Edit tour

Linux Analysis Report
miraint.arm.elf

Overview

General Information

Sample name:	miraint.arm.elf
Analysis ID:	1729400
Has dependencies:	false
MD5:	0da5f1c9a2c878ada6360760d4139cce
SHA1:	c93ce8ee0f92908d761dc1f5bf28f5802d1ddb5f
SHA256:	ec9bcd805d1327f41ca828c500edb0446346a38b36b00e04ed9a90553d1fa991
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	96
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Reads CPU information from /sys indicative of miner or evasive malware

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1729400
Start date and time:	2025-07-06 07:56:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	miraint.arm.elf
Detection:	MAL
Classification:	mal96.spre.troj.evad.linELF@0/4@0/0

Runtime Messages

Command:	/tmp/miraint.arm.elf
PID:	5529
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	listening tun0
Standard Error:

Process Tree

system is lnxubuntu20

miraint.arm.elf (PID: 5529, Parent: 5447, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/miraint.arm.elf

miraint.arm.elf New Fork (PID: 5531, Parent: 5529)

miraint.arm.elf New Fork (PID: 5533, Parent: 5531)

gnome-session-binary New Fork (PID: 5572, Parent: 1498)

sh (PID: 5572, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

gnome-shell (PID: 5572, Parent: 1498, MD5: da7a257239677622fe4b3a65972c9e87) Arguments: /usr/bin/gnome-shell

gnome-shell New Fork (PID: 5745, Parent: 5572)

ibus-daemon (PID: 5745, Parent: 5572, MD5: 1e00fb9860b198c73f6e364e3ff16f31) Arguments: ibus-daemon --panel disable --xim

ibus-daemon New Fork (PID: 5750, Parent: 5745)

ibus-memconf (PID: 5750, Parent: 5745, MD5: 523e939905910d06598e66385761a822) Arguments: /usr/libexec/ibus-memconf

ibus-daemon New Fork (PID: 5752, Parent: 5745)

ibus-daemon New Fork (PID: 5753, Parent: 5752)

ibus-x11 (PID: 5753, Parent: 1, MD5: 2aa1e54666191243814c2733d6992dbd) Arguments: /usr/libexec/ibus-x11 --kill-daemon

ibus-daemon New Fork (PID: 5900, Parent: 5745)

ibus-engine-simple (PID: 5900, Parent: 5745, MD5: 0238866d5e8802a0ce1b1b9af8cb1376) Arguments: /usr/libexec/ibus-engine-simple

systemd New Fork (PID: 5597, Parent: 1)

systemd-localed (PID: 5597, Parent: 1, MD5: 1244af9646256d49594f2a8203329aa9) Arguments: /lib/systemd/systemd-localed

dbus-daemon New Fork (PID: 5755, Parent: 5754)

ibus-portal (PID: 5755, Parent: 5754, MD5: 562ad55bd9a4d54bd7b76746b01e37d3) Arguments: /usr/libexec/ibus-portal

Xorg New Fork (PID: 5763, Parent: 1486)

sh (PID: 5763, Parent: 1486, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""

sh New Fork (PID: 5764, Parent: 5763)

xkbcomp (PID: 5764, Parent: 5763, MD5: c5f953aec4c00d2a1cc27acb75d62c9b) Arguments: /usr/bin/xkbcomp -w 1 -R/usr/share/X11/xkb -xkm - -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" /tmp/server-0.xkm

systemd New Fork (PID: 5765, Parent: 1)

accounts-daemon (PID: 5765, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 5769, Parent: 5765)

language-validate (PID: 5769, Parent: 5765, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 5770, Parent: 5769)

language-options (PID: 5770, Parent: 5769, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 5771, Parent: 5770)

sh (PID: 5771, Parent: 5770, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 5772, Parent: 5771)

locale (PID: 5772, Parent: 5771, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 5773, Parent: 5771)

grep (PID: 5773, Parent: 5771, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 5774, Parent: 1)

geoclue (PID: 5774, Parent: 1, MD5: 30ac5455f3c598dde91dc87477fb19f7) Arguments: /usr/libexec/geoclue

dbus-daemon New Fork (PID: 5885, Parent: 5884)

