Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
1isequal9.arm7

Overview

General Information

Sample Name:1isequal9.arm7
Analysis ID:626544
MD5:c798ceff4aaaf18c02b544d6ef56def9
SHA1:b8ef596aad37bb69bcdb0191d5a50ed6aedfa3f1
SHA256:63275088f5f653385fce127219b64d70e2c6b6c5511568d27997b2496d7c573e
Infos:

Detection

Mirai
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Reads system files that contain records of logged in users
Contains symbols with names commonly found in malware
Sample tries to kill multiple processes (SIGKILL)
Sample reads /proc/mounts (often used for finding a writable filesystem)
Executes the "kill" or "pkill" command typically used to terminate processes
Reads CPU information from /sys indicative of miner or evasive malware
Yara signature match
Executes the "grep" command used to find patterns in files or piped streams
Reads system information from the proc file system
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sample contains symbols with suspicious names
Deletes log files
Creates hidden files and/or directories
Sample tries to set the executable flag
Executes commands using a shell command-line interpreter

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.
Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:626544
Start date and time: 14/05/202211:58:312022-05-14 11:58:31 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 21s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:1isequal9.arm7
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal64.spre.troj.linARM7@0/45@0/0
  • Connection to analysis system has been lost, crash info: Unknown
  • VT rate limit hit for: 1isequal9.arm7
Command:/tmp/1isequal9.arm7
PID:6226
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
VegaSec-KATANA001
Standard Error:
  • system is lnxubuntu20
  • systemd New Fork (PID: 6245, Parent: 1)
  • journalctl (PID: 6245, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var
  • systemd New Fork (PID: 6262, Parent: 1)
  • systemd-journald (PID: 6262, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald
  • systemd New Fork (PID: 6265, Parent: 1)
  • journalctl (PID: 6265, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush
  • systemd New Fork (PID: 6306, Parent: 1)
  • dbus-daemon (PID: 6306, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
  • systemd New Fork (PID: 6317, Parent: 1)
  • whoopsie (PID: 6317, Parent: 1, MD5: d3a6915d0e7398fb4c89a037c13959c8) Arguments: /usr/bin/whoopsie -f
  • systemd New Fork (PID: 6321, Parent: 1860)
  • pulseaudio (PID: 6321, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal
  • systemd New Fork (PID: 6324, Parent: 1)
  • rtkit-daemon (PID: 6324, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon
  • systemd New Fork (PID: 6327, Parent: 1)
  • systemd-logind (PID: 6327, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind
  • systemd New Fork (PID: 6389, Parent: 1)
  • polkitd (PID: 6389, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug
  • systemd New Fork (PID: 6395, Parent: 1)
  • rsyslogd (PID: 6395, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE
  • systemd New Fork (PID: 6398, Parent: 1)
  • agetty (PID: 6398, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux
  • gdm3 New Fork (PID: 6399, Parent: 1320)
  • Default (PID: 6399, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default
  • gdm3 New Fork (PID: 6403, Parent: 1320)
  • Default (PID: 6403, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default
  • gdm3 New Fork (PID: 6404, Parent: 1320)
  • Default (PID: 6404, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default
