Linux Analysis Report
1isequal9.arm7

Overview

General Information

Sample Name: 1isequal9.arm7
Analysis ID: 626544
MD5: c798ceff4aaaf18c02b544d6ef56def9
SHA1: b8ef596aad37bb69bcdb0191d5a50ed6aedfa3f1
SHA256: 63275088f5f653385fce127219b64d70e2c6b6c5511568d27997b2496d7c573e
Infos:

Detection

Mirai
Score: 64
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Reads system files that contain records of logged in users
Contains symbols with names commonly found in malware
Sample tries to kill multiple processes (SIGKILL)
Sample reads /proc/mounts (often used for finding a writable filesystem)
Executes the "kill" or "pkill" command typically used to terminate processes
Reads CPU information from /sys indicative of miner or evasive malware
Yara signature match
Executes the "grep" command used to find patterns in files or piped streams
Reads system information from the proc file system
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample contains symbols with suspicious names
Deletes log files
Creates hidden files and/or directories
Sample tries to set the executable flag
Executes commands using a shell command-line interpreter

Classification

Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pulseaudio (PID: 6321) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 6428) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Sample listens on a socket
Source: /tmp/1isequal9.arm7 (PID: 6226) Socket: 127.0.0.1::59025 Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6450) Socket: <unknown socket type>:unknown Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6482) Socket: <unknown socket type>:unknown Jump to behavior
Source: syslog.35.dr String found in binary or memory: https://www.rsyslog.com

System Summary
barindex
Contains symbols with names commonly found in malware
Source: ELF static info symbol of initial sample Name: attack.c
Source: ELF static info symbol of initial sample Name: attack_app.c
Source: ELF static info symbol of initial sample Name: attack_get_opt_int
Source: ELF static info symbol of initial sample Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample Name: attack_get_opt_str
Source: ELF static info symbol of initial sample Name: attack_gre.c
Source: ELF static info symbol of initial sample Name: attack_gre_eth
Source: ELF static info symbol of initial sample Name: attack_gre_ip
Source: ELF static info symbol of initial sample Name: attack_init
Source: ELF static info symbol of initial sample Name: attack_method_http
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 491, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 721, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 761, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 772, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 774, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 777, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 785, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 793, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1344, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1601, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1860, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1886, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 2048, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 6044, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 6190, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 6191, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 6230, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 6234, result: unknown Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6507) SIGKILL sent: pid: 6505, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6515) SIGKILL sent: pid: 6513, result: successful Jump to behavior
Yara signature match
Source: 1isequal9.arm7, type: SAMPLE Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6226.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6229.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6234.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6226.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6507.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6507.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6513.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6230.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6233.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6229.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6515.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6513.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6230.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6505.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6234.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6505.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6515.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Source: 6233.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORY Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
Sample tries to kill a process (SIGKILL)
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 491, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 721, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 761, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 772, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 774, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 777, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 785, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 793, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1344, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1601, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1860, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 1886, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 2048, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 6044, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 6190, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 6191, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 6230, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6234) SIGKILL sent: pid: 6234, result: unknown Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6507) SIGKILL sent: pid: 6505, result: successful Jump to behavior
Source: /tmp/1isequal9.arm7 (PID: 6515) SIGKILL sent: pid: 6513, result: successful Jump to behavior
Sample contains symbols with suspicious names
Source: ELF static info symbol of initial sample Name: scanner.c
Source: ELF static info symbol of initial sample Name: scanner_init
Source: ELF static info symbol of initial sample Name: scanner_kill
Source: ELF static info symbol of initial sample Name: scanner_pid
Source: ELF static info symbol of initial sample Name: scanner_rawpkt
Source: classification engine Classification label: mal64.spre.troj.linARM7@0/45@0/0