gjs (PID: 5885, Parent: 5884, MD5: 5f3eceb792bb65c22f23d1efb4fde3ad) Arguments: /usr/bin/gjs /usr/share/gnome-shell/org.gnome.Shell.Notifications

systemd New Fork (PID: 5911, Parent: 1)

fprintd (PID: 5911, Parent: 1, MD5: b0d8829f05cd028529b84b061b660e84) Arguments: /usr/libexec/fprintd

gnome-session-binary New Fork (PID: 6038, Parent: 1498)

sh (PID: 6038, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6038, Parent: 1498, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

systemd New Fork (PID: 6047, Parent: 1)

systemd-hostnamed (PID: 6047, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

xfce4-session New Fork (PID: 6219, Parent: 3074)

xfwm4 (PID: 6219, Parent: 3074, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 25b39293a-fee6-4e14-94fe-6ac0d9644afd

xfce4-session New Fork (PID: 6222, Parent: 3074)

xfce4-panel (PID: 6222, Parent: 3074, MD5: a15b657c7d54ac1385f1f15004ea6784) Arguments: xfce4-panel --display :1.0 --sm-client-id 2231df6a5-9489-4681-813c-95be59ba41ad

xfce4-panel New Fork (PID: 6258, Parent: 6222)

wrapper-2.0 (PID: 6258, Parent: 6222, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6259, Parent: 6222)

wrapper-2.0 (PID: 6259, Parent: 6222, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6260, Parent: 6222)

wrapper-2.0 (PID: 6260, Parent: 6222, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6261, Parent: 6222)

wrapper-2.0 (PID: 6261, Parent: 6222, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 6290, Parent: 6261)

xfpm-power-backlight-helper (PID: 6290, Parent: 6261, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6262, Parent: 6222)

wrapper-2.0 (PID: 6262, Parent: 6222, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6267, Parent: 6222)

wrapper-2.0 (PID: 6267, Parent: 6222, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

xfce4-session New Fork (PID: 6226, Parent: 3074)

xfdesktop (PID: 6226, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

xfce4-session New Fork (PID: 6263, Parent: 3074)

xfwm4 (PID: 6263, Parent: 3074, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 25b39293a-fee6-4e14-94fe-6ac0d9644afd

xfce4-session New Fork (PID: 6287, Parent: 3074)

xfwm4 (PID: 6287, Parent: 3074, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 25b39293a-fee6-4e14-94fe-6ac0d9644afd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
miraint.arm.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
miraint.arm.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
miraint.arm.elf	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xd134:$x1: POST /cdn-cgi/ 0xd1fc:$x2: /dev/misc/watchdog 0xd1ec:$x3: /dev/watchdog 0xd3ec:$s1: LCOGQGPTGP 0xd270:$s6: NKQVGLKLE
miraint.arm.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0xd134:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A

Memory Dumps

Source	Rule	Description	Author	Strings
5529.1.00007f22ec017000.00007f22ec025000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5529.1.00007f22ec017000.00007f22ec025000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5529.1.00007f22ec017000.00007f22ec025000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xd134:$x1: POST /cdn-cgi/ 0xd1fc:$x2: /dev/misc/watchdog 0xd1ec:$x3: /dev/watchdog 0xd3ec:$s1: LCOGQGPTGP 0xd270:$s6: NKQVGLKLE
5529.1.00007f22ec017000.00007f22ec025000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0xd134:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5529.1.00007f22ec02c000.00007f22ec02d000.rw-.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: miraint.arm.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: miraint.arm.elf	Virustotal: Detection: 57%			Perma Link
Source: miraint.arm.elf	ReversingLabs: Detection: 69%

Source: /usr/bin/gnome-shell (PID: 5572)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/miraint.arm.elf (PID: 5529)	Socket: 127.0.0.1:48101			Jump to behavior
Source: /usr/bin/ibus-daemon (PID: 5745)	Socket: unknown address family			Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24
Source: unknown	TCP traffic detected without corresponding DNS query: 207.167.64.24

System Summary

Malicious sample detected (through community Yara rule)