  • systemd New Fork (PID: 6405, Parent: 1)
  • gpu-manager (PID: 6405, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log
    • sh (PID: 6406, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"
      • sh New Fork (PID: 6407, Parent: 6406)
      • grep (PID: 6407, Parent: 6406, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
    • sh (PID: 6408, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"
      • sh New Fork (PID: 6409, Parent: 6408)
      • grep (PID: 6409, Parent: 6408, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
    • sh (PID: 6410, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"
      • sh New Fork (PID: 6411, Parent: 6410)
      • grep (PID: 6411, Parent: 6410, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
    • sh (PID: 6415, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"
      • sh New Fork (PID: 6416, Parent: 6415)
      • grep (PID: 6416, Parent: 6415, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
    • sh (PID: 6417, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"
      • sh New Fork (PID: 6418, Parent: 6417)
      • grep (PID: 6418, Parent: 6417, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
    • sh (PID: 6419, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"
      • sh New Fork (PID: 6420, Parent: 6419)
      • grep (PID: 6420, Parent: 6419, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
    • sh (PID: 6423, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"
      • sh New Fork (PID: 6424, Parent: 6423)
      • grep (PID: 6424, Parent: 6423, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
    • sh (PID: 6425, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"
      • sh New Fork (PID: 6426, Parent: 6425)
      • grep (PID: 6426, Parent: 6425, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
  • systemd New Fork (PID: 6427, Parent: 1)
  • generate-config (PID: 6427, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config
    • pkill (PID: 6428, Parent: 6427, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service
  • systemd New Fork (PID: 6431, Parent: 1)
  • gdm-wait-for-drm (PID: 6431, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm
  • systemd New Fork (PID: 6450, Parent: 1)
  • gdm3 (PID: 6450, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3
    • gdm3 New Fork (PID: 6455, Parent: 6450)
    • plymouth (PID: 6455, Parent: 6450, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping
    • gdm3 New Fork (PID: 6475, Parent: 6450)
    • gdm-session-worker (PID: 6475, Parent: 6450, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"
      • gdm-wayland-session (PID: 6480, Parent: 6475, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"
        • dbus-daemon (PID: 6482, Parent: 6480, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session
          • dbus-daemon New Fork (PID: 6486, Parent: 6482)
            • false (PID: 6487, Parent: 6486, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false
        • dbus-run-session (PID: 6488, Parent: 6480, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
          • dbus-daemon (PID: 6489, Parent: 6488, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session
    • gdm3 New Fork (PID: 6490, Parent: 6450)
    • Default (PID: 6490, Parent: 6450, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default
    • gdm3 New Fork (PID: 6491, Parent: 6450)
    • Default (PID: 6491, Parent: 6450, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default
  • systemd New Fork (PID: 6456, Parent: 1)
  • accounts-daemon (PID: 6456, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon
    • language-validate (PID: 6468, Parent: 6456, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8
      • language-options (PID: 6469, Parent: 6468, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options
        • sh (PID: 6470, Parent: 6469, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "
          • sh New Fork (PID: 6473, Parent: 6470)
          • locale (PID: 6473, Parent: 6470, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a
          • sh New Fork (PID: 6474, Parent: 6470)
          • grep (PID: 6474, Parent: 6470, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8
  • fusermount (PID: 6498, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs
  • systemd New Fork (PID: 6547, Parent: 1860)
  • dbus-daemon (PID: 6547, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
  • cleanup
SourceRuleDescriptionAuthorStrings
1isequal9.arm7SUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x171d8:$xo1: \x18:/<994z`{e
  • 0x17250:$xo1: \x18:/<994z`{e
  • 0x172c8:$xo1: \x18:/<994z`{e
  • 0x1731c:$xo1: \x18:/<994z`{e
  • 0x17394:$xo1: \x18:/<994z`{e
  • 0x1740c:$xo1: \x18:/<994z`{e
  • 0x17484:$xo1: \x18:/<994z`{e
  • 0x174f4:$xo1: \x18:/<994z`{e
  • 0x17570:$xo1: \x18:/<994z`{e
  • 0x175c0:$xo1: \x18:/<994z`{e
1isequal9.arm7JoeSecurity_Mirai_8Yara detected MiraiJoe Security
    SourceRuleDescriptionAuthorStrings
    6226.1.0000000097c8e407.000000009c2c05b8.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x3f00:$xo1: \x18:/<994z`{e
    • 0x3f78:$xo1: \x18:/<994z`{e
    • 0x3ff0:$xo1: \x18:/<994z`{e
    • 0x4048:$xo1: \x18:/<994z`{e
    • 0x40c0:$xo1: \x18:/<994z`{e
    • 0x4138:$xo1: \x18:/<994z`{e
    • 0x41b8:$xo1: \x18:/<994z`{e
    • 0x4230:$xo1: \x18:/<994z`{e
    • 0x42b0:$xo1: \x18:/<994z`{e
    • 0x4308:$xo1: \x18:/<994z`{e
    6229.1.0000000097c8e407.000000009c2c05b8.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x3f00:$xo1: \x18:/<994z`{e
    • 0x3f78:$xo1: \x18:/<994z`{e
    • 0x3ff0:$xo1: \x18:/<994z`{e
    • 0x4048:$xo1: \x18:/<994z`{e
    • 0x40c0:$xo1: \x18:/<994z`{e
    • 0x4138:$xo1: \x18:/<994z`{e
    • 0x41b8:$xo1: \x18:/<994z`{e
    • 0x4230:$xo1: \x18:/<994z`{e
    • 0x42b0:$xo1: \x18:/<994z`{e
    • 0x4308:$xo1: \x18:/<994z`{e
    6234.1.000000005d55c1b0.00000000007ca476.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x171d8:$xo1: \x18:/<994z`{e
    • 0x17250:$xo1: \x18:/<994z`{e
    • 0x172c8:$xo1: \x18:/<994z`{e
    • 0x1731c:$xo1: \x18:/<994z`{e
    • 0x17394:$xo1: \x18:/<994z`{e
    • 0x1740c:$xo1: \x18:/<994z`{e
    • 0x17484:$xo1: \x18:/<994z`{e
    • 0x174f4:$xo1: \x18:/<994z`{e
    • 0x17570:$xo1: \x18:/<994z`{e
    • 0x175c0:$xo1: \x18:/<994z`{e
    6226.1.000000005d55c1b0.00000000007ca476.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x171d8:$xo1: \x18:/<994z`{e
    • 0x17250:$xo1: \x18:/<994z`{e
    • 0x172c8:$xo1: \x18:/<994z`{e
    • 0x1731c:$xo1: \x18:/<994z`{e
    • 0x17394:$xo1: \x18:/<994z`{e
    • 0x1740c:$xo1: \x18:/<994z`{e
    • 0x17484:$xo1: \x18:/<994z`{e
    • 0x174f4:$xo1: \x18:/<994z`{e
    • 0x17570:$xo1: \x18:/<994z`{e
    • 0x175c0:$xo1: \x18:/<994z`{e
    6507.1.000000005d55c1b0.00000000007ca476.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x171d8:$xo1: \x18:/<994z`{e
    • 0x17250:$xo1: \x18:/<994z`{e
    • 0x172c8:$xo1: \x18:/<994z`{e
    • 0x1731c:$xo1: \x18:/<994z`{e
    • 0x17394:$xo1: \x18:/<994z`{e
    • 0x1740c:$xo1: \x18:/<994z`{e
    • 0x17484:$xo1: \x18:/<994z`{e
    • 0x174f4:$xo1: \x18:/<994z`{e
    • 0x17570:$xo1: \x18:/<994z`{e
    • 0x175c0:$xo1: \x18:/<994z`{e
    Click to see the 13 entries
    No Snort rule has matched

