Edit tour

Linux Analysis Report
XHYKEGTtfq.elf

Overview

General Information

Sample name:	XHYKEGTtfq.elf renamed because original name is a hash value
Original sample name:	73b136cb342e7a64855905830cdf0c0b.elf
Analysis ID:	1430906
MD5:	73b136cb342e7a64855905830cdf0c0b
SHA1:	87c0098d9c86435194231c2f5623a7e8c488a861
SHA256:	c860d081fb8cfed28d01b054bf1611c295a6d307537563ad02650cc94c280746
Tags:	32elfpowerpc
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Deletes log files

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430906
Start date and time:	2024-04-24 10:57:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	XHYKEGTtfq.elf renamed because original name is a hash value
Original Sample Name:	73b136cb342e7a64855905830cdf0c0b.elf
Detection:	MAL
Classification:	mal60.spre.troj.evad.linELF@0/0@0/0

Warnings

Connection to analysis system has been lost, crash info: Unknown

Runtime Messages

Command:	/tmp/XHYKEGTtfq.elf
PID:	5432
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	black botnet voodoo
Standard Error:

Process Tree

system is lnxubuntu20

XHYKEGTtfq.elf (PID: 5432, Parent: 5353, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/XHYKEGTtfq.elf

XHYKEGTtfq.elf New Fork (PID: 5434, Parent: 5432)

XHYKEGTtfq.elf New Fork (PID: 5436, Parent: 5434)

XHYKEGTtfq.elf New Fork (PID: 5438, Parent: 5434)

XHYKEGTtfq.elf New Fork (PID: 5440, Parent: 5434)

XHYKEGTtfq.elf New Fork (PID: 5441, Parent: 5434)

systemd New Fork (PID: 5444, Parent: 1)

journalctl (PID: 5444, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5461, Parent: 1)

dbus-daemon (PID: 5461, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5478, Parent: 1)

rsyslogd (PID: 5478, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gvfsd-fuse New Fork (PID: 5479, Parent: 3122)

fusermount (PID: 5479, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5480, Parent: 2935)

pulseaudio (PID: 5480, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5484, Parent: 1)

systemd-journald (PID: 5484, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5485, Parent: 1)

dbus-daemon (PID: 5485, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5486, Parent: 1)

rsyslogd (PID: 5486, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5490, Parent: 1)

systemd-journald (PID: 5490, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5491, Parent: 1)

dbus-daemon (PID: 5491, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5492, Parent: 1)

systemd-journald (PID: 5492, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5493, Parent: 1)

rsyslogd (PID: 5493, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5494, Parent: 1)

dbus-daemon (PID: 5494, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5495, Parent: 1)

systemd-journald (PID: 5495, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5496, Parent: 1)

dbus-daemon (PID: 5496, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5497, Parent: 1)

systemd-journald (PID: 5497, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5498, Parent: 1)

rsyslogd (PID: 5498, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 5499, Parent: 1400)

Default (PID: 5499, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5500, Parent: 1400)

Default (PID: 5500, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5501, Parent: 1400)

Default (PID: 5501, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5502, Parent: 1)

rsyslogd (PID: 5502, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5505, Parent: 1)

gpu-manager (PID: 5505, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5506, Parent: 5505)

sh (PID: 5506, Parent: 5505, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5507, Parent: 5506)

grep (PID: 5507, Parent: 5506, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 5508, Parent: 1)

generate-config (PID: 5508, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5509, Parent: 5508)

pkill (PID: 5509, Parent: 5508, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5510, Parent: 1)

gpu-manager (PID: 5510, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 5511, Parent: 1)

generate-config (PID: 5511, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5512, Parent: 5511)

pkill (PID: 5512, Parent: 5511, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5513, Parent: 1)

gpu-manager (PID: 5513, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5514, Parent: 5513)

sh (PID: 5514, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5515, Parent: 5514)

grep (PID: 5515, Parent: 5514, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 5516, Parent: 1)

generate-config (PID: 5516, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5517, Parent: 5516)