Source: miraint.arm.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: miraint.arm.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5529.1.00007f22ec017000.00007f22ec025000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5529.1.00007f22ec017000.00007f22ec025000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 1486, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 1553, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 1617, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 1692, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 3052, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 3064, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 3222, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 3235, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 3246, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 3275, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 1486, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 1553, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 1617, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 1692, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 3052, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 3064, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 3222, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 3235, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 3246, result: successful	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	SIGKILL sent: pid: 3275, result: successful	Jump to behavior

Source: miraint.arm.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: miraint.arm.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5529.1.00007f22ec017000.00007f22ec025000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5529.1.00007f22ec017000.00007f22ec025000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: classification engine

Classification label: mal96.spre.troj.evad.linELF@0/4@0/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/gnome-shell (PID: 5572)	File: /proc/5572/mounts			Jump to behavior
Source: /usr/bin/gjs (PID: 5885)	File: /proc/5885/mounts			Jump to behavior

Source: /usr/bin/gnome-shell (PID: 5572)	Directory: /var/lib/gdm3/.drirc	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5572)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5572)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 5753)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 5753)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5765)	Directory: /root/.cache	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /usr/share/locale/en_US.UTF-8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /usr/share/locale/en_US.utf8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /usr/share/locale/en_US/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /usr/share/locale/en.UTF-8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /usr/share/locale/en.utf8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /usr/share/locale/en/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /usr/share/locale-langpack/en_US/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /usr/share/locale-langpack/en.utf8/LC_MESSAGES/.mo	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Directory: /usr/share/locale-langpack/en/LC_MESSAGES/.mo	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6047)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /home/saturnino/.drirc	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6258)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6259)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6260)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6261)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6262)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6262)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6262)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6262)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6267)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6226)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6226)	Directory: /home/saturnino/.hidden	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6226)	Directory: /.hidden	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6226)	Directory: /home/.hidden	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6226)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6226)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6226)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6287)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6287)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6287)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6287)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior

Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1185/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3241/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1732/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1333/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1695/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3235/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3234/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/911/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/515/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/914/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1617/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1615/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/917/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3255/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3253/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1591/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3252/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3251/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3250/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1623/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1588/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3249/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/764/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3368/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1585/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3246/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/766/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/800/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/888/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/802/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1509/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/803/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/804/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1867/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3407/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1484/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/490/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1514/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1634/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1479/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1875/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/654/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3379/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/655/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/656/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/777/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/931/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1595/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/657/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/812/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/779/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/658/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/933/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/418/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/418/exe	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/419/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/419/exe	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3419/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3310/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3275/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3274/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3273/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3394/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3272/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/782/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3303/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1762/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3027/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1486/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/789/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1806/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1660/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3044/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/793/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/794/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3316/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/674/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/675/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/796/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/676/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1498/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1497/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1496/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3157/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3278/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3399/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1659/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3332/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3210/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3298/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3052/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/680/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/681/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3292/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1701/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1666/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3205/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3047/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3201/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/723/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/724/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1704/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1669/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/3060/maps	Jump to behavior
Source: /tmp/miraint.arm.elf (PID: 5533)	File opened: /proc/1440/maps	Jump to behavior

Source: /usr/lib/xorg/Xorg (PID: 5763)	Shell command executed: sh -c "\"/usr/bin/xkbcomp\" -w 1 \"-R/usr/share/X11/xkb\" -xkm \"-\" -em1 \"The XKEYBOARD keymap compiler (xkbcomp) reports:\" -emp \"> \" -eml \"Errors from xkbcomp are not fatal to the X server\" \"/tmp/server-0.xkm\""			Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 5771)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "			Jump to behavior

Source: /bin/sh (PID: 5773)

Grep executable: /usr/bin/grep -> grep -F .utf8

Jump to behavior

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5765)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 5765)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/miraint.arm.elf (PID: 5529)

File: /tmp/miraint.arm.elf

Jump to behavior

Source: /usr/bin/gnome-shell (PID: 5572)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/miraint.arm.elf (PID: 5529)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gnome-shell (PID: 5572)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/ibus-x11 (PID: 5753)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/fprintd (PID: 5911)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 6038)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6047)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6219)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 6222)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6258)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6259)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6260)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6261)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6262)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6267)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 6226)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6263)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 6287)	Queries kernel information via 'uname':	Jump to behavior

