Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Linux Analysis Report phantom.x86

Overview

General Information

Sample Name:phantom.x86
Analysis ID:553477
MD5:8bb140fe0754eee2498279f9f1830368
SHA1:0146917808c967dd97899cd5259de170b67af87b
SHA256:217a622a111c0d13237c660259617cb1e31943d74a1767a933ddee8ae0b445ac
Tags:Mirai
Infos:

Detection

Mirai
Score:72
Range:0 - 100
Whitelisted:false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
Deletes log files
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "systemctl" command used for controlling the systemd system and service manager
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:553477
Start date:15.01.2022
Start time:00:34:59
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 6m 44s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:phantom.x86
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal72.troj.evad.linX86@0/53@0/0
Warnings:
Show All
  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Process Tree

  • system is lnxubuntu20
  • systemd New Fork (PID: 5192, Parent: 1)
  • logrotate (PID: 5192, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf
    • gzip (PID: 5233, Parent: 5192, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip
    • sh (PID: 5236, Parent: 5192, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
      • sh New Fork (PID: 5237, Parent: 5236)
      • invoke-rc.d (PID: 5237, Parent: 5236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart
        • runlevel (PID: 5238, Parent: 5237, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel
        • systemctl (PID: 5239, Parent: 5237, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service
        • ls (PID: 5242, Parent: 5237, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups
        • systemctl (PID: 5243, Parent: 5237, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service
    • gzip (PID: 5244, Parent: 5192, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip
    • sh (PID: 5245, Parent: 5192, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
      • sh New Fork (PID: 5246, Parent: 5245)
      • rsyslog-rotate (PID: 5246, Parent: 5245, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate
        • systemctl (PID: 5247, Parent: 5246, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service
  • systemd New Fork (PID: 5193, Parent: 1)
  • install (PID: 5193, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man
  • systemd New Fork (PID: 5232, Parent: 1)
  • find (PID: 5232, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete
  • systemd New Fork (PID: 5240, Parent: 1)
  • mandb (PID: 5240, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet
  • cleanup

Yara Overview

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

    Jbx Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Multi AV Scanner detection for submitted fileShow sources
    Source: phantom.x86Virustotal: Detection: 37%Perma Link
    Source: phantom.x86ReversingLabs: Detection: 51%

    Networking:

    barindex
    Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 220.182.10.28:23 -> 192.168.2.23:33648
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 60.168.155.103:23 -> 192.168.2.23:36286
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 60.168.155.103:23 -> 192.168.2.23:36286
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 220.182.10.28:23 -> 192.168.2.23:33704
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 60.168.155.103:23 -> 192.168.2.23:36312
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 60.168.155.103:23 -> 192.168.2.23:36312
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 220.182.10.28:23 -> 192.168.2.23:33722
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 58.58.179.87:23 -> 192.168.2.23:41818
    Source: TrafficSnort IDS: 716 INFO TELNET access 81.28.168.138:23 -> 192.168.2.23:41548
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 60.168.155.103:23 -> 192.168.2.23:36410
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 60.168.155.103:23 -> 192.168.2.23:36410
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 58.58.179.87:23 -> 192.168.2.23:41848
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 220.182.10.28:23 -> 192.168.2.23:33818
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 58.58.179.87:23 -> 192.168.2.23:41912
    Source: TrafficSnort IDS: 716 INFO TELNET access 106.247.163.186:23 -> 192.168.2.23:60834
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 220.182.10.28:23 -> 192.168.2.23:33874
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 60.168.155.103:23 -> 192.168.2.23:36490
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 60.168.155.103:23 -> 192.168.2.23:36490
    Source: TrafficSnort IDS: 716 INFO TELNET access 167.88.133.103:23 -> 192.168.2.23:59728
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 58.58.179.87:23 -> 192.168.2.23:41986
    Source: TrafficSnort IDS: 716 INFO TELNET access 167.88.133.103:23 -> 192.168.2.23:59740
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 220.182.10.28:23 -> 192.168.2.23:33934
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 58.58.179.87:23 -> 192.168.2.23:42002
    Source: TrafficSnort IDS: 716 INFO TELNET access 167.88.133.103:23 -> 192.168.2.23:59758
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 60.168.155.103:23 -> 192.168.2.23:36572
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 60.168.155.103:23 -> 192.168.2.23:36572
    Source: TrafficSnort IDS: 716 INFO TELNET access 167.88.133.103:23 -> 192.168.2.23:59764
    Source: TrafficSnort IDS: 716 INFO TELNET access 81.28.168.138:23 -> 192.168.2.23:41728
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 220.182.10.28:23 -> 192.168.2.23:33962
    Source: TrafficSnort IDS: 716 INFO TELNET access 167.88.133.103:23 -> 192.168.2.23:59780
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 58.58.179.87:23 -> 192.168.2.23:42024
    Source: TrafficSnort IDS: 716 INFO TELNET access 167.88.133.103:23 -> 192.168.2.23:59790
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 60.168.155.103:23 -> 192.168.2.23:36616
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 60.168.155.103:23 -> 192.168.2.23:36616
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 109.122.227.186:23 -> 192.168.2.23:33372
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 109.122.227.186:23 -> 192.168.2.23:33372
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 58.58.179.87:23 -> 192.168.2.23:42044
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 220.182.10.28:23 -> 192.168.2.23:33994
    Source: TrafficSnort IDS: 716 INFO TELNET access 167.88.133.103:23 -> 192.168.2.23:59804
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 216.67.33.87:23 -> 192.168.2.23:59238
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 216.67.33.87:23 -> 192.168.2.23:59238
    Source: TrafficSnort IDS: 716 INFO TELNET access 106.247.163.186:23 -> 192.168.2.23:60976
    Source: TrafficSnort IDS: 716 INFO TELNET access 167.88.133.103:23 -> 192.168.2.23:59826
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 58.58.179.87:23 -> 192.168.2.23:42076
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 220.182.10.28:23 -> 192.168.2.23:34022
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 58.58.179.87:23 -> 192.168.2.23:42090
    Source: TrafficSnort IDS: 716 INFO TELNET access 167.88.133.103:23 -> 192.168.2.23:59844
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 109.122.227.186:23 -> 192.168.2.23:33436
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 109.122.227.186:23 -> 192.168.2.23:33436
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 60.168.155.103:23 -> 192.168.2.23:36662
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 60.168.155.103:23 -> 192.168.2.23:36662
    Source: TrafficSnort IDS: 716 INFO TELNET access 167.88.133.103:23 -> 192.168.2.23:59864
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 220.182.10.28:23 -> 192.168.2.23:34068
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 58.58.179.87:23 -> 192.168.2.23:42130
    Source: TrafficSnort IDS: 716 INFO TELNET access 81.28.168.138:23 -> 192.168.2.23:41850
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 109.122.227.186:23 -> 192.168.2.23:33488
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 109.122.227.186:23 -> 192.168.2.23:33488
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 60.168.155.103:23 -> 192.168.2.23:36714
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 60.168.155.103:23 -> 192.168.2.23:36714
    Source: TrafficSnort IDS: 716 INFO TELNET access 200.148.130.171:23 -> 192.168.2.23:36328
    Source: TrafficSnort IDS: 716 INFO TELNET access 106.247.163.186:23 -> 192.168.2.23:32906
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 109.122.227.186:23 -> 192.168.2.23:33542
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 109.122.227.186:23 -> 192.168.2.23:33542
    Source: TrafficSnort IDS: 716 INFO TELNET access 41.159.150.5:23 -> 192.168.2.23:46088
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 60.168.155.103:23 -> 192.168.2.23:36774
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 60.168.155.103:23 -> 192.168.2.23:36774
    Source: TrafficSnort IDS: 716 INFO TELNET access 177.20.187.254:23 -> 192.168.2.23:46018
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 216.67.33.87:23 -> 192.168.2.23:59422
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 216.67.33.87:23 -> 192.168.2.23:59422
    Source: TrafficSnort IDS: 716 INFO TELNET access 177.20.187.254:23 -> 192.168.2.23:46046
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 109.122.227.186:23 -> 192.168.2.23:33614
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 109.122.227.186:23 -> 192.168.2.23:33614
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 60.168.155.103:23 -> 192.168.2.23:36852
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 60.168.155.103:23 -> 192.168.2.23:36852
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 59.10.149.168:23 -> 192.168.2.23:36846
    Source: TrafficSnort IDS: 716 INFO TELNET access 177.20.187.254:23 -> 192.168.2.23:46080
    Source: TrafficSnort IDS: 716 INFO TELNET access 81.28.168.138:23 -> 192.168.2.23:42032
    Source: TrafficSnort IDS: 716 INFO TELNET access 197.210.191.131:23 -> 192.168.2.23:36928
    Source: TrafficSnort IDS: 716 INFO TELNET access 177.20.187.254:23 -> 192.168.2.23:46118
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 109.122.227.186:23 -> 192.168.2.23:33700
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 109.122.227.186:23 -> 192.168.2.23:33700
    Source: TrafficSnort IDS: 716 INFO TELNET access 177.20.187.254:23 -> 192.168.2.23:46134
    Source: TrafficSnort IDS: 716 INFO TELNET access 200.148.130.171:23 -> 192.168.2.23:36512
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 187.144.43.161:23 -> 192.168.2.23:45308
    Source: TrafficSnort IDS: 2023448 ET TROJAN Possible Linux.Mirai Login Attempt (ubnt) 192.168.2.23:36954 -> 59.10.149.168:23
    Source: TrafficSnort IDS: 716 INFO TELNET access 177.20.187.254:23 -> 192.168.2.23:46146
    Source: TrafficSnort IDS: 716 INFO TELNET access 106.247.163.186:23 -> 192.168.2.23:33070
    Source: TrafficSnort IDS: 716 INFO TELNET access 177.20.187.254:23 -> 192.168.2.23:46162
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 59.10.149.168:23 -> 192.168.2.23:36954
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 109.122.227.186:23 -> 192.168.2.23:33732
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 109.122.227.186:23 -> 192.168.2.23:33732
    Source: TrafficSnort IDS: 716 INFO TELNET access 191.243.8.246:23 -> 192.168.2.23:54074
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 216.67.33.87:23 -> 192.168.2.23:59650
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 216.67.33.87:23 -> 192.168.2.23:59650
    Source: TrafficSnort IDS: 716 INFO TELNET access 223.241.109.216:23 -> 192.168.2.23:41810
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 109.122.227.186:23 -> 192.168.2.23:33824
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 109.122.227.186:23 -> 192.168.2.23:33824
    Source: TrafficSnort IDS: 716 INFO TELNET access 81.28.168.138:23 -> 192.168.2.23:42266
    Source: TrafficSnort IDS: 716 INFO TELNET access 197.210.191.131:23 -> 192.168.2.23:37156
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 81.82.240.55:23 -> 192.168.2.23:55340
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 81.82.240.55:23 -> 192.168.2.23:55340
    Source: TrafficSnort IDS: 2023448 ET TROJAN Possible Linux.Mirai Login Attempt (ubnt) 192.168.2.23:37128 -> 59.10.149.168:23
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 223.241.109.216:23 -> 192.168.2.23:41810
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 81.82.240.55:23 -> 192.168.2.23:55378
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 81.82.240.55:23 -> 192.168.2.23:55378
    Source: TrafficSnort IDS: 716 INFO TELNET access 223.241.109.216:23 -> 192.168.2.23:41886
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 79.127.103.72:23 -> 192.168.2.23:42702
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 79.127.103.72:23 -> 192.168.2.23:42702
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 72.71.147.108:23 -> 192.168.2.23:37168
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 72.71.147.108:23 -> 192.168.2.23:37168
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 59.10.149.168:23 -> 192.168.2.23:37128
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 81.82.240.55:23 -> 192.168.2.23:55432
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 81.82.240.55:23 -> 192.168.2.23:55432
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 223.241.109.216:23 -> 192.168.2.23:41886
    Source: TrafficSnort IDS: 716 INFO TELNET access 200.148.130.171:23 -> 192.168.2.23:36826
    Source: TrafficSnort IDS: 716 INFO TELNET access 223.241.109.216:23 -> 192.168.2.23:42030
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 81.82.240.55:23 -> 192.168.2.23:55500
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 81.82.240.55:23 -> 192.168.2.23:55500
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 109.122.227.186:23 -> 192.168.2.23:34020
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 109.122.227.186:23 -> 192.168.2.23:34020
    Source: TrafficSnort IDS: 716 INFO TELNET access 115.234.209.249:23 -> 192.168.2.23:41652
    Source: TrafficSnort IDS: 716 INFO TELNET access 115.234.209.249:23 -> 192.168.2.23:41668
    Source: TrafficSnort IDS: 716 INFO TELNET access 113.66.237.187:23 -> 192.168.2.23:49080
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 89.237.89.162:23 -> 192.168.2.23:53210
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 89.237.89.162:23 -> 192.168.2.23:53210
    Source: TrafficSnort IDS: 716 INFO TELNET access 115.234.209.249:23 -> 192.168.2.23:41680
    Source: TrafficSnort IDS: 716 INFO TELNET access 202.101.161.154:23 -> 192.168.2.23:44858
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 81.82.240.55:23 -> 192.168.2.23:55572
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 81.82.240.55:23 -> 192.168.2.23:55572
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 223.241.109.216:23 -> 192.168.2.23:42030
    Source: TrafficSnort IDS: 716 INFO TELNET access 115.234.209.249:23 -> 192.168.2.23:41706
    Source: TrafficSnort IDS: 716 INFO TELNET access 106.247.163.186:23 -> 192.168.2.23:33490
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 14.39.191.244:23 -> 192.168.2.23:39110
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 14.39.191.244:23 -> 192.168.2.23:39110
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 79.127.103.72:23 -> 192.168.2.23:42916
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 79.127.103.72:23 -> 192.168.2.23:42916
    Source: TrafficSnort IDS: 716 INFO TELNET access 115.234.209.249:23 -> 192.168.2.23:41748
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 113.66.237.187:23 -> 192.168.2.23:49080
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 113.66.237.187:23 -> 192.168.2.23:49080
    Source: TrafficSnort IDS: 716 INFO TELNET access 202.101.161.154:23 -> 192.168.2.23:44936
    Source: TrafficSnort IDS: 716 INFO TELNET access 115.234.209.249:23 -> 192.168.2.23:41762
    Source: TrafficSnort IDS: 716 INFO TELNET access 223.241.109.216:23 -> 192.168.2.23:42158
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 81.82.240.55:23 -> 192.168.2.23:55634
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 81.82.240.55:23 -> 192.168.2.23:55634
    Source: TrafficSnort IDS: 716 INFO TELNET access 115.234.209.249:23 -> 192.168.2.23:41774
    Source: TrafficSnort IDS: 716 INFO TELNET access 115.234.209.249:23 -> 192.168.2.23:41784
    Source: TrafficSnort IDS: 716 INFO TELNET access 115.234.209.249:23 -> 192.168.2.23:41796
    Source: TrafficSnort IDS: 716 INFO TELNET access 202.101.161.154:23 -> 192.168.2.23:44978
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 118.45.164.195:23 -> 192.168.2.23:52726
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 118.45.164.195:23 -> 192.168.2.23:52726
    Source: TrafficSnort IDS: 716 INFO TELNET access 115.234.209.249:23 -> 192.168.2.23:41808
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 81.82.240.55:23 -> 192.168.2.23:55702
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 81.82.240.55:23 -> 192.168.2.23:55702
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 223.241.109.216:23 -> 192.168.2.23:42158
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 109.122.227.186:23 -> 192.168.2.23:34224
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 109.122.227.186:23 -> 192.168.2.23:34224
    Source: TrafficSnort IDS: 716 INFO TELNET access 202.101.161.154:23 -> 192.168.2.23:45024
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 89.237.89.162:23 -> 192.168.2.23:53378
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 89.237.89.162:23 -> 192.168.2.23:53378
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 81.82.240.55:23 -> 192.168.2.23:55748
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 81.82.240.55:23 -> 192.168.2.23:55748
    Source: TrafficSnort IDS: 716 INFO TELNET access 223.241.109.216:23 -> 192.168.2.23:42254
    Source: TrafficSnort IDS: 716 INFO TELNET access 113.66.237.187:23 -> 192.168.2.23:49284
    Source: TrafficSnort IDS: 716 INFO TELNET access 191.243.8.246:23 -> 192.168.2.23:54588
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 79.127.103.72:23 -> 192.168.2.23:43102
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 79.127.103.72:23 -> 192.168.2.23:43102
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 14.39.191.244:23 -> 192.168.2.23:39306
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 14.39.191.244:23 -> 192.168.2.23:39306
    Source: TrafficSnort IDS: 492 INFO TELNET login failed 223.241.109.216:23 -> 192.168.2.23:42254
    Source: TrafficSnort IDS: 716 INFO TELNET access 197.210.191.131:23 -> 192.168.2.23:37636
    Source: TrafficSnort IDS: 716 INFO TELNET access 202.101.161.154:23 -> 192.168.2.23:45086
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 93.172.166.38:23 -> 192.168.2.23:56366
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 93.172.166.38:23 -> 192.168.2.23:56366
    Source: TrafficSnort IDS: 716 INFO TELNET access 81.28.168.138:23 -> 192.168.2.23:42746
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 113.66.237.187:23 -> 192.168.2.23:49284
    Source: TrafficSnort IDS: 718 INFO TELNET login incorrect 113.66.237.187:23 -> 192.168.2.23:49284
    Source: TrafficSnort IDS: 1251 INFO TELNET Bad Login 213.149.123.81:23 -> 192.168.2.23:34336
    Uses known network protocols on non-standard portsShow sources
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34044
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34048
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34054
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34058
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34064
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34074
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34088
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34094
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34098
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34102
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:54994 -> 95.213.159.92:1312
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 95.213.159.92
    Source: unknownTCP traffic detected without corresponding DNS query: 133.41.242.62
    Source: unknownTCP traffic detected without corresponding DNS query: 211.2.183.44
    Source: unknownTCP traffic detected without corresponding DNS query: 130.19.79.54
    Source: unknownTCP traffic detected without corresponding DNS query: 178.157.137.244
    Source: unknownTCP traffic detected without corresponding DNS query: 109.6.57.138
    Source: unknownTCP traffic detected without corresponding DNS query: 161.136.130.199
    Source: unknownTCP traffic detected without corresponding DNS query: 70.189.11.197
    Source: unknownTCP traffic detected without corresponding DNS query: 133.164.155.201
    Source: unknownTCP traffic detected without corresponding DNS query: 123.75.64.84
    Source: unknownTCP traffic detected without corresponding DNS query: 242.255.207.250
    Source: unknownTCP traffic detected without corresponding DNS query: 112.86.85.56
    Source: unknownTCP traffic detected without corresponding DNS query: 4.125.132.57
    Source: unknownTCP traffic detected without corresponding DNS query: 109.58.109.73
    Source: unknownTCP traffic detected without corresponding DNS query: 251.189.190.129
    Source: unknownTCP traffic detected without corresponding DNS query: 70.227.78.220
    Source: unknownTCP traffic detected without corresponding DNS query: 123.24.171.214
    Source: unknownTCP traffic detected without corresponding DNS query: 39.181.51.72
    Source: unknownTCP traffic detected without corresponding DNS query: 4.124.98.139
    Source: unknownTCP traffic detected without corresponding DNS query: 97.136.138.58
    Source: unknownTCP traffic detected without corresponding DNS query: 166.134.98.188
    Source: unknownTCP traffic detected without corresponding DNS query: 38.114.98.113
    Source: unknownTCP traffic detected without corresponding DNS query: 164.117.227.220
    Source: unknownTCP traffic detected without corresponding DNS query: 95.70.106.36
    Source: unknownTCP traffic detected without corresponding DNS query: 181.224.98.63
    Source: unknownTCP traffic detected without corresponding DNS query: 19.142.231.219
    Source: unknownTCP traffic detected without corresponding DNS query: 151.98.199.101
    Source: unknownTCP traffic detected without corresponding DNS query: 202.221.208.62
    Source: unknownTCP traffic detected without corresponding DNS query: 218.97.170.240
    Source: unknownTCP traffic detected without corresponding DNS query: 108.143.98.38
    Source: unknownTCP traffic detected without corresponding DNS query: 120.12.192.129
    Source: unknownTCP traffic detected without corresponding DNS query: 208.187.121.164
    Source: unknownTCP traffic detected without corresponding DNS query: 155.52.144.229
    Source: unknownTCP traffic detected without corresponding DNS query: 34.233.85.250
    Source: unknownTCP traffic detected without corresponding DNS query: 182.181.130.122
    Source: unknownTCP traffic detected without corresponding DNS query: 53.96.142.168
    Source: unknownTCP traffic detected without corresponding DNS query: 46.245.250.75
    Source: unknownTCP traffic detected without corresponding DNS query: 186.83.155.129
    Source: unknownTCP traffic detected without corresponding DNS query: 194.17.138.51
    Source: unknownTCP traffic detected without corresponding DNS query: 65.142.208.101
    Source: unknownTCP traffic detected without corresponding DNS query: 13.233.191.221
    Source: unknownTCP traffic detected without corresponding DNS query: 5.195.74.110
    Source: unknownTCP traffic detected without corresponding DNS query: 201.229.100.155
    Source: unknownTCP traffic detected without corresponding DNS query: 128.1.73.198
    Source: unknownTCP traffic detected without corresponding DNS query: 96.66.28.90
    Source: unknownTCP traffic detected without corresponding DNS query: 153.121.164.50
    Source: unknownTCP traffic detected without corresponding DNS query: 156.53.58.171
    Source: unknownTCP traffic detected without corresponding DNS query: 162.39.54.83
    Source: unknownTCP traffic detected without corresponding DNS query: 1.29.111.224
    Source: unknownTCP traffic detected without corresponding DNS query: 141.140.40.36
    Source: phantom.x86String found in binary or memory: http://upx.sf.net
    Source: LOAD without section mappingsProgram segment: 0xc01000
    Source: /tmp/phantom.x86 (PID: 5279)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/phantom.x86 (PID: 5282)SIGKILL sent: pid: 936, result: successful
    Source: classification engineClassification label: mal72.troj.evad.linX86@0/53@0/0