pkill (PID: 5517, Parent: 5516, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5518, Parent: 1)

gpu-manager (PID: 5518, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 5519, Parent: 1)

generate-config (PID: 5519, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5520, Parent: 5519)

pkill (PID: 5520, Parent: 5519, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5521, Parent: 1)

gpu-manager (PID: 5521, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 5522, Parent: 1)

generate-config (PID: 5522, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5523, Parent: 5522)

pkill (PID: 5523, Parent: 5522, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5524, Parent: 1)

plymouth (PID: 5524, Parent: 1, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: /bin/plymouth quit

systemd New Fork (PID: 5526, Parent: 2935)

dbus-daemon (PID: 5526, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: XHYKEGTtfq.elf

Virustotal: Detection: 11%

Perma Link

Source: /usr/bin/pkill (PID: 5509)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 5517)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:42674 -> 212.70.149.14:35342

Source: /tmp/XHYKEGTtfq.elf (PID: 5432)

Socket: 127.0.0.1::8345

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	TCP traffic detected without corresponding DNS query: 212.70.149.14
Source: unknown	UDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown	UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown	UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown	UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown	UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown	UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown	UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown	UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown	UDP traffic detected without corresponding DNS query: 51.254.162.59
Source: unknown	UDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown	UDP traffic detected without corresponding DNS query: 51.77.149.139
Source: unknown	UDP traffic detected without corresponding DNS query: 94.16.114.254
Source: unknown	UDP traffic detected without corresponding DNS query: 94.16.114.254

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1475, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1565, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 2926, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 3772, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5272, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5415, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5416, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5438, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5440, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5441, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5444, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5478, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5480, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5484, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5485, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5486, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5490, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5491, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5492, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5493, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5494, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5495, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5496, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5497, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5498, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5499, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5502, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5505, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5507, result: no such process	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5508, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5510, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5511, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5512, result: no such process	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5513, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5514, result: no such process	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5515, result: no such process	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5516, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5517, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5518, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5519, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5521, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5522, result: successful	Jump to behavior

Source: LOAD without section mappings

Program segment: 0x10000000

Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1475, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1565, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 2926, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 3772, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5272, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5415, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5416, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5438, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5440, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5441, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5444, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5478, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5480, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5484, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5485, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5486, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5490, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5491, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5492, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5493, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5494, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5495, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5496, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5497, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5498, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5499, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5502, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5505, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5507, result: no such process	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5508, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5510, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5511, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5512, result: no such process	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5513, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5514, result: no such process	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5515, result: no such process	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5516, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5517, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5518, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5519, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5521, result: successful	Jump to behavior
Source: /tmp/XHYKEGTtfq.elf (PID: 5436)	SIGKILL sent: pid: 5522, result: successful	Jump to behavior

Source: classification engine

Classification label: mal60.spre.troj.evad.linELF@0/0@0/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /bin/fusermount (PID: 5479)

File: /proc/5479/mounts

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5506)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"			Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5514)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"			Jump to behavior

Source: /bin/sh (PID: 5507)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf			Jump to behavior
Source: /bin/sh (PID: 5515)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf			Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 5509)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5512)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5517)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5520)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5523)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/XHYKEGTtfq.elf (PID: 5432)

File: /tmp/XHYKEGTtfq.elf

Jump to behavior

Source: XHYKEGTtfq.elf	Submission file: segment LOAD with 7.8829 entropy (max. 8.0)
Source: XHYKEGTtfq.elf	Submission file: segment LOAD with 7.972 entropy (max. 8.0)

Source: /usr/bin/gpu-manager (PID: 5505)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5510)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5513)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5521)	Truncated file: /var/log/gpu-manager.log	Jump to behavior

Source: /usr/bin/pkill (PID: 5509)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 5517)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/XHYKEGTtfq.elf (PID: 5432)

Queries kernel information via 'uname':