    Click to jump to signature section

    Show All Signature Results
    Source: /usr/bin/pulseaudio (PID: 6321)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /usr/bin/pkill (PID: 6428)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /tmp/1isequal9.arm7 (PID: 6226)Socket: 127.0.0.1::59025
    Source: /lib/systemd/systemd-journald (PID: 6262)Socket: <unknown socket type>:unknown
    Source: /usr/sbin/gdm3 (PID: 6450)Socket: <unknown socket type>:unknown
    Source: /usr/bin/dbus-daemon (PID: 6482)Socket: <unknown socket type>:unknown
    Source: syslog.35.drString found in binary or memory: https://www.rsyslog.com

    System Summary

    barindex
    Source: ELF static info symbol of initial sampleName: attack.c
    Source: ELF static info symbol of initial sampleName: attack_app.c
    Source: ELF static info symbol of initial sampleName: attack_get_opt_int
    Source: ELF static info symbol of initial sampleName: attack_get_opt_ip
    Source: ELF static info symbol of initial sampleName: attack_get_opt_str
    Source: ELF static info symbol of initial sampleName: attack_gre.c
    Source: ELF static info symbol of initial sampleName: attack_gre_eth
    Source: ELF static info symbol of initial sampleName: attack_gre_ip
    Source: ELF static info symbol of initial sampleName: attack_init
    Source: ELF static info symbol of initial sampleName: attack_method_http
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 491, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 658, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 720, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 721, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 759, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 761, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 772, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 774, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 777, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 785, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 793, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1334, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1335, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1344, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1601, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1860, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1872, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1886, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 2048, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 6044, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 6190, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 6191, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 6230, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 6234, result: unknown
    Source: /tmp/1isequal9.arm7 (PID: 6507)SIGKILL sent: pid: 6505, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6515)SIGKILL sent: pid: 6513, result: successful
    Source: 1isequal9.arm7, type: SAMPLEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6226.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6229.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6234.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6226.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6507.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6507.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6513.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6230.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6233.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6229.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6515.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6513.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6230.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6505.1.000000005d55c1b0.00000000007ca476.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6234.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6505.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6515.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: 6233.1.0000000097c8e407.000000009c2c05b8.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 491, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 658, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 720, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 721, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 759, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 761, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 772, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 774, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 777, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 785, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 793, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1334, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1335, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1344, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1601, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1860, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1872, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 1886, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 2048, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 6044, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 6190, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 6191, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 6230, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6234)SIGKILL sent: pid: 6234, result: unknown
    Source: /tmp/1isequal9.arm7 (PID: 6507)SIGKILL sent: pid: 6505, result: successful
    Source: /tmp/1isequal9.arm7 (PID: 6515)SIGKILL sent: pid: 6513, result: successful
    Source: ELF static info symbol of initial sampleName: scanner.c
    Source: ELF static info symbol of initial sampleName: scanner_init
    Source: ELF static info symbol of initial sampleName: scanner_kill
    Source: ELF static info symbol of initial sampleName: scanner_pid
    Source: ELF static info symbol of initial sampleName: scanner_rawpkt
    Source: classification engineClassification label: mal64.spre.troj.linARM7@0/45@0/0