    Data Obfuscation:

    barindex
    Sample is packed with UPXShow sources
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/491/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/793/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/772/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/796/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/774/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/797/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/777/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/799/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/658/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/912/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/759/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/936/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/918/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/5279/exe
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/1/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/761/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/785/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/884/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/720/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/721/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/788/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/789/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/800/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/801/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/847/fd
    Source: /tmp/phantom.x86 (PID: 5279)File opened: /proc/904/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/491/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/5282/exe
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/793/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/772/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/796/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/774/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/797/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/777/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/799/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/658/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/912/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/759/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/936/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/918/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/1/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/761/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/785/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/884/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/720/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/721/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/788/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/789/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/800/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/801/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/847/fd
    Source: /tmp/phantom.x86 (PID: 5282)File opened: /proc/904/fd
    Source: /usr/sbin/logrotate (PID: 5236)Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
    Source: /usr/sbin/logrotate (PID: 5245)Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
    Source: /usr/sbin/invoke-rc.d (PID: 5239)Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service
    Source: /usr/sbin/invoke-rc.d (PID: 5243)Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service
    Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 5247)Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service

    Hooking and other Techniques for Hiding and Protection:

    barindex
    Uses known network protocols on non-standard portsShow sources
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34044
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34048
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34054
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34058
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34064
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34074
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34088
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34094
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34098
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34102
    Source: /usr/sbin/logrotate (PID: 5192)Truncated file: /var/log/cups/access_log.1Jump to behavior
    Source: /usr/sbin/logrotate (PID: 5192)Truncated file: /var/log/syslog.1Jump to behavior
    Source: /usr/bin/find (PID: 5232)Queries kernel information via 'uname':
    Source: 5240.20.drBinary or memory string: -9915837702310A--gzvmware kernel module
    Source: 5240.20.drBinary or memory string: -1116261022170A--gzQEMU User Emulator
    Source: 5240.20.drBinary or memory string: qemu-or1k
    Source: 5240.20.drBinary or memory string: qemu-riscv64
    Source: 5240.20.drBinary or memory string: {cqemu
    Source: 5240.20.drBinary or memory string: qemu-arm
    Source: 5240.20.drBinary or memory string: (qemu
    Source: 5240.20.drBinary or memory string: qemu-tilegx
    Source: 5240.20.drBinary or memory string: qemu-hppa
    Source: 5240.20.drBinary or memory string: q{rqemu%
    Source: 5240.20.drBinary or memory string: )qemu
    Source: 5240.20.drBinary or memory string: vmware-toolbox-cmd
    Source: 5240.20.drBinary or memory string: qemu-ppc
    Source: 5240.20.drBinary or memory string: Tqemu9
    Source: 5240.20.drBinary or memory string: qemu-aarch64_be
    Source: 5240.20.drBinary or memory string: 0qemu9
    Source: 5240.20.drBinary or memory string: qemu-sparc64
    Source: 5240.20.drBinary or memory string: qemu-mips64
    Source: 5240.20.drBinary or memory string: vV:qemu9
    Source: 5240.20.drBinary or memory string: qemu-ppc64le
    Source: 5240.20.drBinary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
    Source: 5240.20.drBinary or memory string: vmware
    Source: 5240.20.drBinary or memory string: qemu-cris
    Source: 5240.20.drBinary or memory string: libvmtools
    Source: 5240.20.drBinary or memory string: qemu-m68k
    Source: 5240.20.drBinary or memory string: qemu-xtensa
    Source: 5240.20.drBinary or memory string: 9qemu
    Source: 5240.20.drBinary or memory string: qemu-sh4
    Source: 5240.20.drBinary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
    Source: 5240.20.drBinary or memory string: .qemu{
    Source: 5240.20.drBinary or memory string: qemu-ppc64abi32
    Source: 5240.20.drBinary or memory string: qemu-ppc64
    Source: 5240.20.drBinary or memory string: qemu-i386
    Source: 5240.20.drBinary or memory string: qemu-x86_64
    Source: 5240.20.drBinary or memory string: H~6\nqemu*q
    Source: 5240.20.drBinary or memory string: @qemu
    Source: 5240.20.drBinary or memory string: Fqqemu
    Source: 5240.20.drBinary or memory string: N4qemu
    Source: 5240.20.drBinary or memory string: ~6\nqemu*q
    Source: 5240.20.drBinary or memory string: qemu-mips64el
    Source: 5240.20.drBinary or memory string: hqemu
    Source: 5240.20.drBinary or memory string: &mqemu
    Source: 5240.20.drBinary or memory string: $qemu
    Source: 5240.20.drBinary or memory string: qemu-sparc
    Source: 5240.20.drBinary or memory string: qemu-microblaze
    Source: 5240.20.drBinary or memory string: qemu-user
    Source: 5240.20.drBinary or memory string: qemu-aarch64
    Source: 5240.20.drBinary or memory string: qemu-sh4eb
    Source: 5240.20.drBinary or memory string: iqemu
    Source: 5240.20.drBinary or memory string: qemu-mipsel
    Source: 5240.20.drBinary or memory string: qemuP`
    Source: 5240.20.drBinary or memory string: qemu-alpha
    Source: 5240.20.drBinary or memory string: qemu-microblazeel
    Source: 5240.20.drBinary or memory string: \qemu
    Source: 5240.20.drBinary or memory string: qemu-xtensaeb
    Source: 5240.20.drBinary or memory string: qemu-mipsn32el
    Source: 5240.20.drBinary or memory string: SAqemu
    Source: 5240.20.drBinary or memory string: Vqemu
    Source: 5240.20.drBinary or memory string: qemu-mipsn32
    Source: 5240.20.drBinary or memory string: qemuAU
    Source: 5240.20.drBinary or memory string: qemu-riscv32
    Source: 5240.20.drBinary or memory string: qemu-sparc32plus
    Source: 5240.20.drBinary or memory string: 7,qemu
    Source: 5240.20.drBinary or memory string: qemu-s390x
    Source: 5240.20.drBinary or memory string: vmware-checkvm
    Source: 5240.20.drBinary or memory string: qemu-nios2
    Source: 5240.20.drBinary or memory string: qemu-armeb
    Source: 5240.20.drBinary or memory string: -4415868968400A--gzVMware SVGA video driver
    Source: 5240.20.drBinary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
    Source: 5240.20.drBinary or memory string: I_qemu
    Source: 5240.20.drBinary or memory string: -1116261022170B--gzQEMU User Emulator
    Source: 5240.20.drBinary or memory string: -3315837702310A--gzvmware shared library
    Source: 5240.20.drBinary or memory string: qemu-mips
    Source: 5240.20.drBinary or memory string: qemuj\
    Source: 5240.20.drBinary or memory string: {qemuQ&
    Source: 5240.20.drBinary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
    Source: 5240.20.drBinary or memory string: vmware-xferlogs

    Stealing of Sensitive Information:

    barindex
    Yara detected MiraiShow sources
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality:

    barindex
    Yara detected MiraiShow sources
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsScripting1Systemd Service1Systemd Service1Scripting1OS Credential Dumping1Security Software Discovery11Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsIndicator Removal on Host1LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Standard Port11Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

    Malware Configuration

    No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 553477 Sample: phantom.x86 Startdate: 15/01/2022 Architecture: LINUX Score: 72 68 209.253.15.54 WINDSTREAMUS United States 2->68 70 209.18.212.249 VOYANTUS United States 2->70 72 98 other IPs or domains 2->72 74 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->74 76 Multi AV Scanner detection for submitted file 2->76 78 Yara detected Mirai 2->78 80 2 other signatures 2->80 10 systemd logrotate 2->10         started        12 systemd mandb phantom.x86 2->12         started        14 systemd install 2->14         started        16 systemd find 2->16         started        signatures3 process4 process5 18 logrotate sh 10->18         started        20 logrotate sh 10->20         started        22 logrotate gzip 10->22         started        24 logrotate gzip 10->24         started        26 phantom.x86 12->26         started        28 phantom.x86 12->28         started        30 phantom.x86 12->30         started        process6 32 sh invoke-rc.d 18->32         started        34 sh rsyslog-rotate 20->34         started        36 phantom.x86 26->36         started        38 phantom.x86 26->38         started        40 phantom.x86 28->40         started        42 phantom.x86 28->42         started        44 phantom.x86 28->44         started        process7 46 invoke-rc.d runlevel 32->46         started        48 invoke-rc.d systemctl 32->48         started        50 invoke-rc.d ls 32->50         started        52 invoke-rc.d systemctl 32->52         started        54 rsyslog-rotate systemctl 34->54         started        56 phantom.x86 36->56         started        62 2 other processes 36->62 58 phantom.x86 40->58         started        60 phantom.x86 40->60         started        process8 64 phantom.x86 56->64         started        66 phantom.x86 56->66         started       

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    phantom.x8637%VirustotalBrowse
    phantom.x8651%ReversingLabsLinux.Trojan.Mirai

    Dropped Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    No Antivirus matches

    Domains and IPs

    Contacted Domains

    No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.netphantom.x86false
      		high

      Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public

      IPDomainCountryFlagASNASN NameMalicious
      161.46.153.9
      		unknownUnited States
      		1252UNMC-ASUSfalse
      138.214.135.26
      		unknownCanada
      		59121AKNWS-NETAsahiKaseiNetworksCorporationJPfalse
      191.181.205.173
      		unknownBrazil
      		28573CLAROSABRfalse
      186.180.66.200
      		unknownColombia
      		27831ColombiaMovilCOfalse
      35.218.99.155
      		unknownUnited States
      		19527GOOGLE-2USfalse
      174.223.172.50
      		unknownUnited States
      		22394CELLCOUSfalse
      92.14.197.230
      		unknownUnited Kingdom
      		13285OPALTELECOM-ASTalkTalkCommunicationsLimitedGBfalse
      203.183.154.92
      		unknownJapan4725ODNSoftBankMobileCorpJPfalse
      63.190.130.133
      		unknownUnited States
      		1239SPRINTLINKUSfalse
      155.106.187.197
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      168.165.75.76
      		unknownMexico
      		37179AFRICAINXZAfalse
      200.133.204.145
      		unknownBrazil
      		1916AssociacaoRedeNacionaldeEnsinoePesquisaBRfalse
      247.16.190.72
      		unknownReserved
      		unknownunknownfalse
      44.148.157.125
      		unknownUnited States
      		62383LDS-ASBEfalse
      146.24.28.224
      		unknownUnited States
      		197938TRAVIANGAMESDEfalse
      73.45.72.12
      		unknownUnited States
      		7922COMCAST-7922USfalse
      62.215.147.93
      		unknownKuwait
      		21050FAST-TELCOKWfalse
      111.197.113.115
      		unknownChina
      		4808CHINA169-BJChinaUnicomBeijingProvinceNetworkCNfalse
      209.253.15.54
      		unknownUnited States
      		7029WINDSTREAMUSfalse
      248.250.22.44
      		unknownReserved
      		unknownunknownfalse
      250.135.211.1
      		unknownReserved
      		unknownunknownfalse
      58.6.174.54
      		unknownAustralia
      		7545TPG-INTERNET-APTPGTelecomLimitedAUfalse
      130.227.167.221
      		unknownDenmark
      		9158TELENOR_DANMARK_ASDKfalse
      167.100.152.214
      		unknownSaudi Arabia
      		25019SAUDINETSTC-ASSAfalse
      185.57.37.64
      		unknownUnited Kingdom
      		202206MOTIVEGBfalse
      70.153.237.61
      		unknownUnited States
      		6389BELLSOUTH-NET-BLKUSfalse
      181.7.145.113
      		unknownArgentina
      		7303TelecomArgentinaSAARfalse
      185.255.158.224
      		unknownDenmark
      		60111ASOM-NETDKfalse
      35.15.136.181
      		unknownUnited States
      		36375UMICH-AS-5USfalse
      155.28.153.184
      		unknownUnited States
      		1556DNIC-ASBLK-01550-01601USfalse
      254.164.185.124
      		unknownReserved
      		unknownunknownfalse
      20.79.32.82
      		unknownUnited States
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
      190.141.21.40
      		unknownPanama
      		18809CableOndaPAfalse
      60.168.40.14
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      27.229.140.235
      		unknownJapan9605DOCOMONTTDOCOMOINCJPfalse
      136.255.15.129
      		unknownRomania
      		12302VODAFONE_ROCharlesdeGaullenr15ROfalse
      162.79.89.113
      		unknownUnited States
      		4152USDA-1USfalse
      221.64.244.54
      		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
      36.33.212.92
      		unknownChina
      		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      80.36.57.53
      		unknownSpain
      		3352TELEFONICA_DE_ESPANAESfalse
      213.161.228.235
      		unknownNorway
      		15765MIMERNOfalse
      42.119.44.71
      		unknownViet Nam
      		18403FPT-AS-APTheCorporationforFinancingPromotingTechnolofalse
      96.132.29.69
      		unknownUnited States
      		7922COMCAST-7922USfalse
      221.20.125.203
      		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
      241.254.232.178
      		unknownReserved
      		unknownunknownfalse
      210.48.235.19
      		unknownJapan2514INFOSPHERENTTPCCommunicationsIncJPfalse
      195.129.27.188
      		unknownEuropean Union
      		702UUNETUSfalse
      160.75.166.103
      		unknownTurkey
      		9095IstanbulTeknikUniversitesiTRfalse
      193.194.39.59
      		unknownMorocco
      		6713IAM-ASMAfalse
      200.176.169.253
      		unknownBrazil
      		22548NucleodeInfeCoorddoPontoBR-NICBRfalse
      187.252.127.109
      		unknownMexico
      		28509CablemasTelecomunicacionesSAdeCVMXfalse
      185.11.6.125
      		unknownRussian Federation
      		15493RUSCOMP-ASRussiancompanyLLCInternetServiceProviderTfalse
      157.227.65.58
      		unknownAustralia
      		4704SANNETRakutenMobileIncJPfalse
      76.43.0.141
      		unknownUnited States
      		18494CENTURYLINK-LEGACY-EMBARQ-WRBGUSfalse
      157.139.187.2
      		unknownUnited States
      		20252JSIWMCUSfalse
      80.142.180.154
      		unknownGermany
      		3320DTAGInternetserviceprovideroperationsDEfalse
      48.11.58.244
      		unknownUnited States
      		2686ATGS-MMD-ASUSfalse
      63.155.197.20
      		unknownUnited States
      		209CENTURYLINK-US-LEGACY-QWESTUSfalse
      253.72.75.120
      		unknownReserved
      		unknownunknownfalse
      116.72.42.120
      		unknownIndia
      		17488HATHWAY-NET-APHathwayIPOverCableInternetINfalse
      151.219.242.134
      		unknownunknown
      		11003PANDGUSfalse
      133.118.92.141
      		unknownJapan2522PPP-EXPJapanNetworkInformationCenterJPfalse
      169.228.186.243
      		unknownUnited States
      		7377UCSDUSfalse
      179.132.161.105
      		unknownBrazil
      		26599TELEFONICABRASILSABRfalse
      76.114.145.159
      		unknownUnited States
      		7922COMCAST-7922USfalse
      255.67.241.130
      		unknownReserved
      		unknownunknownfalse
      117.196.164.125
      		unknownIndia
      		9829BSNL-NIBNationalInternetBackboneINfalse
      217.60.218.162
      		unknownIran (ISLAMIC Republic Of)
      		31549RASANAIRfalse
      96.144.25.21
      		unknownUnited States
      		7922COMCAST-7922USfalse
      37.135.6.37
      		unknownSpain
      		12479UNI2-ASESfalse
      82.124.221.121
      		unknownFrance
      		3215FranceTelecom-OrangeFRfalse
      19.157.11.236
      		unknownUnited States
      		3MIT-GATEWAYSUSfalse
      57.137.251.6
      		unknownBelgium
      		2686ATGS-MMD-ASUSfalse
      223.52.70.237
      		unknownKorea Republic of
      		9644SKTELECOM-NET-ASSKTelecomKRfalse
      174.103.238.15
      		unknownUnited States
      		10796TWC-10796-MIDWESTUSfalse
      154.90.25.153
      		unknownSeychelles
      		26484IKGUL-26484USfalse
      116.87.137.130
      		unknownSingapore
      		55430STARHUB-NGNBNStarhubLtdSGfalse
      209.18.212.249
      		unknownUnited States
      		5006VOYANTUSfalse
      210.89.203.17
      		unknownJapan7671MCNETNTTSmartConnectCorporationJPfalse
      8.127.239.179
      		unknownUnited States
      		3356LEVEL3USfalse
      43.24.206.124
      		unknownJapan4249LILLY-ASUSfalse
      114.142.142.198
      		unknownIndia
      		4721JCNJupiterTelecommunicationsCoLtdJPfalse
      53.49.50.138
      		unknownGermany
      		31399DAIMLER-ASITIGNGlobalNetworkDEfalse
      46.154.181.7
      		unknownTurkey
      		15897VODAFONETURKEYTRfalse
      182.89.214.65
      		unknownChina
      		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      165.77.232.33
      		unknownUnited States
      		4725ODNSoftBankMobileCorpJPfalse
      37.157.93.73
      		unknownEstonia
      		3249ESTPAKEEfalse
      106.31.231.3
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      182.137.131.110
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      208.63.21.65
      		unknownUnited States
      		6389BELLSOUTH-NET-BLKUSfalse
      162.149.162.149
      		unknownUnited States
      		7922COMCAST-7922USfalse
      12.134.143.230
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      75.8.57.219
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      42.75.76.247
      		unknownTaiwan; Republic of China (ROC)
      		17421EMOME-NETMobileBusinessGroupTWfalse
      83.137.220.4
      		unknownRussian Federation
      		12739NETLINE_ASRUfalse
      250.237.36.137
      		unknownReserved
      		unknownunknownfalse
      78.222.94.138
      		unknownFrance
      		12322PROXADFRfalse
      198.39.146.109
      		unknownUnited States
      		11857AEGONUSAUSfalse
      251.237.41.157
      		unknownReserved
      		unknownunknownfalse
      108.176.28.42
      		unknownUnited States
      		12271TWC-12271-NYCUSfalse


      Runtime Messages

      Command:/tmp/phantom.x86
      Exit Code:0
      Exit Code Info:
      Killed:False
      Standard Output:
      Connected To CNC
      Standard Error:

      Joe Sandbox View / Context

      IPs

      No context

      Domains

      No context

      ASN

      No context

      JA3 Fingerprints

      No context

      Dropped Files

      No context

      Created / dropped Files

      /var/cache/man/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):622592
      Entropy (8bit):4.657516417799966
      Encrypted:false
      SSDEEP:6144:rb7cWWov4H5N80nuDSyvxYCWZ0/VmpRELAR/QuU/MzUCl1NZ:H4WWoGgvSiOp2kl
      MD5:0C99179B6C5CFE82203424AD7DAD0D8F
      SHA1:CAC50B64B1352723FF8F58BB1B103B93C396539B
      SHA-256:CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
      SHA-512:4226FDE9F558FFEF2107C330DB942E7E665C51C520A840221541AD255D0995AF64101C69D42C4BD43037364CC4D152851625A53DC56CC188DC28A3DC8C5602F6
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview: .W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/cs/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):1.6070136442091312
      Encrypted:false
      SSDEEP:48:bhVGQeUzGLIsWUMZJ5CggJHtheYdiKNHTlJ8NK:bhVGaGLIWMZXZgxeYtzll
      MD5:D0CA2EBA9E7A17D4680AA9DDC5F88946
      SHA1:270F443EFF85209052AE8FFA86660AFB0FAAD39B
      SHA-256:9504DC65F8B4E057D0939FA3B2C640FC703D0290EE19381836BAA5EB3EFBADBD
      SHA-512:9F999B0467E396E78A91F0BFE56E191DB9D9AFA6DC47858F3427CB44A39D5A13A206542A471CE15C8851674A234B9A7A49AAB7E6D5AF8D080BBC99C2BA3C56D8
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/cs/index.db.04PZJq
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/da/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):2.24195239843379
      Encrypted:false
      SSDEEP:96:bhHY2DzMnpU0QMiloesQdUTn3WVE0UnknJfsWdv0SBpEVvsb6eZeGfRL+:dYKM+oagn3WW5nkniWdv0SAVE6eZee6
      MD5:4DF08004EE4C5384C02376841F2B50BC
      SHA1:C02E58212CA012913390B4C1CCD64DD3353009EE
      SHA-256:F4D6A62A734E2844B99F3AD0EB480373AFBE56B29C0CFC9C70D9DFDF19D95C02
      SHA-512:6146001CA7028F58595235F244AE8FC4ECAEA3E95C83276514FC704E91B7596678E74CDE9963D680F2493F9C04AFDEBC4DB5094E2AB7C1A949E9378307AE0116
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/da/index.db.MDFXAr
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/de/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):45056
      Entropy (8bit):4.163076275268073
      Encrypted:false
      SSDEEP:768:gMGrknsA3KVtOOcmGMrTJDEEf5RjOHriVDdtq5:/GrkncXD+qkHrGLq
      MD5:5D16F6B4EF2562C7B8F366BEA94D1522
      SHA1:A405409CEDF9AA15C403747F8C3075FBDBC213C7
      SHA-256:DC365F5FCEA0B3109C57E277B330D451D504BF2079BE732CAD5886D1CC990822
      SHA-512:933FCB662A065859D866DC047AC077AB75D6EE4120FA8B239E270F023010D50FC1D68622CA331680ED86224522954597A86A3F654792518C0FE1208B0F49B4B5
      Malicious:false
      Reputation:low
      Preview: .W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/de/index.db.4iy15q
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):45056
      Entropy (8bit):0.20558603354177746
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:55880A8B73FD160B73198E09A21C83DB
      SHA1:5EB780702D2501747AF46F7525EF5C635EC5E64C
      SHA-256:66BD4C98AF40E2E208AC102ACD0F555A6C118E7258D91B833BE1D53EBFFB7BBB
      SHA-512:388924B8CAE80CCA6CA8E5109D0239A963A66CC0454450223EC7FB2A188F6F05E49632E535DC06E49DF6D007B221AA6B3D5F23C80203BCC861FF95EFA10AC1F9
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/es/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):2.469907427008948
      Encrypted:false
      SSDEEP:96:bhj9SeW/8iDdO/tktuGWTaZxzn3zbHGc2WjAXGBCgfd6Dgzs30z8ztvpWF4DXst:99PGo9Tmn3zbNBSw/fd6Oz8ztQSDXo
      MD5:3DBF4FF017D406F407BFBC2011BCAE9E
      SHA1:FF64864ACA18DFA7869715CE8AA5ECC3DABA54B6
      SHA-256:640C040F364061A5825E913682798C9BC8E1081088894D3FEB2C3EC39D02A379
      SHA-512:3DCC8F432487C532A1F69D321EB57EFE5CFE65AA3C99B81EA1A56613F8F460EA9ED7D2031615F2E60A3F2EE279D411848E5387CC8B8D5F28D8F8D0055D72489B
      Malicious:false
      Preview: .W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/es/index.db.2o04wp
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):0.3847690842836057
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:F0B902DEA5EF122A0B1F0F496DDC781B
      SHA1:90176D320A9C3601787D53CC346DC743367D53F1
      SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
      SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fi/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.5882948808594274
      Encrypted:false
      SSDEEP:12:Ey20yaajjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjjjjjp:bhjz+9Ab
      MD5:09F6ED1A60B8A4203EA97CF5926C6AFF
      SHA1:C28F4E393D55AD057E3C7608741904B796F67076
      SHA-256:56664D61D0BB8BF34CCA28C73CB314CB73EA1C4FAC64D2208B43F63C009FC855
      SHA-512:476EAE37D827C8BB322213799AB52DBE8FA43274DB3447BC5FEDFED64ECCEAF2C11DA375FDA09B37977D03CA1910E22443B22A3EEA875CE6F3BC698F8ADCC0E2
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fi/index.db.et0KPr
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fr.ISO8859-1/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.9312184489410064
      Encrypted:false
      SSDEEP:12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
      MD5:43ADE2E40B8B5A0DFA0A155FC9A02F7F
      SHA1:3D04BDFFD0E2A8433150C87D334014099336A5C5
      SHA-256:81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
      SHA-512:C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fr.ISO8859-1/index.db.dxxXfs
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fr.UTF-8/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.9312184489410064
      Encrypted:false
      SSDEEP:12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
      MD5:43ADE2E40B8B5A0DFA0A155FC9A02F7F
      SHA1:3D04BDFFD0E2A8433150C87D334014099336A5C5
      SHA-256:81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
      SHA-512:C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fr.UTF-8/index.db.n5c34p
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fr/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):40960
      Entropy (8bit):3.8303945862002498
      Encrypted:false
      SSDEEP:768:A4VX6Bd+dla5HmdT8qHl87BaIPay4uz8HksjHnwNO:A4ROd+dStM83PavjHC
      MD5:839C7639B0946E9882FE70633B0A5E8E
      SHA1:AA58A11EBCC8D421E4A054C1782D25C86B026ADB
      SHA-256:FD8D1952430FA9C45320574478B04381F7B287A8E3ADA2EB1F72E9948B0B734B
      SHA-512:AE280AC0F3337B9B1C2FB401DC073E96C5AC634AC7BE3F6FBBF64D0CBF4D9D68B6282DA95C9CF961624D475F03638408CAC3F8C618BC7F8F3CC2DD35B5499FDD
      Malicious:false
      Preview: .W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/fr/index.db.51Vzdp
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):40960
      Entropy (8bit):0.22208993462959856
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:425CB57CD9B42556C8089FE7A7A3E495
      SHA1:4F33F9A9897218FDED958FD8F8D7AF7CD8BC48F3
      SHA-256:85E01EFF2AC0C83C827E118D5CE2CD1E1A19E059688B6E0D09CB3CC131F065D3
      SHA-512:8C7D4DACF5C5C5C4B78775048427AF99ED8057590AA3A69FD5B3F875B6DDD249A6DB0AF3A51BB96A7F629D1017B272317583A8DFF89FB3968FFE2F246F040F33
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/hu/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.9419610786280751
      Encrypted:false
      SSDEEP:24:bh04IR9rYz9kvNQFl46MdnqfPE9eTuF0Ce:bhXIHakVQmnqXqeT/Ce
      MD5:18F02B57872A97DE1E82FF5348A5AF1B
      SHA1:52F332343B120B1C950AC02B3C923556C70DC62A
      SHA-256:5C605DE68B3E05754698485F73413F4052AEA8C3AAE6012AC6416B3B6B056DF7
      SHA-512:E33A8412F52D26BDE55E4D72E0D9D09EB777F4B882F5BB1C4625AB392EE321D6ACD8795001BF50CCDACFAC131A1263B1398F208799F753554C43349136EB8BEC
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/hu/index.db.EAVros
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/id/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):1.309811236154278
      Encrypted:false
      SSDEEP:48:bhESUeDVrWTVd5ekRv/KSmGWqR0VouC4btU8IzTC74ExJKGtII:bhEVeBqTVdAcn3Iowl4UBtx
      MD5:3AFDA1B0F729816929FF7A6628D776D5
      SHA1:5982940A5782F11AEB5BF859C055DE3FEFBDF5DB
      SHA-256:77809D5F38F6D96A2E8BA9BE0DFBB16C10B6B1FF7D2BA1DD5FB9437F73C47E7F
      SHA-512:6D4CE03475C68EDC0AE928E7F65BB8C06198721146A1266F55455AF3D5E24F44A569E007C0DC44BC7745C1573DBC7F02B8C4094F9BD97FAF6A0B5894BE0E07E5
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/id/index.db.gNViRp
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/index.db.b6qNrs
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):622592
      Entropy (8bit):0.022159377425242585
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:2E442DBA85DEDFDCB07090FDF9DE90D0
      SHA1:02658086E93854D13D82B1F0D80F4B78D26DCA51
      SHA-256:62406BFE7657964E490DE65A0007F7C1D59B62B2B9AD35BA55BA219673378848
      SHA-512:FDBBA0DEF310CF7DBF448CFB6E5C9CDCEFBF6A0CAEB26CA3AFA91A388FBA10A9E77BCC27CA9B0AEA2A7B67F964849E147FB44862C7394C2C7CDCB572C06FCB05
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/it/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):3.3621193886235408
      Encrypted:false
      SSDEEP:384:Jtp0q5d98n3SaMfhtxfmbMy+HseeNwoMbHf:JDd9QSBf
      MD5:B228DE097081AF360D337CF8C8FF2C6F
      SHA1:7DD2C4640925B225F98014566F73C35F4E960940
      SHA-256:1056CECADA78542B173EE469C9BEAF61F81298EBBD21B54EA6EE449028E18B3F
      SHA-512:F61D7F9040E452C4B1B77F3657BE4252475C3BF23D78EED903A5E55FA97BA0571BA3AD90DBA7F77C334DF5B721F909B12720515034421A4AAB0450D1D43B32E4
      Malicious:false
      Preview: .W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/it/index.db.mBfOlp
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):0.3847690842836057
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:F0B902DEA5EF122A0B1F0F496DDC781B
      SHA1:90176D320A9C3601787D53CC346DC743367D53F1
      SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
      SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/ja/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):3.667488020062395
      Encrypted:false
      SSDEEP:192:CF4pPRfAgFn35FF1veUMjGiEGBuPhiB0PUKwA+U:5PRfAgFn35MSeAPUjN
      MD5:D3CD7D67F8155491493BB7235FB9AA57
      SHA1:5A7AE62A7AFE50EFCCED06CBD56AE2A0A284EFF3
      SHA-256:6958349ECA637F99AABC419B5E402CFB50BC5B8867F31BCB67F064F47A209929
      SHA-512:1168BF697CDE563F7D82A71EAE1CD496EA81D178B26F87EAAF2EDEED13274B1E3500CE1C981647717598495EBE1FF8F8AC54AD33547506E566C925D7002F5CFF
      Malicious:false
      Preview: .W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/ja/index.db.i6ZXop
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):0.3847690842836057
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:F0B902DEA5EF122A0B1F0F496DDC781B
      SHA1:90176D320A9C3601787D53CC346DC743367D53F1
      SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
      SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/ko/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.7847786157292606
      Encrypted:false
      SSDEEP:12:Ey20yYn0jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjmjj7:bhXYznMk31RFe6f
      MD5:FBA25855E1C99D8F87E8AC13E2E2ECB1
      SHA1:D99351AC40D6CC4C9BE54E0E018C44A9A88983D7
      SHA-256:C0E18ED1CEFF427FD4D57D1B79CE1AF7320AC8453BAF8A0349C08267464C4D71
      SHA-512:0969DF6506E083A4995A18518BC3C4472157E7790EEC26C08221B0FC6DE9C7DA0ADB11CF92C56BC35B89BC60447F3D991F935E352552B58FB9BD1D4B2579FBB0
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/ko/index.db.oWMJuq
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/nl/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):2.554204221242331
      Encrypted:false
      SSDEEP:192:H8Y5a2oquB2aCYn3lvu3whjXVobdbs7dq1KJGbtf0Hoa:hoquYaCYn3Q8jXqbdbs7dGbKHoa
      MD5:27FED1CA8EB0101C459D9A617C833293
      SHA1:503B2A3E33FE79FF2CD58F831ED33DB358849BEA
      SHA-256:C3033C4F7CF0D6108611EF5A62CA893F98EE6463DDCFF7100D3BAFDEB0036D9E
      SHA-512:7BD630F5E0C5A91C34D2E48D0053923C9F2F5BAA07D21FDA79E60F3AFDF759E594E6639562C1F3EE68DD080D417009DC3AFB7DA534E3B8C29FF7B10438C3FD4E
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/nl/index.db.aTrbws
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/pl/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):2.880948418505059
      Encrypted:false
      SSDEEP:192:7Sf8026LXqn3ZTV6pXAmA44BRqvc3X3GVAjvAk/AvdWjWftxA:E802uXqn3/6pxARqr8kdWjW1
