Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
boatnet.arm.elf

Overview

General Information

Sample name:boatnet.arm.elf
Analysis ID:1662518
MD5:d5320d8d3eed35b3c52f5ec43e7ddbde
SHA1:24b3e614ca156227f2275d1c36d5ad47e6a2fddb
SHA256:eaa5510ba45ece2445d830e866012f7ebb19901f11b405175fb290f56eb291cb
Tags:elfuser-abuse_ch
Infos:

Detection

Score:64
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1662518
Start date and time:2025-04-10 22:55:11 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 24s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:boatnet.arm.elf
Detection:MAL
Classification:mal64.spre.evad.linELF@0/0@2/0
Command:/tmp/boatnet.arm.elf
PID:5630
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:
  • system is lnxubuntu20
  • wrapper-2.0 (PID: 5641, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
  • wrapper-2.0 (PID: 5642, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
  • wrapper-2.0 (PID: 5643, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
    • xfpm-power-backlight-helper (PID: 5663, Parent: 5643, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness
  • wrapper-2.0 (PID: 5644, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
  • wrapper-2.0 (PID: 5645, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
  • wrapper-2.0 (PID: 5646, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
  • xfconfd (PID: 5662, Parent: 5661, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
  • systemd New Fork (PID: 5688, Parent: 2955)
  • xfce4-notifyd (PID: 5688, Parent: 2955, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
  • xfconfd (PID: 5694, Parent: 5693, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
  • cleanup
SourceRuleDescriptionAuthorStrings
5634.1.00007f0ac4017000.00007f0ac4023000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0xa6fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa74c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa79c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa7b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa7c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa7d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa7ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa83c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa88c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5636.1.00007f0ac4017000.00007f0ac4023000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0xa6fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa74c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa79c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa7b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa7c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa7d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa7ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa83c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa88c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5630.1.00007f0ac4017000.00007f0ac4023000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0xa6fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa74c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa79c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa7b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa7c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa7d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa7ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa83c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xa88c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: boatnet.arm.elf PID: 5634Linux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x366c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x3680:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x3694:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x36a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x36bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x36d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x36e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x36f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x370c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x3720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x3734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x3748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x375c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x3770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x3784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x3798:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x37ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x37c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x37d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x37e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x37fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: boatnet.arm.elf PID: 5636Linux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x1231:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x1245:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x1259:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x126d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x1281:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x1295:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x12a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x12bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x12d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x12e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x12f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x130d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x1321:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x1335:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x1349:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x135d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x1371:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x1385:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x1399:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x13ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x13c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: boatnet.arm.elfVirustotal: Detection: 29%Perma Link
Source: boatnet.arm.elfReversingLabs: Detection: 33%
Source: global trafficTCP traffic: 192.168.2.14:35378 -> 176.65.137.13:7716
Source: unknownTCP traffic detected without corresponding DNS query: 176.65.137.13
Source: unknownTCP traffic detected without corresponding DNS query: 176.65.137.13
Source: unknownTCP traffic detected without corresponding DNS query: 176.65.137.13
Source: unknownTCP traffic detected without corresponding DNS query: 176.65.137.13
Source: unknownTCP traffic detected without corresponding DNS query: 176.65.137.13
Source: unknownTCP traffic detected without corresponding DNS query: 176.65.137.13
Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
Source: boatnet.arm.elfString found in binary or memory: http://upx.sf.net

System Summary

barindex
Source: 5634.1.00007f0ac4017000.00007f0ac4023000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5636.1.00007f0ac4017000.00007f0ac4023000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5630.1.00007f0ac4017000.00007f0ac4023000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: boatnet.arm.elf PID: 5634, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: boatnet.arm.elf PID: 5636, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3129, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3184, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3187, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3188, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3189, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3190, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3193, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3207, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3215, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3235, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5636, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5641, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5642, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5643, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5644, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5645, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5646, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5662, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5688, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5694, result: successfulJump to behavior
Source: LOAD without section mappingsProgram segment: 0x8000
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3129, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3184, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3187, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3188, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3189, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3190, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3193, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3207, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3215, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 3235, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5636, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5641, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5642, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5643, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5644, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5645, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5646, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5662, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5688, result: successfulJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)SIGKILL sent: pid: 5694, result: successfulJump to behavior
Source: 5634.1.00007f0ac4017000.00007f0ac4023000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5636.1.00007f0ac4017000.00007f0ac4023000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5630.1.00007f0ac4017000.00007f0ac4023000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.arm.elf PID: 5634, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: boatnet.arm.elf PID: 5636, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engineClassification label: mal64.spre.evad.linELF@0/0@2/0