    Persistence and Installation Behavior

    barindex
    Source: /usr/bin/dbus-daemon (PID: 6306)File: /proc/6306/mountsJump to behavior
    Source: /usr/bin/dbus-daemon (PID: 6482)File: /proc/6482/mountsJump to behavior
    Source: /usr/bin/dbus-daemon (PID: 6489)File: /proc/6489/mountsJump to behavior
    Source: /bin/fusermount (PID: 6498)File: /proc/6498/mountsJump to behavior
    Source: /usr/bin/dbus-daemon (PID: 6547)File: /proc/6547/mountsJump to behavior
    Source: /usr/share/gdm/generate-config (PID: 6428)Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
    Source: /bin/sh (PID: 6407)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
    Source: /bin/sh (PID: 6409)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
    Source: /bin/sh (PID: 6411)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
    Source: /bin/sh (PID: 6416)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
    Source: /bin/sh (PID: 6418)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
    Source: /bin/sh (PID: 6420)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
    Source: /bin/sh (PID: 6424)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
    Source: /bin/sh (PID: 6426)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
    Source: /bin/sh (PID: 6474)Grep executable: /usr/bin/grep -> grep -F .utf8
    Source: /lib/systemd/systemd-journald (PID: 6262)Reads from proc file: /proc/meminfoJump to behavior
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6395/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6395/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6395/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6395/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6395/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6395/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6395/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6475/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6475/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6475/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6475/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6475/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6475/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/6475/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2078/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2078/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2078/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2078/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2078/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2078/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2078/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2077/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2077/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2077/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2077/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2077/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2077/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2077/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2033/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2033/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2033/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2033/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2033/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2033/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2033/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2074/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2074/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2074/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2074/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2074/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2074/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2074/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2028/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1532/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1532/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1532/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1532/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1532/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1532/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1532/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/1334/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2302/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2302/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2302/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2302/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2302/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2302/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2302/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2025/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2025/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2025/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2025/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2025/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2025/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2025/cgroup
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2223/comm
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2223/cmdline
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2223/status
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2223/attr/current
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2223/sessionid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2223/loginuid
    Source: /lib/systemd/systemd-journald (PID: 6262)File opened: /proc/2223/cgroup
    Source: /usr/bin/whoopsie (PID: 6317)Directory: /nonexistent/.cacheJump to behavior
    Source: /usr/lib/policykit-1/polkitd (PID: 6389)Directory: /root/.cacheJump to behavior
    Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6480)Directory: /var/lib/gdm3/.cacheJump to behavior
    Source: /usr/lib/accountsservice/accounts-daemon (PID: 6456)Directory: /root/.cacheJump to behavior
    Source: /usr/sbin/gdm3 (PID: 6450)File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)Jump to behavior
    Source: /usr/sbin/gdm3 (PID: 6450)File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)Jump to behavior
    Source: /usr/lib/accountsservice/accounts-daemon (PID: 6456)File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)Jump to behavior
    Source: /usr/lib/accountsservice/accounts-daemon (PID: 6456)File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)Jump to behavior
    Source: /usr/bin/gpu-manager (PID: 6406)Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"
    Source: /usr/bin/gpu-manager (PID: 6408)Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"
    Source: /usr/bin/gpu-manager (PID: 6410)Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"
    Source: /usr/bin/gpu-manager (PID: 6415)Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"
    Source: /usr/bin/gpu-manager (PID: 6417)Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"
    Source: /usr/bin/gpu-manager (PID: 6419)Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"
    Source: /usr/bin/gpu-manager (PID: 6423)Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"
    Source: /usr/bin/gpu-manager (PID: 6425)Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"
    Source: /usr/share/language-tools/language-options (PID: 6470)Shell command executed: sh -c "locale -a | grep -F .utf8 "
    Source: /usr/sbin/rsyslogd (PID: 6395)Log file created: /var/log/auth.logJump to dropped file
    Source: /usr/sbin/rsyslogd (PID: 6395)Log file created: /var/log/kern.logJump to dropped file
    Source: /usr/bin/gpu-manager (PID: 6405)Log file created: /var/log/gpu-manager.logJump to dropped file
    Source: /usr/bin/pulseaudio (PID: 6321)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /usr/bin/pkill (PID: 6428)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
    Source: /tmp/1isequal9.arm7 (PID: 6226)Queries kernel information via 'uname':
    Source: /lib/systemd/systemd-journald (PID: 6262)Queries kernel information via 'uname':
    Source: /usr/bin/whoopsie (PID: 6317)Queries kernel information via 'uname':
    Source: /usr/bin/pulseaudio (PID: 6321)Queries kernel information via 'uname':
    Source: /usr/sbin/rsyslogd (PID: 6395)Queries kernel information via 'uname':
    Source: /sbin/agetty (PID: 6398)Queries kernel information via 'uname':
    Source: /usr/bin/gpu-manager (PID: 6405)Queries kernel information via 'uname':
    Source: /usr/lib/gdm3/gdm-session-worker (PID: 6475)Queries kernel information via 'uname':
    Source: /usr/bin/gpu-manager (PID: 6405)Truncated file: /var/log/gpu-manager.log
    Source: syslog.35.drBinary or memory string: May 14 12:00:20 galassia kernel: [ 479.246636] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
    Source: syslog.35.drBinary or memory string: May 14 12:00:20 galassia kernel: [ 479.246585] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
    Source: 1isequal9.arm7, 6226.1.000000003680e83a.000000005c5c2243.rw-.sdmp, 1isequal9.arm7, 6229.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6230.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6233.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6234.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6505.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6507.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6513.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6515.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmpBinary or memory string: "V!/etc/qemu-binfmt/arm
    Source: 1isequal9.arm7, 6234.1.00000000fc8940c5.0000000022e68779.rw-.sdmpBinary or memory string: /tmp/qemu-open.2u2bbA
    Source: 1isequal9.arm7, 6226.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6229.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6230.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6233.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6234.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6505.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6507.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6513.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6515.1.00000000fc8940c5.0000000022e68779.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/1isequal9.arm7SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/1isequal9.arm7
    Source: 1isequal9.arm7, 6226.1.000000003680e83a.000000005c5c2243.rw-.sdmp, 1isequal9.arm7, 6229.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6230.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6233.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6234.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6505.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6507.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6513.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmp, 1isequal9.arm7, 6515.1.000000003680e83a.00000000ca6d1a3b.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
    Source: 1isequal9.arm7, 6226.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6229.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6230.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6233.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6234.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6505.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6507.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6513.1.00000000fc8940c5.0000000022e68779.rw-.sdmp, 1isequal9.arm7, 6515.1.00000000fc8940c5.0000000022e68779.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
    Source: 1isequal9.arm7, 6234.1.00000000fc8940c5.0000000022e68779.rw-.sdmpBinary or memory string: "V/tmp/qemu-open.2u2bbA