      MD5:37CEBCD3F5BF6322785FFF568EE33131
      SHA1:201298C827C77C60CD314BF721DC4C27EF95BD64
      SHA-256:012C5597C5DD8654EB14432AFCEFD9B131F2CE75AD21488991A5A688929AAEA6
      SHA-512:CCC8A8CCF4ACA332CAF610155DE9E7C4A12D1C45C98D20766B86098A3D2EF332189F159E3956944CD302DF652FE7A6F0D07CA39CBE7DF4A655D3211452487582
      Malicious:false
      Preview: .W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/pl/index.db.wmVpkp
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):0.3847690842836057
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:F0B902DEA5EF122A0B1F0F496DDC781B
      SHA1:90176D320A9C3601787D53CC346DC743367D53F1
      SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
      SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/pt/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):2.4110695640960995
      Encrypted:false
      SSDEEP:192:mva8yGn35+0+eo8TAnBW4VppKP8qtRJI:Sa8Rn35+peo8T8V/fqlI
      MD5:782FF89B6FA5932F7019AF9CF3F82E43
      SHA1:2ECE8DC134E3A292E2545AA2DCD24114A5FC5749
      SHA-256:01E77D9235C524F2A61EA03953607C13831C391A5B9AB0D9094F9C38F0EEB02E
      SHA-512:2305BEC024CA5D8B43267F5487B02081A0A746B73608E11217D19C91AD857B6A5D8E935194AC4228DA3A5383086E60D593095309E64BAF38841A6E32D7EA7805
      Malicious:false
      Preview: .W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/pt/index.db.JG93tq
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):20480
      Entropy (8bit):0.3847690842836057
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:F0B902DEA5EF122A0B1F0F496DDC781B
      SHA1:90176D320A9C3601787D53CC346DC743367D53F1
      SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
      SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/pt_BR/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):1.7510008687365202
      Encrypted:false
      SSDEEP:48:bhX6G+IwvnUZe4Gv/KSmGROqAQAuSe0dDOfInYbmucrm3QEAvJBFIz:bhq5bnUY4Gn3P+/Z1tvJDQ
      MD5:A11F5E85A2A07AF84255570AE29318FB
      SHA1:D06BF25E5FD4A17BCF7C5BD77ACD747F0FE181E8
      SHA-256:8FFA8BC408B254217275A622D054853CB72B08409A11AA49C4C664C0DABFB62F
      SHA-512:059F3CBC93750B68942D88EDD4AD2531B2291CEC421EB903280B9105010D1C8AD70F9F3CFA1B1A50D5110DCBFDB807A6E7A3F9EBC9A48AC8C3A49DEC4B6B3899
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/pt_BR/index.db.ujAt8r
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/ru/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):24576
      Entropy (8bit):3.440634655325007
      Encrypted:false
      SSDEEP:384:SpjHrhEon3PRekEF3PS6y13Vi6w5TlmmcOB:Q3hNEk23MuxrB
      MD5:DF5C1114538C5D8EA1EE929FFAC24E3C
      SHA1:B6331AF77566B63EA8204BE85F5DC99FAF51479E
      SHA-256:F238C75DAD82E10AB011A9BF79775B2A5F5889644A5A06835933340845A08555
      SHA-512:9514A424CC2A9290F749F527F515B35E45C6A829CB3930DBFB39DC9D70A684640A31686EC77258FF285FE89B6DD44BB01A478848FF9B3EBD764741A6F7856704
      Malicious:false
      Preview: .W..............................`......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/ru/index.db.umdRNo
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):24576
      Entropy (8bit):0.3337394253577246
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:5B66CE03BFE548DEE335E0518E4E0554
      SHA1:65397845DC679AA972454B0FF237A513C0F490CB
      SHA-256:C38BB21B1D92166794DC09807C9A55B67B0A760C684FEEDD0C931F8415DD6D29
      SHA-512:A31C3D23F25607333250443490F0EE295BB702B46A636905FD413E8AEAA8ED23AAB42106868D2938718555C9DEEFB69FB416CAF5228A422F64D6CA8DB438FEE8
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/sl/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.8558400366712392
      Encrypted:false
      SSDEEP:12:Ey20y8jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjKuV0jjjjjjjjjjjjjjjjjjjjjjje:bhaVZjx6ot7m13SmZQs
      MD5:67697BEA7C23E4805A82FE9755BB3CAE
      SHA1:14ACAFF0BECBDB116E4C0BC329E59DEF68CF46D1
      SHA-256:553DA7FF76999B7CCC4450498B11E6BD98B3B1E5FF81D82A53568F84B0D270D5
      SHA-512:D966DD6430003E708C6EE10764DC072A1ED0A252E6E1C822CBD28271A2EDD4B1F61C7F9AA7D1D442D6175791A104A365DE25B9C2598500AE705C9250C8BA46A1
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/sl/index.db.wWPVwo
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/sr/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):1.3868484511023333
      Encrypted:false
      SSDEEP:48:bhLSUCt/WFekRv/KSmGWqApnEVyfNsu+tBNGg2PgULLE2vRy2QwfoQEDiR2e3iRj:bhLVC48cn3Vu2FtBv7AtboQIqb3qwK
      MD5:0DD75ECC81E4E564EA56A57FF32A24D3
      SHA1:859C0FE5F86A2C5A32BAD7920787BE845F34C4FB
      SHA-256:DB778B175D19DEFA4180D0B12D675AD0B8B22CC4BB77702D9EC8510F894EB3B1
      SHA-512:7B0C56A76797383527509F8036EB4911F8925E7ACC005CDC3269F0A43231479E3A0A9887BF4D2979F05CBFE18324997DEF715FDA6921EEF827B385C9D902C708
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/sr/index.db.dPeBKr
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/sv/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):2.5432558448090097
      Encrypted:false
      SSDEEP:96:bhk/+fz7b9ldxbe2Vn3iwkVJIB0D6c6aZ4+1Wrzbxpl4/tMe1:imrn9lHbe2Vn3iwKhD6cvTAbl4/tMe
      MD5:D97454D6B1F39F39966A809BCA3D9647
      SHA1:276931CED8F34B7651C1BDFC8522FF0560E2C377
      SHA-256:DCB8CE7F4F21595D851100F315C56B717541DB898AEB9ED9C0CCC9FF217A5801
      SHA-512:3E014F3EA8EEE79B87726EDA6291AC2D0BD9B22803EE848F61CA2AAD39D5FB87704410C57C648EE4AF8A1B78EFB0D766524F6DB750208C9BAC346079FD8EE69E
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/sv/index.db.VTorKr
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/tr/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):1.7558188637474321
      Encrypted:false
      SSDEEP:96:bhWV1OIM7cn3UZiPU1wywyoEpJmz6W2Mzgg:YDOL4n3fPvywrzgMU
      MD5:5F905B930E7310E72BC3DF5C50F8E579
      SHA1:50B1AD3115F095C743CB26F87ECCE406FAC3523B
      SHA-256:1DB72BA77CA01F25CA9768999825D8F97F5ED4D00E17C9130D6F7CDE34130270
      SHA-512:A6066F4DF4097DB93673CD156BBE5F910C3F64D01E1671E481BC9FBDD720DBD6F8CEF337E20404F7C6AE97B2FA1F5E67088041ACBB6EA85D6758924D5740D06C
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/tr/index.db.1oKdtr
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/zh_CN/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):2.6210042560348144
      Encrypted:false
      SSDEEP:48:bh5roGafX8XKu5YIoBHtF2YekDsv/KSmGWNmA/y0uJNI/oyjaOUUfEHKn9nnjoEJ:bhdoLfX8N9oBNF2XFn3UD/9FZiy0aoN
      MD5:39398A15564A55EB7BFE895D7668A5A3
      SHA1:28DA677435B87176E08AFABBF8B51F7B93E22948
      SHA-256:A4C0216476E357ED3A23E71333DBE7DE91E04370EF049032EE8E47BB1EDBD83B
      SHA-512:B4E69212338C742F8C83194552078A86E4BED59375D82563C0B4059B7E0D6A58D6317151AB1F2A6FB20D2FF6DB7C550DF6A6984B2BB873A111D58AF9AEB7D95E
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/zh_CN/index.db.U2VzYp
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/zh_TW/5240
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):1.0170167917961734
      Encrypted:false
      SSDEEP:24:bhAvIZuF4ptmpzf50dhOv8WvxjMMhFmMKxevOfOots+:bhDi4p+ahOhFFKxewj
      MD5:1FC5F2B98E5BC25B10373353D91B86B1
      SHA1:D848DA35B0731328195D59C1E996B95C4952F1F9
      SHA-256:509FAD18B4454CD70D974755F6156D4A5FA9B960AB9FF468D1FC350F0B64F379
      SHA-512:95BC2E289EDE5D9A3F56C9D8AE9DD13D9379BE2ABF8927CDABBE92B9F57A8EB667E9C08E4DFD82BF9F1F57118CE6E495722ADA2668AFF4FA0540F46C0A6D5138
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/cache/man/zh_TW/index.db.jmvRhq
      Process:/usr/bin/mandb
      File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
      Category:dropped
      Size (bytes):16384
      Entropy (8bit):0.45676214072558463
      Encrypted:false
      SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
      MD5:EE429C7E8B222AFF73C611A8C358B661
      SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
      SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
      SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
      Malicious:false
      Preview: .W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
      /var/lib/logrotate/status.tmp
      Process:/usr/sbin/logrotate
      File Type:ASCII text
      Category:dropped
      Size (bytes):1607
      Entropy (8bit):4.791993862575465
      Encrypted:false
      SSDEEP:48:UrKqJFNFr0J+K5Npq4pNMJNcsXNU3N6NA515xrtNq4wNZNDNU1LN3o9NhqJNCNqQ:krwdm4puxe3Mm7A4wTteJY+nCA5eC9kR
      MD5:CF9182FDFD94B0BCDB7F2553DF1DC551
      SHA1:08222EAF783C4AE9906DBDF385C7B8AAED167046
      SHA-256:B7A197E756497652FEE95B841822FDA8E6E1A9D4B2D9A347E1F4D30BB71C8789
      SHA-512:508AD8171C43CFF82C078921CA20AA87E08D60445011E1549FC2B6736DFA94545A2E4038D13205C0BF977267922A32B563DB8E6FB5A642A2B2215B235CC13012
      Malicious:false
      Preview: logrotate state -- version 2."/var/log/syslog" 2022-1-15-0:35:32."/var/log/dpkg.log" 2022-1-14-23:35:5."/var/log/speech-dispatcher/debug-flite" 2021-8-20-13:0:0."/var/log/unattended-upgrades/unattended-upgrades.log" 2022-1-14-23:35:5."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2021-9-17-9:23:29."/var/log/auth.log" 2022-1-14-23:35:5."/var/log/apt/term.log" 2022-1-14-23:35:5."/var/log/ppp-connect-errors" 2021-8-20-13:0:0."/var/log/apport.log" 2021-9-17-9:23:29."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2021-8-20-13:0:0."/var/log/apt/history.log" 2022-1-14-23:35:5."/var/log/boot.log" 2021-8-20-13:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/lightdm/*.log" 2021-8-20-13:0:0."/var/log/mail.log" 2021-8-20-13:0:0."/var/log/debug" 2021-8-20-13:0:0."/var/log/kern.log" 2022-1-14-23:35:5."/var/log/cups/access_log" 2022-1-15-0:35:32."/var/log/ufw.log" 2021-8-20-13:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2021-8-20-13:0:0."/var/log/da
      /var/log/cups/access_log.1.gz
      Process:/bin/gzip
      File Type:gzip compressed data, last modified: Fri Jan 14 23:35:05 2022, from Unix
      Category:dropped
      Size (bytes):196
      Entropy (8bit):6.96530059658896
      Encrypted:false
      SSDEEP:3:FtqHMmAqGbnDuUY5y2lCoX23wQ9x8JQtP022yQCMv+bN0fJcWDW3rJ5iNNvOXuz7:X8M3b72lCpvoJQN6Y0RfK3t5bs/z/
      MD5:0B7715182028BFCD7DFFE389C83FD123
      SHA1:8DCE0D2F2260EF4F5A54463FFAEDC9C4A37A0783
      SHA-256:BAE868BDB99D1C4BB9ABD70377BA355E746371AEB12ABF2F7ECE154668CDC7B4
      SHA-512:A08B9004FDCEAB79CC697A43A50F93A7146645576961EE1E5F0DA6C81FCFFF43BF0A088C0EEEB1C8FC6C762DF44C05DE6A20633013A5D8684D315DB7719331CB
      Malicious:false
      Preview: .......a......0......jj.@.+.q..6....i...l.....'.E..7..d......L.....(..= .oM...m[S~....@..T^wQ.....'....!.t......-.....x~......3&..e.^.8p!.......x.UZ.V$e.v.h......8..........v..*...
      /var/log/syslog.1.gz
      Process:/bin/gzip
      File Type:gzip compressed data, last modified: Fri Jan 14 23:35:05 2022, from Unix
      Category:dropped
      Size (bytes):2962
      Entropy (8bit):7.922956020325171
      Encrypted:false
      SSDEEP:48:X8Mf7UUomMM4Vtn/Bvc8HLlsnSbXFFKGUE1XtRRSEUE5mp5tMWdwJB4HhEks:smUUgJVtnnlsnSrFFKGUExR7h5mdpdEX
      MD5:2924AB701C776FB82B82054459D86A61
      SHA1:BA6FA91B3F40B088297A1ADCA92BE3F9064FB4CC
      SHA-256:A772E6582E163B5759FED128D249B1385D147C9E18AF7643D3519CDA8A52F3A5
      SHA-512:CEACEF450D3216EACFBF8315346C65341E26626A48369266555EAE5D61ECE4615EE1D9008CE257360D1E131937916CC3F7FEFCF941ABDBE993B3AE57521AD2D1
      Malicious:false
      Preview: .......a...\is...._...'...-R3.L....g.(.n..x ..X..C..._......R..~.!..{_ ....Gf8.....)N1..F...)...t.d.P..D.qA...o...o....C-0l..SCwz..C..:..N.P....A.7...r#b..}E..1G..zI....G...+.......,..Iq.Dd.Fe.....P.8Oh.g$F.+ ..&IJ...|.s..QJ0=.#o%..E......1&..W.~...j..5..O.4.G8..-.......ScRH>..`.1..y|...H.B..'E&...R...'...d....BS.ND4K..eD`..h.*QLk..`...9M..yo. i.e.1...o.....`.w8.m.p. SBI.E.Mf.L).%..........^.04......y... r..-_...d...CH.|h.._........;.......x..t&....j..$o.@.k*5..`./.1cb.......p7..1. .......i.@..4....F.Z.....b..,..`:.$Nx..{..,..*.H..X..+..<....x.%..v.d..)....-*....[.&1........'.$......e4...X..Z.H..~....O\.I.......3&.(.,.G...."..0pC.D.{A.K$..8......nz.{...z.e.fd;.K.@w]..C....M...>.".....F......}.r......L.Y....nO.x.'.................?Yy....?...8.xs.......[.......~~./.?of.A.V...M...1... .h...q......Z..`..A...]<..o.8...#k..G 3...e.S6.<k."L).h.d...4..E.s.o...8....0.@{...[.._..L]....9...9...+....,.I....'.<.i.x.!."...1..9...g..7H. .A5|...." .D^$T 6....