Persistence and Installation Behavior
barindex
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /usr/bin/dbus-daemon (PID: 6306) File: /proc/6306/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6482) File: /proc/6482/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6489) File: /proc/6489/mounts Jump to behavior
Source: /bin/fusermount (PID: 6498) File: /proc/6498/mounts Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6547) File: /proc/6547/mounts Jump to behavior
Executes the "kill" or "pkill" command typically used to terminate processes
Source: /usr/share/gdm/generate-config (PID: 6428) Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service Jump to behavior
Executes the "grep" command used to find patterns in files or piped streams
Source: /bin/sh (PID: 6407) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 6409) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 6411) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 6416) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 6418) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 6420) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 6424) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf Jump to behavior
Source: /bin/sh (PID: 6426) Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf Jump to behavior
Source: /bin/sh (PID: 6474) Grep executable: /usr/bin/grep -> grep -F .utf8 Jump to behavior
Reads system information from the proc file system
Source: /lib/systemd/systemd-journald (PID: 6262) Reads from proc file: /proc/meminfo Jump to behavior
Enumerates processes within the "proc" file system
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6395/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6395/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6395/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6395/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6395/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6395/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6395/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6475/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6475/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6475/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6475/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6475/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6475/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/6475/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2078/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2078/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2078/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2078/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2078/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2078/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2078/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2077/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2077/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2077/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2077/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2077/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2077/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2077/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2033/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2033/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2033/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2033/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2033/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2033/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2033/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2074/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2074/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2074/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2074/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2074/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2074/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2074/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2028/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1532/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1532/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1532/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1532/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1532/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1532/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1532/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/1334/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2302/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2302/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2302/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2302/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2302/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2302/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2302/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2025/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2025/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2025/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2025/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2025/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2025/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2025/cgroup Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2223/comm Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2223/cmdline Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2223/status Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2223/attr/current Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2223/sessionid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2223/loginuid Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) File opened: /proc/2223/cgroup Jump to behavior
Creates hidden files and/or directories
Source: /usr/bin/whoopsie (PID: 6317) Directory: /nonexistent/.cache Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6389) Directory: /root/.cache Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6480) Directory: /var/lib/gdm3/.cache Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6456) Directory: /root/.cache Jump to behavior
Sample tries to set the executable flag
Source: /usr/sbin/gdm3 (PID: 6450) File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx) Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6450) File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx) Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6456) File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx) Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6456) File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx) Jump to behavior
Executes commands using a shell command-line interpreter
Source: /usr/bin/gpu-manager (PID: 6406) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6408) Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6410) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6415) Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6417) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6419) Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6423) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf" Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6425) Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf" Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6470) Shell command executed: sh -c "locale -a | grep -F .utf8 " Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6395) Log file created: /var/log/auth.log Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6395) Log file created: /var/log/kern.log Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6405) Log file created: /var/log/gpu-manager.log Jump to dropped file
Reads CPU information from /sys indicative of miner or evasive malware
Source: /usr/bin/pulseaudio (PID: 6321) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /usr/bin/pkill (PID: 6428) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/1isequal9.arm7 (PID: 6226) Queries kernel information via 'uname': Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6262) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/whoopsie (PID: 6317) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6321) Queries kernel information via 'uname': Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6395) Queries kernel information via 'uname': Jump to behavior
Source: /sbin/agetty (PID: 6398) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6405) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6475) Queries kernel information via 'uname': Jump to behavior
Deletes log files
Source: /usr/bin/gpu-manager (PID: 6405) Truncated file: /var/log/gpu-manager.log Jump to behavior
Source: syslog.35.dr Binary or memory string: May 14 12:00:20 galassia kernel: [ 479.246636] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: syslog.35.dr Binary or memory string: May 14 12:00:20 galassia kernel: [ 479.246585] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: 1isequal9.arm7, 6226.1.000000003680e83a.000000005c5c2243.rw-.sdmp, 1isequal9.arm7, 6229.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6230.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6233.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6234.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6505.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6507.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6513.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6515.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp Binary or memory string: "V!/etc/qemu-binfmt/arm
Source: 1isequal9.arm7, 6234.1.00000000fc8940c5.0000000022e68779.rw-.sdmp Binary or memory string: /tmp/qemu-open.2u2bbA
Source: 1isequal9.arm7, 6226.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6229.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6230.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6233.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6234.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6505.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6507.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6513.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6515.1.00000000fc8940c5.0000000022e68779.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/1isequal9.arm7SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/1isequal9.arm7
Source: 1isequal9.arm7, 6226.1.000000003680e83a.000000005c5c2243.rw-.sdmp, 1isequal9.arm7, 6229.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6230.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6233.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6234.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6505.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6507.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6513.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6515.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: 1isequal9.arm7, 6226.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6229.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6230.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6233.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6234.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6505.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6507.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6513.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6515.1.00000000fc8940c5.0000000022e68779.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm
Source: 1isequal9.arm7, 6234.1.00000000fc8940c5.0000000022e68779.rw-.sdmp Binary or memory string: "V/tmp/qemu-open.2u2bbA

Language, Device and Operating System Detection
barindex
Reads system files that contain records of logged in users
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6456) Logged in records file read: /var/log/wtmp Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 1isequal9.arm7, type: SAMPLE

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 1isequal9.arm7, type: SAMPLE

No Screenshots

⊘No contacted IP infos