    Language, Device and Operating System Detection

    barindex
    Source: /usr/lib/accountsservice/accounts-daemon (PID: 6456)Logged in records file read: /var/log/wtmpJump to behavior

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: 1isequal9.arm7, type: SAMPLE

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: 1isequal9.arm7, type: SAMPLE
    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid Accounts1
    Scripting
    Path InterceptionPath Interception1
    Masquerading
    1
    OS Credential Dumping
    11
    Security Software Discovery
    Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
    Service Stop
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
    File and Directory Permissions Modification
    LSASS Memory1
    System Owner/User Discovery
    Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
    Disable or Modify Tools
    Security Account Manager1
    File and Directory Discovery
    SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
    Scripting
    NTDS2
    System Information Discovery
    Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
    Hidden Files and Directories
    LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
    Replication Through Removable MediaLaunchdRc.commonRc.common1
    Indicator Removal on Host
    Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 626544 Sample: 1isequal9.arm7 Startdate: 14/05/2022 Architecture: LINUX Score: 64 85 Yara detected Mirai 2->85 87 Contains symbols with names commonly found in malware 2->87 10 systemd gdm3 2->10         started        12 1isequal9.arm7 2->12         started        14 systemd gpu-manager 2->14         started        16 19 other processes 2->16 process3 file4 20 gdm3 gdm-session-worker 10->20         started        34 3 other processes 10->34 22 1isequal9.arm7 12->22         started        24 1isequal9.arm7 12->24         started        26 gpu-manager sh 14->26         started        28 gpu-manager sh 14->28         started        36 6 other processes 14->36 79 /var/log/wtmp, data 16->79 dropped 81 Sample reads /proc/mounts (often used for finding a writable filesystem) 16->81 83 Reads system files that contain records of logged in users 16->83 30 accounts-daemon language-validate 16->30         started        32 generate-config pkill 16->32         started        signatures5 process6 process7 38 gdm-session-worker gdm-wayland-session 20->38         started        40 1isequal9.arm7 22->40         started        42 1isequal9.arm7 22->42         started        44 1isequal9.arm7 22->44         started        53 2 other processes 22->53 47 sh grep 26->47         started        49 sh grep 28->49         started        51 language-validate language-options 30->51         started        55 6 other processes 36->55 signatures8 57 gdm-wayland-session dbus-run-session 38->57         started        59 gdm-wayland-session dbus-daemon 38->59         started        62 1isequal9.arm7 40->62         started        64 1isequal9.arm7 42->64         started        95 Sample tries to kill multiple processes (SIGKILL) 44->95 66 language-options sh 51->66         started        process9 signatures10 68 dbus-run-session dbus-daemon 57->68         started        91 Sample reads /proc/mounts (often used for finding a writable filesystem) 59->91 71 dbus-daemon 59->71         started        93 Sample tries to kill multiple processes (SIGKILL) 62->93 73 sh locale 66->73         started        75 sh grep 66->75         started        process11 signatures12 89 Sample reads /proc/mounts (often used for finding a writable filesystem) 68->89 77 dbus-daemon false 71->77         started        process13
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    No Antivirus matches
    No contacted domains info
    NameSourceMaliciousAntivirus DetectionReputation
    https://www.rsyslog.comsyslog.35.drfalse
      high
      No contacted IP infos
      No context