Jump to behavior

Source: XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp	Binary or memory string: /ppc/tmp/vmware-root_727-4290690966
Source: XHYKEGTtfq.elf, 5432.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: XHYKEGTtfq.elf, 5441.1.00007f7dac035000.00007f7dac038000.rw-.sdmp	Binary or memory string: 1/tmp/vmware-root_727-4290690966
Source: XHYKEGTtfq.elf, 5438.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp, XHYKEGTtfq.elf, 5440.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp, XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: XHYKEGTtfq.elf, 5432.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp, XHYKEGTtfq.elf, 5438.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp, XHYKEGTtfq.elf, 5440.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp, XHYKEGTtfq.elf, 5441.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp	Binary or memory string: =x86_64/usr/bin/qemu-ppc/tmp/XHYKEGTtfq.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/XHYKEGTtfq.elf
Source: XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp	Binary or memory string: U1/tmp/vmware-root_727-4290690966
Source: XHYKEGTtfq.elf, 5432.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp, XHYKEGTtfq.elf, 5438.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp, XHYKEGTtfq.elf, 5440.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp, XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: XHYKEGTtfq.elf, 5441.1.00007f7dac02a000.00007f7dac035000.rw-.sdmp	Binary or memory string: vmware-root_727-4290690966
Source: XHYKEGTtfq.elf, 5441.1.00007f7dac035000.00007f7dac038000.rw-.sdmp	Binary or memory string: 0a/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-colord.service-PB7Ovfa1/tmp/vmware-root_727-4290690966
Source: XHYKEGTtfq.elf, 5432.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp, XHYKEGTtfq.elf, 5438.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp, XHYKEGTtfq.elf, 5440.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp, XHYKEGTtfq.elf, 5441.1.00007ffe423d8000.00007ffe423f9000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_727-4290690966
Source: XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-upower.service-VKEayg
Source: XHYKEGTtfq.elf, 5441.1.00005585d9d4f000.00005585d9e20000.rw-.sdmp	Binary or memory string: U/ppc/tmp/vmware-root_727-42906909665425093f40a37100b81c1/tmp/snap-private-tmp/snap.lxd/tmp

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Disable or Modify Tools	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Indicator Removal	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
XHYKEGTtfq.elf	11%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.70.149.14	unknown	Bulgaria		208410	INTERNET-HOSTINGBG	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
212.70.149.14	UOt98MEVJw.elf	Get hash	malicious	Unknown	Browse	/arm6
	XtpqFYYOsk.elf	Get hash	malicious	Unknown	Browse	/arm7
	M5JK7Pf4NO.elf	Get hash	malicious	Unknown	Browse	/mips
	aIIxWKK5Cm.elf	Get hash	malicious	Unknown	Browse	/mpsl
	Y8ahzapm43.elf	Get hash	malicious	Unknown	Browse	/arm5

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INTERNET-HOSTINGBG	SecuriteInfo.com.Linux.Siggen.7232.1376.786.elf	Get hash	malicious	Unknown	Browse	212.70.149.10
	SecuriteInfo.com.Linux.Mirai.8362.8829.19078.elf	Get hash	malicious	Mirai	Browse	212.70.149.14
	SecuriteInfo.com.Linux.Siggen.7228.11695.14684.elf	Get hash	malicious	Unknown	Browse	212.70.149.10
	SecuriteInfo.com.Linux.Siggen.7251.3492.11320.elf	Get hash	malicious	Unknown	Browse	212.70.149.14
	UOt98MEVJw.elf	Get hash	malicious	Unknown	Browse	212.70.149.14
	XtpqFYYOsk.elf	Get hash	malicious	Unknown	Browse	212.70.149.14
	M5JK7Pf4NO.elf	Get hash	malicious	Unknown	Browse	212.70.149.14
	aIIxWKK5Cm.elf	Get hash	malicious	Unknown	Browse	212.70.149.14
	Y8ahzapm43.elf	Get hash	malicious	Unknown	Browse	212.70.149.14
	CT9oaKX3q3.elf	Get hash	malicious	Unknown	Browse	87.246.7.66