      Static File Info

      General

      File type:ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped
      Entropy (8bit):7.870193950774575
      TrID:
      • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
      • ELF Executable and Linkable format (generic) (4004/1) 49.84%
      File name:phantom.x86
      File size:24728
      MD5:8bb140fe0754eee2498279f9f1830368
      SHA1:0146917808c967dd97899cd5259de170b67af87b
      SHA256:217a622a111c0d13237c660259617cb1e31943d74a1767a933ddee8ae0b445ac
      SHA512:52a23adbbfd3cade7830976b6e0d64d149593293f7f7ab46f54dd0bc3616f8bf1648ba8ed26382e58ff14886115d1c18ba497d80016fa83ee49790075c57296c
      SSDEEP:768:R/QOC0Yhn6RODyFd4cwNEFCnNBml1YHtfXcs:R/nihnuFnwTNBuktfss
      File Content Preview:.ELF.....................g..4...........4. ...(......................_..._...................W...W..................Q.td...............................tUPX!....................Z........?d..ELF.......d.......4.,..4. (.......k.-.#.`...........?..P......d..l

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, little endian
      Version:1 (current)
      Machine:Intel 80386
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - Linux
      ABI Version:0
      Entry Point Address:0xc067a0
      Flags:0x0
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:0
      Section Header Size:40
      Number of Section Headers:0
      Header String Table Index:0

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00xc010000xc010000x5f9b0x5f9b4.56300x5R E0x1000
      LOAD0x7000x80557000x80557000x00x00.00000x6RW 0x1000
      GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

      Network Behavior

      Network Port Distribution

      TCP Packets

      TimestampSource PortDest PortSource IPDest IP
      Jan 15, 2022 00:35:44.423783064 CET549941312192.168.2.2395.213.159.92
      Jan 15, 2022 00:35:44.427534103 CET1349823192.168.2.23133.41.242.62
      Jan 15, 2022 00:35:44.427548885 CET1349823192.168.2.23211.2.183.44
      Jan 15, 2022 00:35:44.427570105 CET1349823192.168.2.23130.19.79.54
      Jan 15, 2022 00:35:44.427575111 CET1349823192.168.2.23178.157.137.244
      Jan 15, 2022 00:35:44.427582979 CET1349823192.168.2.23109.6.57.138
      Jan 15, 2022 00:35:44.427587032 CET1349823192.168.2.23161.136.130.199
      Jan 15, 2022 00:35:44.427592993 CET1349823192.168.2.2370.189.11.197
      Jan 15, 2022 00:35:44.427602053 CET1349823192.168.2.23133.164.155.201
      Jan 15, 2022 00:35:44.427624941 CET1349823192.168.2.23123.75.64.84
      Jan 15, 2022 00:35:44.427647114 CET1349823192.168.2.23242.255.207.250
      Jan 15, 2022 00:35:44.427654028 CET1349823192.168.2.23112.86.85.56
      Jan 15, 2022 00:35:44.427660942 CET1349823192.168.2.234.125.132.57
      Jan 15, 2022 00:35:44.427666903 CET1349823192.168.2.23204.110.254.139
      Jan 15, 2022 00:35:44.427674055 CET1349823192.168.2.23109.58.109.73
      Jan 15, 2022 00:35:44.427681923 CET1349823192.168.2.23251.189.190.129
      Jan 15, 2022 00:35:44.427687883 CET1349823192.168.2.2370.227.78.220
      Jan 15, 2022 00:35:44.427694082 CET1349823192.168.2.23123.24.171.214
      Jan 15, 2022 00:35:44.427695990 CET1349823192.168.2.2339.181.51.72
      Jan 15, 2022 00:35:44.427697897 CET1349823192.168.2.234.124.98.139
      Jan 15, 2022 00:35:44.427701950 CET1349823192.168.2.2397.136.138.58
      Jan 15, 2022 00:35:44.427711010 CET1349823192.168.2.23166.134.98.188
      Jan 15, 2022 00:35:44.427715063 CET1349823192.168.2.2338.114.98.113
      Jan 15, 2022 00:35:44.427717924 CET1349823192.168.2.23164.117.227.220
      Jan 15, 2022 00:35:44.427728891 CET1349823192.168.2.2395.70.106.36
      Jan 15, 2022 00:35:44.427730083 CET1349823192.168.2.23181.224.98.63
      Jan 15, 2022 00:35:44.427735090 CET1349823192.168.2.2319.142.231.219
      Jan 15, 2022 00:35:44.427742958 CET1349823192.168.2.23151.98.199.101
      Jan 15, 2022 00:35:44.427747011 CET1349823192.168.2.23202.221.208.62
      Jan 15, 2022 00:35:44.427753925 CET1349823192.168.2.23218.97.170.240
      Jan 15, 2022 00:35:44.427757978 CET1349823192.168.2.23108.143.98.38
      Jan 15, 2022 00:35:44.427762032 CET1349823192.168.2.23120.12.192.129
      Jan 15, 2022 00:35:44.427779913 CET1349823192.168.2.23208.187.121.164
      Jan 15, 2022 00:35:44.427784920 CET1349823192.168.2.23155.52.144.229
      Jan 15, 2022 00:35:44.427809000 CET1349823192.168.2.23101.192.210.96
      Jan 15, 2022 00:35:44.427824974 CET1349823192.168.2.2334.233.85.250
      Jan 15, 2022 00:35:44.427844048 CET1349823192.168.2.23182.181.130.122
      Jan 15, 2022 00:35:44.427844048 CET1349823192.168.2.2353.96.142.168
      Jan 15, 2022 00:35:44.427844048 CET1349823192.168.2.2346.245.250.75
      Jan 15, 2022 00:35:44.427854061 CET1349823192.168.2.23186.83.155.129
      Jan 15, 2022 00:35:44.427855968 CET1349823192.168.2.23194.17.138.51
      Jan 15, 2022 00:35:44.427858114 CET1349823192.168.2.2365.142.208.101
      Jan 15, 2022 00:35:44.427861929 CET1349823192.168.2.2313.233.191.221
      Jan 15, 2022 00:35:44.427862883 CET1349823192.168.2.235.195.74.110
      Jan 15, 2022 00:35:44.427865028 CET1349823192.168.2.23201.229.100.155
      Jan 15, 2022 00:35:44.427865028 CET1349823192.168.2.23128.1.73.198
      Jan 15, 2022 00:35:44.427880049 CET1349823192.168.2.2396.66.28.90
      Jan 15, 2022 00:35:44.427884102 CET1349823192.168.2.23183.160.210.137
      Jan 15, 2022 00:35:44.427887917 CET1349823192.168.2.23153.121.164.50
      Jan 15, 2022 00:35:44.427895069 CET1349823192.168.2.23156.53.58.171
      Jan 15, 2022 00:35:44.427897930 CET1349823192.168.2.23162.39.54.83
      Jan 15, 2022 00:35:44.427901983 CET1349823192.168.2.231.29.111.224
      Jan 15, 2022 00:35:44.427911043 CET1349823192.168.2.23141.140.40.36
      Jan 15, 2022 00:35:44.427917957 CET1349823192.168.2.23212.104.216.221
      Jan 15, 2022 00:35:44.427927971 CET1349823192.168.2.23117.32.165.32
      Jan 15, 2022 00:35:44.427932024 CET1349823192.168.2.23133.144.14.15
      Jan 15, 2022 00:35:44.427934885 CET1349823192.168.2.23203.23.80.37
      Jan 15, 2022 00:35:44.427937984 CET1349823192.168.2.23138.213.87.243
      Jan 15, 2022 00:35:44.427947044 CET1349823192.168.2.232.155.163.138
      Jan 15, 2022 00:35:44.427952051 CET1349823192.168.2.23138.246.66.147
      Jan 15, 2022 00:35:44.427953959 CET1349823192.168.2.23115.79.85.10
      Jan 15, 2022 00:35:44.427957058 CET1349823192.168.2.23149.134.123.203
      Jan 15, 2022 00:35:44.427968025 CET1349823192.168.2.2362.227.2.41
      Jan 15, 2022 00:35:44.427970886 CET1349823192.168.2.23185.81.135.5
      Jan 15, 2022 00:35:44.427978039 CET1349823192.168.2.23103.250.217.188
      Jan 15, 2022 00:35:44.427978992 CET1349823192.168.2.2371.49.191.247
      Jan 15, 2022 00:35:44.427984953 CET1349823192.168.2.23245.185.3.100
      Jan 15, 2022 00:35:44.427987099 CET1349823192.168.2.2396.247.44.219
      Jan 15, 2022 00:35:44.427989960 CET1349823192.168.2.2346.216.61.207
      Jan 15, 2022 00:35:44.427992105 CET1349823192.168.2.23185.230.21.235
      Jan 15, 2022 00:35:44.427994013 CET1349823192.168.2.23115.124.106.134
      Jan 15, 2022 00:35:44.427994013 CET1349823192.168.2.23191.99.47.24
      Jan 15, 2022 00:35:44.427999020 CET1349823192.168.2.2393.74.3.7
      Jan 15, 2022 00:35:44.428002119 CET1349823192.168.2.23158.170.129.194
      Jan 15, 2022 00:35:44.428003073 CET1349823192.168.2.23101.17.205.165
      Jan 15, 2022 00:35:44.428004980 CET1349823192.168.2.2377.78.45.64
      Jan 15, 2022 00:35:44.428006887 CET1349823192.168.2.2335.117.157.234
      Jan 15, 2022 00:35:44.428011894 CET1349823192.168.2.23250.114.165.22
      Jan 15, 2022 00:35:44.428020000 CET1349823192.168.2.2323.183.118.2
      Jan 15, 2022 00:35:44.428020000 CET1349823192.168.2.2384.5.23.195
      Jan 15, 2022 00:35:44.428025007 CET1349823192.168.2.2370.132.194.55
      Jan 15, 2022 00:35:44.428025961 CET1349823192.168.2.2324.120.1.250
      Jan 15, 2022 00:35:44.428041935 CET1349823192.168.2.23135.88.15.164
      Jan 15, 2022 00:35:44.428045988 CET1349823192.168.2.23155.127.42.146
      Jan 15, 2022 00:35:44.428045988 CET1349823192.168.2.23193.177.199.122
      Jan 15, 2022 00:35:44.428056955 CET1349823192.168.2.2319.203.69.158
      Jan 15, 2022 00:35:44.428057909 CET1349823192.168.2.2367.243.193.25
      Jan 15, 2022 00:35:44.428065062 CET1349823192.168.2.2371.224.179.102
      Jan 15, 2022 00:35:44.428071976 CET1349823192.168.2.2393.124.235.175
      Jan 15, 2022 00:35:44.428073883 CET1349823192.168.2.23117.174.46.125
      Jan 15, 2022 00:35:44.428076982 CET1349823192.168.2.23171.31.254.180
      Jan 15, 2022 00:35:44.428092957 CET1349823192.168.2.2398.240.127.89
      Jan 15, 2022 00:35:44.428092957 CET1349823192.168.2.2389.238.165.36
      Jan 15, 2022 00:35:44.428098917 CET1349823192.168.2.23184.146.197.71
      Jan 15, 2022 00:35:44.428102016 CET1349823192.168.2.23243.91.140.148
      Jan 15, 2022 00:35:44.428107977 CET1349823192.168.2.2339.245.244.6
      Jan 15, 2022 00:35:44.428111076 CET1349823192.168.2.2348.254.194.87
      Jan 15, 2022 00:35:44.428116083 CET1349823192.168.2.23193.66.68.138
      Jan 15, 2022 00:35:44.428119898 CET1349823192.168.2.23157.164.208.58
      Jan 15, 2022 00:35:44.428128958 CET1349823192.168.2.2377.10.225.154