Data Obfuscation

barindex
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5641)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5642)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5643)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5644)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /usr/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /usr/local/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /home/saturnino/.fonts/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /usr/share/fonts/X11/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /usr/share/fonts/type1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /home/saturnino/.cacheJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /home/saturnino/.localJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Directory: /home/saturnino/.configJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5646)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5662)Directory: /home/saturnino/.cacheJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5662)Directory: /home/saturnino/.localJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5662)Directory: /home/saturnino/.configJump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5662)Directory: /home/saturnino/.configJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5662/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3760/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3761/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5785/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/2672/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1583/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3244/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3120/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3361/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3759/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3239/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1577/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1610/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/512/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1299/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3235/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/514/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3874/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/519/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/2946/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/917/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3758/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5673/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5674/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5675/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3134/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1593/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3011/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3094/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3406/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1589/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3129/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1588/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3402/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3125/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3246/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3245/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/767/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/800/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/888/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/801/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/769/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/803/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/806/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/807/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/928/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/2956/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3420/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/490/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3142/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1635/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1633/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1599/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3139/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1873/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1630/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3412/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/657/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5676/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/658/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5677/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/659/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5678/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/418/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5679/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/419/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1639/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1638/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5693/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5694/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3398/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1371/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3392/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/780/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/660/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/661/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/782/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1369/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3304/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3425/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/785/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1642/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/940/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/941/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1640/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3147/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/3268/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1364/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/548/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5688/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5569/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1647/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/5463/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/2991/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1383/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1382/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1381/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/791/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/671/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/794/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1655/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/2986/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/795/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/674/cmdlineJump to behavior
Source: /tmp/boatnet.arm.elf (PID: 5632)File opened: /proc/1653/cmdlineJump to behavior
Source: boatnet.arm.elfSubmission file: segment LOAD with 7.9142 entropy (max. 8.0)
Source: /tmp/boatnet.arm.elf (PID: 5630)Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5641)Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5642)Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5643)Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5644)Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645)Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5646)Queries kernel information via 'uname': Jump to behavior
Source: boatnet.arm.elf, 5630.1.00007ffe3c157000.00007ffe3c178000.rw-.sdmp, boatnet.arm.elf, 5634.1.00007ffe3c157000.00007ffe3c178000.rw-.sdmp, boatnet.arm.elf, 5636.1.00007ffe3c157000.00007ffe3c178000.rw-.sdmpBinary or memory string: ^x86_64/usr/bin/qemu-arm/tmp/boatnet.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.arm.elf
Source: boatnet.arm.elf, 5630.1.0000557af10f8000.0000557af1306000.rw-.sdmp, boatnet.arm.elf, 5634.1.0000557af10f8000.0000557af1306000.rw-.sdmp, boatnet.arm.elf, 5636.1.0000557af10f8000.0000557af1306000.rw-.sdmpBinary or memory string: zU!/etc/qemu-binfmt/arm
Source: boatnet.arm.elf, 5630.1.0000557af10f8000.0000557af1306000.rw-.sdmp, boatnet.arm.elf, 5634.1.0000557af10f8000.0000557af1306000.rw-.sdmp, boatnet.arm.elf, 5636.1.0000557af10f8000.0000557af1306000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: boatnet.arm.elf, 5630.1.00007ffe3c157000.00007ffe3c178000.rw-.sdmp, boatnet.arm.elf, 5634.1.00007ffe3c157000.00007ffe3c178000.rw-.sdmp, boatnet.arm.elf, 5636.1.00007ffe3c157000.00007ffe3c178000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
Hidden Files and Directories
1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Non-Standard Port
Exfiltration Over Other Network Medium1
Service Stop
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts11
Obfuscated Files or Information
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1662518 Sample: boatnet.arm.elf Startdate: 10/04/2025 Architecture: LINUX Score: 64 24 176.65.137.13, 35378, 7716 PALTEL-ASPALTELAutonomousSystemPS Germany 2->24 26 daisy.ubuntu.com 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Sample is packed with UPX 2->32 7 boatnet.arm.elf 2->7         started        9 xfce4-panel wrapper-2.0 2->9         started        11 xfce4-panel wrapper-2.0 2->11         started        13 7 other processes 2->13 signatures3 process4 process5 15 boatnet.arm.elf 7->15         started        18 boatnet.arm.elf 7->18         started        20 boatnet.arm.elf 7->20         started        22 wrapper-2.0 xfpm-power-backlight-helper 9->22         started        signatures6 34 Sample tries to kill multiple processes (SIGKILL) 15->34