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.970205312474335
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	XHYKEGTtfq.elf
File size:	46'656 bytes
MD5:	73b136cb342e7a64855905830cdf0c0b
SHA1:	87c0098d9c86435194231c2f5623a7e8c488a861
SHA256:	c860d081fb8cfed28d01b054bf1611c295a6d307537563ad02650cc94c280746
SHA512:	81af757f1e3cc4608da40137130a6efb1be3c1e2edc08f6ed75159f9e440fcb695feb95728ef0d6157202be1e356d4d269448c279444bef88e34d24dd0cf6b72
SSDEEP:	768:cnhQn2SuI+h7gjER7R3Q2stXIhyXkGhe0WDo31aostZwceD6hnTKcb4uVcqgw0Eo:XNO6Qc2UXIoX1e0J31fstZwyN3b4u+qc
TLSH:	FE23F13ADD692D3AFC6FFD323D5A8363A72ED68515A3A3950184FF414C4D02AED848C4
File Content Preview:	.ELF...........................4.........4. ...(........................../4...........................@...@........dt.Q................................sfga.P.....................W.......?.E.h4...@b........=.a...!.1.Z!K.......T.(..lj.T .`F.}.>...p.....>#9

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x1004a1f8
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x10000000	0x10000000	0x1000	0x32f34	7.8829	0x6	RW	0x10000
LOAD	0x0	0x10040000	0x10040000	0xb540	0xb540	7.9720	0x5	R E	0x10000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 10:57:52.829941034 CEST	42674	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:57:53.158019066 CEST	35342	42674	212.70.149.14	192.168.2.13
Apr 24, 2024 10:57:56.824860096 CEST	42678	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:57:57.152399063 CEST	35342	42678	212.70.149.14	192.168.2.13
Apr 24, 2024 10:58:00.767880917 CEST	42680	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:58:01.093925953 CEST	35342	42680	212.70.149.14	192.168.2.13
Apr 24, 2024 10:58:03.966942072 CEST	42682	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:58:04.298343897 CEST	35342	42682	212.70.149.14	192.168.2.13
Apr 24, 2024 10:58:31.321029902 CEST	42684	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:58:31.647145033 CEST	35342	42684	212.70.149.14	192.168.2.13
Apr 24, 2024 10:58:35.187374115 CEST	42686	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:58:35.513803005 CEST	35342	42686	212.70.149.14	192.168.2.13
Apr 24, 2024 10:58:37.805960894 CEST	42688	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:58:38.133001089 CEST	35342	42688	212.70.149.14	192.168.2.13
Apr 24, 2024 10:58:41.753118038 CEST	42690	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:58:42.079061031 CEST	35342	42690	212.70.149.14	192.168.2.13
Apr 24, 2024 10:59:09.112138033 CEST	42692	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:59:09.438483000 CEST	35342	42692	212.70.149.14	192.168.2.13
Apr 24, 2024 10:59:36.465599060 CEST	42694	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:59:36.792435884 CEST	35342	42694	212.70.149.14	192.168.2.13
Apr 24, 2024 10:59:40.336221933 CEST	42696	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:59:40.662914038 CEST	35342	42696	212.70.149.14	192.168.2.13
Apr 24, 2024 10:59:44.196711063 CEST	42698	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:59:44.522787094 CEST	35342	42698	212.70.149.14	192.168.2.13
Apr 24, 2024 10:59:48.135737896 CEST	42700	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:59:48.462379932 CEST	35342	42700	212.70.149.14	192.168.2.13