      System Behavior

      Analysis Process: systemd PID: 5192 Parent PID: 1

      General

      Start time:00:35:31
      Start date:15/01/2022
      Path:/usr/lib/systemd/systemd
      Arguments:n/a
      File size:1620224 bytes
      MD5 hash:9b2bec7092a40488108543f9334aab75

      Analysis Process: logrotate PID: 5192 Parent PID: 1

      General

      Start time:00:35:31
      Start date:15/01/2022
      Path:/usr/sbin/logrotate
      Arguments:/usr/sbin/logrotate /etc/logrotate.conf
      File size:84056 bytes
      MD5 hash:ff9f6831debb63e53a31ff8057143af6

      Analysis Process: logrotate PID: 5233 Parent PID: 5192

      General

      Start time:00:35:32
      Start date:15/01/2022
      Path:/usr/sbin/logrotate
      Arguments:n/a
      File size:84056 bytes
      MD5 hash:ff9f6831debb63e53a31ff8057143af6

      Analysis Process: gzip PID: 5233 Parent PID: 5192

      General

      Start time:00:35:32
      Start date:15/01/2022
      Path:/bin/gzip
      Arguments:/bin/gzip
      File size:97496 bytes
      MD5 hash:beef4e1f54ec90564d2acd57c0b0c897

      Analysis Process: logrotate PID: 5236 Parent PID: 5192

      General

      Start time:00:35:32
      Start date:15/01/2022
      Path:/usr/sbin/logrotate
      Arguments:n/a
      File size:84056 bytes
      MD5 hash:ff9f6831debb63e53a31ff8057143af6

      Analysis Process: sh PID: 5236 Parent PID: 5192

      General

      Start time:00:35:32
      Start date:15/01/2022
      Path:/bin/sh
      Arguments:sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: sh PID: 5237 Parent PID: 5236

      General

      Start time:00:35:32
      Start date:15/01/2022
      Path:/bin/sh
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: invoke-rc.d PID: 5237 Parent PID: 5236

      General

      Start time:00:35:32
      Start date:15/01/2022
      Path:/usr/sbin/invoke-rc.d
      Arguments:invoke-rc.d --quiet cups restart
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: invoke-rc.d PID: 5238 Parent PID: 5237

      General

      Start time:00:35:32
      Start date:15/01/2022
      Path:/usr/sbin/invoke-rc.d
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: runlevel PID: 5238 Parent PID: 5237

      General

      Start time:00:35:32
      Start date:15/01/2022
      Path:/sbin/runlevel
      Arguments:/sbin/runlevel
      File size:996584 bytes
      MD5 hash:4deddfb6741481f68aeac522cc26ff4b

      Analysis Process: invoke-rc.d PID: 5239 Parent PID: 5237

      General

      Start time:00:35:32
      Start date:15/01/2022
      Path:/usr/sbin/invoke-rc.d
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: systemctl PID: 5239 Parent PID: 5237

      General

      Start time:00:35:32
      Start date:15/01/2022
      Path:/usr/bin/systemctl
      Arguments:systemctl --quiet is-enabled cups.service
      File size:996584 bytes
      MD5 hash:4deddfb6741481f68aeac522cc26ff4b

      Analysis Process: invoke-rc.d PID: 5242 Parent PID: 5237

      General

      Start time:00:35:34
      Start date:15/01/2022
      Path:/usr/sbin/invoke-rc.d
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: ls PID: 5242 Parent PID: 5237

      General

      Start time:00:35:34
      Start date:15/01/2022
      Path:/usr/bin/ls
      Arguments:ls /etc/rc[S2345].d/S[0-9][0-9]cups
      File size:142144 bytes
      MD5 hash:e7793f15c2ff7e747b4bc7079f5cd4f7

      Analysis Process: invoke-rc.d PID: 5243 Parent PID: 5237

      General

      Start time:00:35:34
      Start date:15/01/2022
      Path:/usr/sbin/invoke-rc.d
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: systemctl PID: 5243 Parent PID: 5237

      General

      Start time:00:35:34
      Start date:15/01/2022
      Path:/usr/bin/systemctl
      Arguments:systemctl --quiet is-active cups.service
      File size:996584 bytes
      MD5 hash:4deddfb6741481f68aeac522cc26ff4b

      Analysis Process: logrotate PID: 5244 Parent PID: 5192

      General

      Start time:00:35:34
      Start date:15/01/2022
      Path:/usr/sbin/logrotate
      Arguments:n/a
      File size:84056 bytes
      MD5 hash:ff9f6831debb63e53a31ff8057143af6

      Analysis Process: gzip PID: 5244 Parent PID: 5192

      General

      Start time:00:35:34
      Start date:15/01/2022
      Path:/bin/gzip
      Arguments:/bin/gzip
      File size:97496 bytes
      MD5 hash:beef4e1f54ec90564d2acd57c0b0c897

      Analysis Process: logrotate PID: 5245 Parent PID: 5192

      General

      Start time:00:35:34
      Start date:15/01/2022
      Path:/usr/sbin/logrotate
      Arguments:n/a
      File size:84056 bytes
      MD5 hash:ff9f6831debb63e53a31ff8057143af6

      Analysis Process: sh PID: 5245 Parent PID: 5192

      General

      Start time:00:35:34
      Start date:15/01/2022
      Path:/bin/sh
      Arguments:sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: sh PID: 5246 Parent PID: 5245

      General

      Start time:00:35:34
      Start date:15/01/2022
      Path:/bin/sh
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: rsyslog-rotate PID: 5246 Parent PID: 5245

      General

      Start time:00:35:34
      Start date:15/01/2022
      Path:/usr/lib/rsyslog/rsyslog-rotate
      Arguments:/usr/lib/rsyslog/rsyslog-rotate
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: rsyslog-rotate PID: 5247 Parent PID: 5246

      General

      Start time:00:35:34
      Start date:15/01/2022
      Path:/usr/lib/rsyslog/rsyslog-rotate
      Arguments:n/a
      File size:129816 bytes
      MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

      Analysis Process: systemctl PID: 5247 Parent PID: 5246

      General

      Start time:00:35:34
      Start date:15/01/2022
      Path:/usr/bin/systemctl
      Arguments:systemctl kill -s HUP rsyslog.service
      File size:996584 bytes
      MD5 hash:4deddfb6741481f68aeac522cc26ff4b

      Analysis Process: systemd PID: 5193 Parent PID: 1

      General

      Start time:00:35:31
      Start date:15/01/2022
      Path:/usr/lib/systemd/systemd
      Arguments:n/a
      File size:1620224 bytes
      MD5 hash:9b2bec7092a40488108543f9334aab75

      Analysis Process: install PID: 5193 Parent PID: 1

      General

      Start time:00:35:31
      Start date:15/01/2022
      Path:/usr/bin/install
      Arguments:/usr/bin/install -d -o man -g man -m 0755 /var/cache/man
      File size:158112 bytes
      MD5 hash:55e2520049dc6a62e8c94732e36cdd54

      Analysis Process: systemd PID: 5232 Parent PID: 1

      General

      Start time:00:35:31
      Start date:15/01/2022
      Path:/usr/lib/systemd/systemd
      Arguments:n/a
      File size:1620224 bytes
      MD5 hash:9b2bec7092a40488108543f9334aab75

      Analysis Process: find PID: 5232 Parent PID: 1

      General

      Start time:00:35:31
      Start date:15/01/2022
      Path:/usr/bin/find
      Arguments:/usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete
      File size:320160 bytes
      MD5 hash:b68ef002f84cc54dd472238ba7df80ab

      Analysis Process: systemd PID: 5240 Parent PID: 1

      General

      Start time:00:35:32
      Start date:15/01/2022
      Path:/usr/lib/systemd/systemd
      Arguments:n/a
      File size:1620224 bytes
      MD5 hash:9b2bec7092a40488108543f9334aab75

      Analysis Process: mandb PID: 5240 Parent PID: 1

      General

      Start time:00:35:32
      Start date:15/01/2022
      Path:/usr/bin/mandb
      Arguments:/usr/bin/mandb --quiet
      File size:142432 bytes
      MD5 hash:1dda5ea0027ecf1c2db0f5a3de7e6941

      Analysis Process: phantom.x86 PID: 5278 Parent PID: 5117

      General

      Start time:00:35:43
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:/tmp/phantom.x86
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5279 Parent PID: 5278

      General

      Start time:00:35:43
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5372 Parent PID: 5279

      General

      Start time:00:38:32
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5374 Parent PID: 5279

      General

      Start time:00:38:32
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5375 Parent PID: 5374

      General

      Start time:00:38:32
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5381 Parent PID: 5375

      General

      Start time:00:38:37
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5382 Parent PID: 5375

      General

      Start time:00:38:37
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5376 Parent PID: 5374

      General

      Start time:00:38:32
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5377 Parent PID: 5374

      General

      Start time:00:38:32
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5280 Parent PID: 5278

      General

      Start time:00:35:43
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5281 Parent PID: 5278

      General

      Start time:00:35:43
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5282 Parent PID: 5281

      General

      Start time:00:35:43
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5371 Parent PID: 5282

      General

      Start time:00:38:32
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5373 Parent PID: 5282

      General

      Start time:00:38:32
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5283 Parent PID: 5281

      General

      Start time:00:35:43
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368

      Analysis Process: phantom.x86 PID: 5284 Parent PID: 5281

      General

      Start time:00:35:43
      Start date:15/01/2022
      Path:/tmp/phantom.x86
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:8bb140fe0754eee2498279f9f1830368