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
boatnet.arm.elf29%VirustotalBrowse
boatnet.arm.elf33%ReversingLabsLinux.Backdoor.Mirai
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
daisy.ubuntu.com
162.213.35.24
truefalse
    high
    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.netboatnet.arm.elffalse
      high
      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPDomainCountryFlagASNASN NameMalicious
      176.65.137.13
      unknownGermany
      12975PALTEL-ASPALTELAutonomousSystemPSfalse
      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
      176.65.137.13boatnet.mips.elfGet hashmaliciousUnknownBrowse
        boatnet.x86.elfGet hashmaliciousUnknownBrowse
          boatnet.arm7.elfGet hashmaliciousUnknownBrowse
            boatnet.mpsl.elfGet hashmaliciousUnknownBrowse
              boatnet.ppc.elfGet hashmaliciousUnknownBrowse
                boatnet.sh4.elfGet hashmaliciousUnknownBrowse
                  boatnet.m68k.elfGet hashmaliciousUnknownBrowse
                    boatnet.spc.elfGet hashmaliciousUnknownBrowse
                      boatnet.spc.elfGet hashmaliciousUnknownBrowse
                        boatnet.spc.elfGet hashmaliciousUnknownBrowse
                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          daisy.ubuntu.comboatnet.x86.elfGet hashmaliciousUnknownBrowse
                          • 162.213.35.24
                          nemil.x86_64.elfGet hashmaliciousMiraiBrowse
                          • 162.213.35.25
                          boatnet.arm7.elfGet hashmaliciousUnknownBrowse
                          • 162.213.35.24
                          boatnet.mpsl.elfGet hashmaliciousUnknownBrowse
                          • 162.213.35.25
                          boatnet.arm6.elfGet hashmaliciousUnknownBrowse
                          • 162.213.35.25
                          boatnet.ppc.elfGet hashmaliciousUnknownBrowse
                          • 162.213.35.25
                          resgod.arc.elfGet hashmaliciousMiraiBrowse
                          • 162.213.35.24
                          nemil.arm6.elfGet hashmaliciousMiraiBrowse
                          • 162.213.35.25
                          nemil.mpsl.elfGet hashmaliciousMiraiBrowse
                          • 162.213.35.25
                          resgod.arm7.elfGet hashmaliciousMiraiBrowse
                          • 162.213.35.24
                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          PALTEL-ASPALTELAutonomousSystemPSboatnet.mips.elfGet hashmaliciousUnknownBrowse
                          • 176.65.137.13
                          boatnet.x86.elfGet hashmaliciousUnknownBrowse
                          • 176.65.137.13
                          boatnet.arm7.elfGet hashmaliciousUnknownBrowse
                          • 176.65.137.13
                          boatnet.mpsl.elfGet hashmaliciousUnknownBrowse
                          • 176.65.137.13
                          boatnet.ppc.elfGet hashmaliciousUnknownBrowse
                          • 176.65.137.13
                          boatnet.sh4.elfGet hashmaliciousUnknownBrowse
                          • 176.65.137.13
                          boatnet.m68k.elfGet hashmaliciousUnknownBrowse
                          • 176.65.137.13
                          boatnet.spc.elfGet hashmaliciousUnknownBrowse
                          • 176.65.137.13
                          resgod.mips.elfGet hashmaliciousMiraiBrowse
                          • 213.244.67.111
                          bongtak.arm5.elfGet hashmaliciousMirai, OkiruBrowse
                          • 176.65.144.96
                          No context
                          No context
                          No created / dropped files found
                          File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
                          Entropy (8bit):7.909499883671207
                          TrID:
                          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                          File name:boatnet.arm.elf
                          File size:21'096 bytes
                          MD5:d5320d8d3eed35b3c52f5ec43e7ddbde
                          SHA1:24b3e614ca156227f2275d1c36d5ad47e6a2fddb
                          SHA256:eaa5510ba45ece2445d830e866012f7ebb19901f11b405175fb290f56eb291cb
                          SHA512:b4ed448f9d4f3aa064d9b38f8a12953e76cdb5096ced13cfcf13caef7050f98bf71b6435fb7bfad57064eeaeb67a74fb8c22eba1e1e8e996d8d0d133d677b952
                          SSDEEP:384:0lSRHk3lYF2GDb9ylPItPSr1XL1j0JAhCHFZlu/hrNPWv8hymdGUop5hl:pMYF2G9ylQ5k71PYHFW/hrNe0s3UozT
                          TLSH:6192B02061D984A1D7F20C7AAFE9C7C737A702FCF1FD37261A540368AAC611A64B56C7
                          File Content Preview:.ELF...a..........(.........4...........4. ...(......................Q...Q...............:..........................Q.td..............................CvUPX!....................Q..........?.E.h;.}...^..........e....-./K?.6\wn.N......:.&.="..BSJ......U.^..y