Source: miraint.arm.elf, 5529.1.00007ffe3f2a9000.00007ffe3f2ca000.rw-.sdmp	Binary or memory string: Zx86_64/usr/bin/qemu-arm/tmp/miraint.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/miraint.arm.elf
Source: miraint.arm.elf, 5529.1.0000556f89041000.0000556f8916f000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: miraint.arm.elf, 5529.1.00007ffe3f2a9000.00007ffe3f2ca000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: miraint.arm.elf, 5529.1.0000556f89041000.0000556f8916f000.rw-.sdmp	Binary or memory string: oU!/etc/qemu-binfmt/arm

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 5765)

Logged in records file read: /var/log/wtmp

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: miraint.arm.elf, type: SAMPLE
Source: Yara match	File source: 5529.1.00007f22ec017000.00007f22ec025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5529.1.00007f22ec02c000.00007f22ec02d000.rw-.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: miraint.arm.elf, type: SAMPLE
Source: Yara match	File source: 5529.1.00007f22ec017000.00007f22ec025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5529.1.00007f22ec02c000.00007f22ec02d000.rw-.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
miraint.arm.elf	58%	Virustotal		Browse
miraint.arm.elf	69%	ReversingLabs	Linux.Worm.Mirai
miraint.arm.elf	100%	Avira	LINUX/Mirai.bonb

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
207.167.64.24	unknown	Reserved		7837	UNASSIGNED	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
207.167.64.24	miraint.ppc440.elf	Get hash	malicious	Mirai	Browse
	miraint.mips.elf	Get hash	malicious	Mirai	Browse
	miraint.arm6.elf	Get hash	malicious	Mirai	Browse
	miraint.sh4.elf	Get hash	malicious	Mirai	Browse
	miraint.x86.elf	Get hash	malicious	Mirai	Browse
	miraint.i686.elf	Get hash	malicious	Mirai	Browse
	miraint.m68k.elf	Get hash	malicious	Mirai	Browse
	miraint.spc.elf	Get hash	malicious	Mirai	Browse
	miraint.arm7.elf	Get hash	malicious	Mirai	Browse
	miraint.mpsl.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNASSIGNED	https://workstationteam.zoholandingpage.com/proservedasri.com/?FA7658923%E2%80%9107%E2%80%912025.xls	Get hash	malicious	Unknown	Browse	199.67.84.72
	https://link.edgepilot.com/s/4f329cc8/7u6er1vNgUiUhze8mMdKiw?u=https://forms.office.com/e/AV2WV8aDuq?origin=lprLink	Get hash	malicious	Unknown	Browse	199.67.84.72
	https://link.edgepilot.com/s/ba114da0/ncfBAU2fKESRW5ciSGiHJA?u=https://forms.office.com/e/DyxB5QirkT?origin%3DlprLink	Get hash	malicious	Unknown	Browse	199.67.84.72
	i686.elf	Get hash	malicious	Mirai	Browse	157.225.246.152
	m68k.elf	Get hash	malicious	Mirai	Browse	156.134.188.76
	https://mibc-fr-09.mailinblack.com/securelink/?url=https:**Aforms.office.com&key=eyJsYW5nIjoiRlIiLCJ1cmwiOiJodHRwczovL2Zvcm1zLm9mZmljZS5jb20vZS9YQmJzeHdiUkw3P29yaWdpbj1scHJMaW5rIiwidG9rZW4iOiJnQUFBQUFCb1pWSWFnN3R0a1dyTlR3TWhoSzJKSWFMM01XREZBeVp3V0lzT0QtWVNYM2xGc0tYX3M0cHdSWloxR1Q4SXFhUmkyY0hNeWQ0NmVHYWxQSjZxR2FCcC0zWU9aZVhSTTRqMjFTTVMtVlNpVk00MFA1OWNZWTVXY0RxeGUwcmR5VzNtMGhNRWpPcHMteDJjemF1R1ZSTFZaVTNkQzBPUlFFSm9iQlRHaUpjdjdmbkh2YWpXVHBrTlJyZUFINTBRZFJHX0x3VkRkaTBVOEVZZDZucE42R0wxY1VWZnMyUnJtWDltWVRkNXNrR25uOVVFRjlBYXpWUG1vcTRmMHBHZE9hVWdYbVZOU1RRSnF4U3c0SzQ0d3lOanVCV0JPbURzZk1LdFBDZnJVUTFIemlqWFZlc3lvOU9RLVdKNFJQRlRRQncwbVNRWiJ9	Get hash	malicious	Unknown	Browse	199.67.84.72
	https://tcjbpd-cmpzourl.maillist-manage.com/click/11259935e94618217/11259935e945e7722	Get hash	malicious	Unknown	Browse	199.67.84.76
	miraint.ppc440.elf	Get hash	malicious	Mirai	Browse	207.167.64.24
	miraint.mips.elf	Get hash	malicious	Mirai	Browse	207.167.64.24
	miraint.arm6.elf	Get hash	malicious	Mirai	Browse	207.167.64.24

