Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
z0r0.arm
|
ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
|
initial sample
|
 |
|
|
/var/cache/man/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/cs/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/cs/index.db.CA1Hw9
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/da/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/da/index.db.zhekg9
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/de/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/de/index.db.fTJLlc
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/es/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/es/index.db.a9fyec
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/fi/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/fi/index.db.G8ou08
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/fr.ISO8859-1/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/fr.ISO8859-1/index.db.6Hajwa
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/fr.UTF-8/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/fr.UTF-8/index.db.6IONkc
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/fr/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/fr/index.db.mrioFb
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/hu/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/hu/index.db.jLE9Wb
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/id/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/id/index.db.ISobd9
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/index.db.rglO39
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/it/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/it/index.db.e1tcA9
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/ja/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/ja/index.db.OPIWaa
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/ko/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/ko/index.db.03VMC8
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/nl/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/nl/index.db.sHZStb
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/pl/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/pl/index.db.LJNDwc
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/pt/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/pt/index.db.1paJGa
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/pt_BR/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/pt_BR/index.db.MgN2kc
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/ru/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/ru/index.db.cAekB8
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/sl/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/sl/index.db.AOLa0b
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/sr/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/sr/index.db.b8Rqjb
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/sv/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/sv/index.db.xcGBu9
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/tr/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/tr/index.db.Ri204b
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/zh_CN/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/zh_CN/index.db.IBKjA8
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/zh_TW/5263
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/cache/man/zh_TW/index.db.x40HWb
|
GNU dbm 1.x or ndbm database, little endian, 64-bit
|
dropped
|
||
|
/var/lib/logrotate/status.tmp
|
ASCII text
|
dropped
|
||
|
/var/log/cups/access_log.1.gz
|
gzip compressed data, last modified: Fri Jan 28 23:14:24 2022, from Unix
|
dropped
|
||
|
/var/log/syslog.1.gz
|
gzip compressed data, last modified: Fri Jan 28 23:14:24 2022, from Unix
|
dropped
|
There are 44 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
/usr/lib/systemd/systemd
|
n/a
|
||
|
/usr/sbin/logrotate
|
/usr/sbin/logrotate /etc/logrotate.conf
|
||
|
/usr/sbin/logrotate
|
n/a
|
||
|
/bin/gzip
|
/bin/gzip
|
||
|
/usr/sbin/logrotate
|
n/a
|
||
|
/bin/sh
|
sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "
|
||
|
/bin/sh
|
n/a
|
||
|
/usr/sbin/invoke-rc.d
|
invoke-rc.d --quiet cups restart
|
||
|
/usr/sbin/invoke-rc.d
|
n/a
|
||
|
/sbin/runlevel
|
/sbin/runlevel
|
||
|
/usr/sbin/invoke-rc.d
|
n/a
|
||
|
/usr/bin/systemctl
|
systemctl --quiet is-enabled cups.service
|
||
|
/usr/sbin/invoke-rc.d
|
n/a
|
||
|
/usr/bin/ls
|
ls /etc/rc[S2345].d/S[0-9][0-9]cups
|
||
|
/usr/sbin/invoke-rc.d
|
n/a
|
||
|
/usr/bin/systemctl
|
systemctl --quiet is-active cups.service
|
||
|
/usr/sbin/logrotate
|
n/a
|
||
|
/bin/gzip
|
/bin/gzip
|
||
|
/usr/sbin/logrotate
|
n/a
|
||
|
/bin/sh
|
sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog
|
||
|
/bin/sh
|
n/a
|
||
|
/usr/lib/rsyslog/rsyslog-rotate
|
/usr/lib/rsyslog/rsyslog-rotate
|
||
|
/usr/lib/rsyslog/rsyslog-rotate
|
n/a
|
||
|
/usr/bin/systemctl
|
systemctl kill -s HUP rsyslog.service
|
||
|
/usr/lib/systemd/systemd
|
n/a
|
||
|
/usr/bin/install
|
/usr/bin/install -d -o man -g man -m 0755 /var/cache/man
|
||
|
/usr/lib/systemd/systemd
|
n/a
|
||
|
/usr/bin/find
|
/usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete
|
||
|
/usr/lib/systemd/systemd
|
n/a
|
||
|
/usr/bin/mandb
|
/usr/bin/mandb --quiet
|
||
|
/tmp/z0r0.arm
|
/tmp/z0r0.arm
|
There are 21 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://upx.sf.net
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
109.202.202.202
|
unknown
|
Switzerland
|
||
|
91.189.91.43
|
unknown
|
United Kingdom
|
||
|
91.189.91.42
|
unknown
|
United Kingdom
|