                          ELF header

                          Class:ELF32
                          Data:2's complement, little endian
                          Version:1 (current)
                          Machine:ARM
                          Version Number:0x1
                          Type:EXEC (Executable file)
                          OS/ABI:ARM - ABI
                          ABI Version:0
                          Entry Point Address:0xbfd0
                          Flags:0x202
                          ELF Header Size:52
                          Program Header Offset:52
                          Program Header Size:32
                          Number of Program Headers:3
                          Section Header Offset:0
                          Section Header Size:40
                          Number of Section Headers:0
                          Header String Table Index:0
                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                          LOAD0x00x80000x80000x517f0x517f7.91420x5R E0x8000
                          LOAD0x3a1c0x1ba1c0x1ba1c0x00x00.00000x6RW 0x8000
                          GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                          TimestampSource PortDest PortSource IPDest IP
                          Apr 10, 2025 22:56:14.786837101 CEST353787716192.168.2.14176.65.137.13
                          Apr 10, 2025 22:56:14.984580994 CEST771635378176.65.137.13192.168.2.14
                          Apr 10, 2025 22:56:14.984658003 CEST353787716192.168.2.14176.65.137.13
                          Apr 10, 2025 22:56:14.987047911 CEST353787716192.168.2.14176.65.137.13
                          Apr 10, 2025 22:56:15.179003954 CEST771635378176.65.137.13192.168.2.14
                          Apr 10, 2025 22:56:15.179250002 CEST353787716192.168.2.14176.65.137.13
                          Apr 10, 2025 22:56:15.363852024 CEST771635378176.65.137.13192.168.2.14
                          Apr 10, 2025 22:56:20.337483883 CEST353787716192.168.2.14176.65.137.13
                          Apr 10, 2025 22:56:20.521967888 CEST771635378176.65.137.13192.168.2.14
                          Apr 10, 2025 22:56:20.523222923 CEST353787716192.168.2.14176.65.137.13
                          Apr 10, 2025 22:58:56.474685907 CEST4516053192.168.2.148.8.8.8
                          Apr 10, 2025 22:58:56.564857006 CEST53451608.8.8.8192.168.2.14
                          Apr 10, 2025 22:58:56.564934969 CEST4516053192.168.2.148.8.8.8
                          Apr 10, 2025 22:58:56.564984083 CEST4516053192.168.2.148.8.8.8
                          Apr 10, 2025 22:58:56.565035105 CEST4516053192.168.2.148.8.8.8
                          Apr 10, 2025 22:58:56.657193899 CEST53451608.8.8.8192.168.2.14
                          Apr 10, 2025 22:58:56.657263041 CEST53451608.8.8.8192.168.2.14
                          Apr 10, 2025 22:58:56.657279015 CEST53451608.8.8.8192.168.2.14
                          Apr 10, 2025 22:58:56.657293081 CEST53451608.8.8.8192.168.2.14
                          Apr 10, 2025 22:58:56.657612085 CEST4516053192.168.2.148.8.8.8
                          Apr 10, 2025 22:58:56.657643080 CEST4516053192.168.2.148.8.8.8
                          Apr 10, 2025 22:58:59.178469896 CEST53451608.8.8.8192.168.2.14
                          Apr 10, 2025 22:58:59.183809042 CEST4516053192.168.2.148.8.8.8
                          Apr 10, 2025 22:58:59.282550097 CEST53451608.8.8.8192.168.2.14
                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                          Apr 10, 2025 22:58:56.564984083 CEST192.168.2.148.8.8.80x5db7Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                          Apr 10, 2025 22:58:56.565035105 CEST192.168.2.148.8.8.80x9451Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                          Apr 10, 2025 22:58:56.657279015 CEST8.8.8.8192.168.2.140x5db7No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                          Apr 10, 2025 22:58:56.657279015 CEST8.8.8.8192.168.2.140x5db7No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                          System Behavior