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-media-keys
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.

/tmp/server-0.xkm

Download File

Process:	/usr/bin/xkbcomp
File Type:	Compiled XKB Keymap: lsb, version 15
Category:	dropped
Size (bytes):	12060
Entropy (8bit):	4.8492493153178975
Encrypted:	false
SSDEEP:	192:tDyb2zOmnECQmwTVFfLaSLus4UVcqLkjoqdD//HJeCQ1+JdDx0s2T:tDyAxvYhFf+S6tUzmp7/1MJ
MD5:	B4E3EB0B8B6B0FC1F46740C573E18D86
SHA1:	7D35426357695EBA77850757E8939A62DCEFF2D1
SHA-256:	7951135CC89A6E89493E3A9997C3D9054439459F8BFCE3DDEC76B943DA79FA91
SHA-512:	8196A23E2B5E525A5581562A2D7F2EE4FF5B694FEF3E218206D52EA9BFE80600BB0C6AA8968CA58E93E1AAD478FA05E157D08DB6D4D1224DDEA6754E377BE001
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.mkx..............D.......................h.......<.....P.@%.......&......D.......NumLock.....Alt.....LevelThree..LAlt....RAlt....RControl....LControl....ScrollLock..LevelFive...AltGr...Meta....Super...Hyper...........evdev+aliases(qwerty)...!.....ESC.AE01AE02AE03AE04AE05AE06AE07AE08AE09AE10AE11AE12BKSPTAB.AD01AD02AD03AD04AD05AD06AD07AD08AD09AD10AD11AD12RTRNLCTLAC01AC02AC03AC04AC05AC06AC07AC08AC09AC10AC11TLDELFSHBKSLAB01AB02AB03AB04AB05AB06AB07AB08AB09AB10RTSHKPMULALTSPCECAPSFK01FK02FK03FK04FK05FK06FK07FK08FK09FK10NMLKSCLKKP7.KP8.KP9.KPSUKP4.KP5.KP6.KPADKP1.KP2.KP3.KP0.KPDLLVL3....LSGTFK11FK12AB11KATAHIRAHENKHKTGMUHEJPCMKPENRCTLKPDVPRSCRALTLNFDHOMEUP..PGUPLEFTRGHTEND.DOWNPGDNINS.DELEI120MUTEVOL-VOL+POWRKPEQI126PAUSI128I129HNGLHJCVAE13LWINRWINCOMPSTOPAGAIPROPUNDOFRNTCOPYOPENPASTFINDCUT.HELPI147I148I149I150I151I152I153I154I155I156I157I158I159I160I161I162I163I164I165I166I167I168I169I170I171I172I173I174I175I176I177I178I179I180I181I182I183I184I185I186I187I188I189I190FK13FK14FK15FK16FK17FK18

