:53:12
Start date:	30/05/2023
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: rsyslog-rotate PID: 6253, Parent PID: 6252

General

Start time:	00:53:12
Start date:	30/05/2023
Path:	/usr/lib/rsyslog/rsyslog-rotate
Arguments:	/usr/lib/rsyslog/rsyslog-rotate
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: rsyslog-rotate PID: 6254, Parent PID: 6253

General

Start time:	00:53:12
Start date:	30/05/2023
Path:	/usr/lib/rsyslog/rsyslog-rotate
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: systemctl PID: 6254, Parent PID: 6253

General

Start time:	00:53:12
Start date:	30/05/2023
Path:	/usr/bin/systemctl
Arguments:	systemctl kill -s HUP rsyslog.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Analysis Process: systemd PID: 6199, Parent PID: 1

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: install PID: 6199, Parent PID: 1

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/usr/bin/install
Arguments:	/usr/bin/install -d -o man -g man -m 0755 /var/cache/man
File size:	158112 bytes
MD5 hash:	55e2520049dc6a62e8c94732e36cdd54

Analysis Process: systemd PID: 6205, Parent PID: 1

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: find PID: 6205, Parent PID: 1

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/usr/bin/find
Arguments:	/usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete
File size:	320160 bytes
MD5 hash:	b68ef002f84cc54dd472238ba7df80ab

Analysis Process: systemd PID: 6207, Parent PID: 1

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Analysis Process: mandb PID: 6207, Parent PID: 1

General

Start time:	00:53:08
Start date:	30/05/2023
Path:	/usr/bin/mandb
Arguments:	/usr/bin/mandb --quiet
File size:	142432 bytes
MD5 hash:	1dda5ea0027ecf1c2db0f5a3de7e6941

Analysis Process: yvweY4vsVq.elf PID: 6291, Parent PID: 6127

General

Start time:	00:53:24
Start date:	30/05/2023
Path:	/tmp/yvweY4vsVq.elf
Arguments:	/tmp/yvweY4vsVq.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: yvweY4vsVq.elf PID: 6293, Parent PID: 6291

General

Start time:	00:53:25
Start date:	30/05/2023
Path:	/tmp/yvweY4vsVq.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: yvweY4vsVq.elf PID: 6295, Parent PID: 6291

General

Start time:	00:53:25
Start date:	30/05/2023
Path:	/tmp/yvweY4vsVq.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: yvweY4vsVq.elf PID: 6297, Parent PID: 6291

General

Start time:	00:53:25
Start date:	30/05/2023
Path:	/tmp/yvweY4vsVq.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: yvweY4vsVq.elf PID: 6299, Parent PID: 6297

General

Start time:	00:53:25
Start date:	30/05/2023
Path:	/tmp/yvweY4vsVq.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: yvweY4vsVq.elf PID: 6301, Parent PID: 6297

General

Start time:	00:53:25
Start date:	30/05/2023
Path:	/tmp/yvweY4vsVq.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: yvweY4vsVq.elf PID: 6303, Parent PID: 6297

General

Start time:	00:53:25
Start date:	30/05/2023
Path:	/tmp/yvweY4vsVq.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.
Tactics:	Defense Evasion
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	API monitoring, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report yvweY4vsVq.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

PCAP (Network Traffic)

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/cache/man/cs/6207

/var/cache/man/cs/index.db.rLDrkz

/var/cache/man/da/6207

/var/cache/man/da/index.db.Wu1kvv

/var/cache/man/de/6207

/var/cache/man/de/index.db.jdb2Cv

/var/cache/man/es/6207

/var/cache/man/es/index.db.sQb6Uw

/var/cache/man/fi/6207

/var/cache/man/fi/index.db.apftZv

/var/cache/man/fr.ISO8859-1/6207

/var/cache/man/fr.ISO8859-1/index.db.CCD6Ox

/var/cache/man/fr.UTF-8/6207

/var/cache/man/fr.UTF-8/index.db.ccta5y

/var/cache/man/fr/6207

/var/cache/man/fr/index.db.KxVL9x

/var/cache/man/hu/6207

/var/cache/man/hu/index.db.CuSdly

/var/cache/man/it/6207

/var/cache/man/it/index.db.F21dcx

/var/cache/man/ja/6207

/var/cache/man/ja/index.db.2C2iJw

/var/cache/man/ko/6207

/var/cache/man/ko/index.db.B4yPiz

/var/cache/man/nl/6207

/var/cache/man/nl/index.db.0onckz

Linux Analysis Report
yvweY4vsVq.elf