                          Start time (UTC):20:56:12
                          Start date (UTC):10/04/2025
                          Path:/tmp/boatnet.arm.elf
                          Arguments:/tmp/boatnet.arm.elf
                          File size:4956856 bytes
                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                          Start time (UTC):20:56:13
                          Start date (UTC):10/04/2025
                          Path:/tmp/boatnet.arm.elf
                          Arguments:-
                          File size:4956856 bytes
                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                          Start time (UTC):20:56:13
                          Start date (UTC):10/04/2025
                          Path:/tmp/boatnet.arm.elf
                          Arguments:-
                          File size:4956856 bytes
                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                          Start time (UTC):20:56:13
                          Start date (UTC):10/04/2025
                          Path:/tmp/boatnet.arm.elf
                          Arguments:-
                          File size:4956856 bytes
                          MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                          Start time (UTC):20:56:18
                          Start date (UTC):10/04/2025
                          Path:/usr/bin/xfce4-panel
                          Arguments:-
                          File size:375768 bytes
                          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                          Start time (UTC):20:56:18
                          Start date (UTC):10/04/2025
                          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
                          File size:35136 bytes
                          MD5 hash:ac0b8a906f359a8ae102244738682e76

                          Start time (UTC):20:56:18
                          Start date (UTC):10/04/2025
                          Path:/usr/bin/xfce4-panel
                          Arguments:-
                          File size:375768 bytes
                          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                          Start time (UTC):20:56:18
                          Start date (UTC):10/04/2025
                          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
                          File size:35136 bytes
                          MD5 hash:ac0b8a906f359a8ae102244738682e76

                          Start time (UTC):20:56:18
                          Start date (UTC):10/04/2025
                          Path:/usr/bin/xfce4-panel
                          Arguments:-
                          File size:375768 bytes
                          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                          Start time (UTC):20:56:18
                          Start date (UTC):10/04/2025
                          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
                          File size:35136 bytes
                          MD5 hash:ac0b8a906f359a8ae102244738682e76

                          Start time (UTC):20:56:26
                          Start date (UTC):10/04/2025
                          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                          Arguments:-
                          File size:35136 bytes
                          MD5 hash:ac0b8a906f359a8ae102244738682e76

                          Start time (UTC):20:56:26
                          Start date (UTC):10/04/2025
                          Path:/usr/sbin/xfpm-power-backlight-helper
                          Arguments:/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
                          File size:14656 bytes
                          MD5 hash:3d221ad23f28ca3259f599b1664e2427

                          Start time (UTC):20:56:18
                          Start date (UTC):10/04/2025
                          Path:/usr/bin/xfce4-panel
                          Arguments:-
                          File size:375768 bytes
                          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                          Start time (UTC):20:56:18
                          Start date (UTC):10/04/2025
                          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
                          File size:35136 bytes
                          MD5 hash:ac0b8a906f359a8ae102244738682e76

                          Start time (UTC):20:56:19
                          Start date (UTC):10/04/2025
                          Path:/usr/bin/xfce4-panel
                          Arguments:-
                          File size:375768 bytes
                          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                          Start time (UTC):20:56:19
                          Start date (UTC):10/04/2025
                          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
                          File size:35136 bytes
                          MD5 hash:ac0b8a906f359a8ae102244738682e76

                          Start time (UTC):20:56:19
                          Start date (UTC):10/04/2025
                          Path:/usr/bin/xfce4-panel
                          Arguments:-
                          File size:375768 bytes
                          MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                          Start time (UTC):20:56:19
                          Start date (UTC):10/04/2025
                          Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
                          File size:35136 bytes
                          MD5 hash:ac0b8a906f359a8ae102244738682e76

                          Start time (UTC):20:56:26
                          Start date (UTC):10/04/2025
                          Path:/usr/bin/dbus-daemon
                          Arguments:-
                          File size:249032 bytes
                          MD5 hash:3089d47e3f3ab84cd81c48fd406d7a8c

                          Start time (UTC):20:56:26
                          Start date (UTC):10/04/2025
                          Path:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                          File size:112880 bytes
                          MD5 hash:4c7a0d6d258bb970905b19b84abcd8e9

                          Start time (UTC):20:56:31
                          Start date (UTC):10/04/2025
                          Path:/usr/lib/systemd/systemd
                          Arguments:-
                          File size:1620224 bytes
                          MD5 hash:9b2bec7092a40488108543f9334aab75

                          Start time (UTC):20:56:31
                          Start date (UTC):10/04/2025
                          Path:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
                          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
                          File size:112872 bytes
                          MD5 hash:eee956f1b227c1d5031f9c61223255d1

                          Start time (UTC):20:56:34
                          Start date (UTC):10/04/2025
                          Path:/usr/bin/dbus-daemon
                          Arguments:-
                          File size:249032 bytes
                          MD5 hash:3089d47e3f3ab84cd81c48fd406d7a8c

                          Start time (UTC):20:56:34
                          Start date (UTC):10/04/2025
                          Path:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                          Arguments:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                          File size:112880 bytes
                          MD5 hash:4c7a0d6d258bb970905b19b84abcd8e9