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Download File

Process:	/usr/bin/ibus-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.146492002832665
Encrypted:	false
SSDEEP:	6:SbF4b2sONeZVkSoQ65EfqFFAU+qmnQT23msRvkTFacecf8h/zKLGWWSrV2wA19on:q5sU3LWfLUDmQymqSFbfomS621fon
MD5:	D207E44A7676DCEF9428623D88EC9484
SHA1:	215FB1F765B938F3691D3AE70DE83A193074E977
SHA-256:	D4EC2D1145BE7035EC09044F3059A7214AAAA92CC3EC6EA770B4393198F7268C
SHA-512:	122C6B1E185B4C37B5430FD1DCB233357B0959A067EB676A422A6E3C31F8204D23A0A66E878605758BCE5A7DA7CF8F503EF6C2BFCA535C2173FD2DCFA33AE226
Malicious:	false
Reputation:	low
Preview:	# This file is created by ibus-daemon, please do not modify it..# This file allows processes on the machine to find the.# ibus session bus with the below address..# If the IBUS_ADDRESS environment variable is set, it will.# be used rather than this file..IBUS_ADDRESS=unix:abstract=/var/lib/gdm3/.cache/ibus/dbus-qV5NptpT,guid=51173e3cbd7085e76a60d654686a1071.IBUS_DAEMON_PID=5745.

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.033031846439679
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	miraint.arm.elf
File size:	56'832 bytes
MD5:	0da5f1c9a2c878ada6360760d4139cce
SHA1:	c93ce8ee0f92908d761dc1f5bf28f5802d1ddb5f
SHA256:	ec9bcd805d1327f41ca828c500edb0446346a38b36b00e04ed9a90553d1fa991
SHA512:	e3981449eda64883b1c69184501dc6e050550c19471000d332947facefc4f65e4b70fa0d809a62ee5cdd97947331b38c48c5e46def63b412db8df4a572d07076
SSDEEP:	768:8oWbQjL6oZMf1SOqWxMDSlzcRhatOoqluy337pARFuzQUoQ+ji9EWmNRqhqeLnE:mbQjL1ZMdSO/KSNyaHuDH7pA/XJGas
TLSH:	2F432986BC91C913CAD413B6FA5E51CD372223E8E2EE32079D211F51779A86F0D77682
File Content Preview:	.ELF...a..........(.........4...p.......4. ...(.....................................................\|...............Q.td..................................-...L."....4..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	56432
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0xd070	0x0	0x6	AX	16
.fini	PROGBITS	0x15120	0xd120	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x15134	0xd134	0x97c	0x0	0x2	A	4
.ctors	PROGBITS	0x1dab4	0xdab4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1dabc	0xdabc	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x1dac8	0xdac8	0x168	0x0	0x3	WA	4
.bss	NOBITS	0x1dc30	0xdc30	0x320	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xdc30	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0xdab0	0xdab0	6.0650	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0xdab4	0x1dab4	0x1dab4	0x17c	0x49c	0.8443	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 6, 2025 07:57:07.106389999 CEST	58286	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:07.227936983 CEST	23	58286	207.167.64.24	192.168.2.15
Jul 6, 2025 07:57:07.228018045 CEST	58286	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:07.228538036 CEST	58286	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:07.228877068 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:07.350064039 CEST	23	58286	207.167.64.24	192.168.2.15
Jul 6, 2025 07:57:07.350167990 CEST	58286	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:07.350330114 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:57:07.350403070 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:07.351558924 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:07.472973108 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:57:07.473035097 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:07.595160961 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:57:07.595490932 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:57:07.595503092 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:57:07.595511913 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:57:07.595524073 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:57:07.595551968 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:07.595551968 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:07.595551968 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:07.595557928 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:57:07.595572948 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:07.595587015 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:17.607570887 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:17.729270935 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:57:17.729348898 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:33.205451012 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:57:33.205646992 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:57:48.564491034 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:57:48.564734936 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:58:03.928802013 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:58:03.929215908 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:58:17.766911030 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:58:17.891884089 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:58:17.891930103 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:58:33.110085011 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:58:33.110188007 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:58:48.472120047 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:58:48.472173929 CEST	58288	23	192.168.2.15	207.167.64.24
Jul 6, 2025 07:59:03.831031084 CEST	23	58288	207.167.64.24	192.168.2.15
Jul 6, 2025 07:59:03.831093073 CEST	58288	23	192.168.2.15	207.167.64.24

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report miraint.arm.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/user/127/dconf/user

/tmp/server-0.xkm

/var/lib/gdm3/.config/ibus/bus/ee49dfd4fa47433baee88884e2d7de7c-unix-0

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Linux Analysis Report
miraint.arm.elf