Apr 24, 2024 10:59:52.012990952 CEST	42702	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 10:59:52.339411020 CEST	35342	42702	212.70.149.14	192.168.2.13
Apr 24, 2024 11:00:19.366575956 CEST	42704	35342	192.168.2.13	212.70.149.14
Apr 24, 2024 11:00:19.692785025 CEST	35342	42704	212.70.149.14	192.168.2.13
Apr 24, 2024 11:00:21.985075951 CEST	42706	35342	192.168.2.13	212.70.149.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 10:57:52.537662983 CEST	52777	53	192.168.2.13	51.158.108.203
Apr 24, 2024 10:57:52.828303099 CEST	53	52777	51.158.108.203	192.168.2.13
Apr 24, 2024 10:57:55.158890963 CEST	45841	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:57:55.476224899 CEST	53	45841	51.77.149.139	192.168.2.13
Apr 24, 2024 10:57:55.476520061 CEST	38594	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:57:55.804251909 CEST	53	38594	51.77.149.139	192.168.2.13
Apr 24, 2024 10:57:55.804567099 CEST	46735	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:57:56.113241911 CEST	53	46735	51.77.149.139	192.168.2.13
Apr 24, 2024 10:57:56.113457918 CEST	46019	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:57:56.514849901 CEST	53	46019	51.77.149.139	192.168.2.13
Apr 24, 2024 10:57:56.515017986 CEST	35299	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:57:56.824580908 CEST	53	35299	51.77.149.139	192.168.2.13
Apr 24, 2024 10:57:59.152807951 CEST	38202	53	192.168.2.13	185.181.61.24
Apr 24, 2024 10:57:59.476119995 CEST	53	38202	185.181.61.24	192.168.2.13
Apr 24, 2024 10:57:59.476305008 CEST	60188	53	192.168.2.13	185.181.61.24
Apr 24, 2024 10:57:59.804452896 CEST	53	60188	185.181.61.24	192.168.2.13
Apr 24, 2024 10:57:59.804702997 CEST	45652	53	192.168.2.13	185.181.61.24
Apr 24, 2024 10:58:00.127368927 CEST	53	45652	185.181.61.24	192.168.2.13
Apr 24, 2024 10:58:00.127605915 CEST	47825	53	192.168.2.13	185.181.61.24
Apr 24, 2024 10:58:00.449290991 CEST	53	47825	185.181.61.24	192.168.2.13
Apr 24, 2024 10:58:00.449518919 CEST	38373	53	192.168.2.13	185.181.61.24
Apr 24, 2024 10:58:00.767709970 CEST	53	38373	185.181.61.24	192.168.2.13
Apr 24, 2024 10:58:03.094355106 CEST	44823	53	192.168.2.13	134.195.4.2
Apr 24, 2024 10:58:03.269135952 CEST	53	44823	134.195.4.2	192.168.2.13
Apr 24, 2024 10:58:03.269284010 CEST	47576	53	192.168.2.13	134.195.4.2
Apr 24, 2024 10:58:03.442320108 CEST	53	47576	134.195.4.2	192.168.2.13
Apr 24, 2024 10:58:03.442640066 CEST	53605	53	192.168.2.13	134.195.4.2
Apr 24, 2024 10:58:03.616166115 CEST	53	53605	134.195.4.2	192.168.2.13
Apr 24, 2024 10:58:03.616322994 CEST	47311	53	192.168.2.13	134.195.4.2
Apr 24, 2024 10:58:03.793488026 CEST	53	47311	134.195.4.2	192.168.2.13
Apr 24, 2024 10:58:03.793601036 CEST	46671	53	192.168.2.13	134.195.4.2
Apr 24, 2024 10:58:03.966528893 CEST	53	46671	134.195.4.2	192.168.2.13
Apr 24, 2024 10:58:06.298695087 CEST	38695	53	192.168.2.13	1.1.1.1
Apr 24, 2024 10:58:11.303807020 CEST	42614	53	192.168.2.13	1.1.1.1
Apr 24, 2024 10:58:16.305469036 CEST	53924	53	192.168.2.13	1.1.1.1
Apr 24, 2024 10:58:21.310739994 CEST	43056	53	192.168.2.13	1.1.1.1
Apr 24, 2024 10:58:26.315515041 CEST	45338	53	192.168.2.13	1.1.1.1
Apr 24, 2024 10:58:33.648534060 CEST	39878	53	192.168.2.13	51.254.162.59
Apr 24, 2024 10:58:33.957607031 CEST	53	39878	51.254.162.59	192.168.2.13
Apr 24, 2024 10:58:33.957890034 CEST	37910	53	192.168.2.13	51.254.162.59
Apr 24, 2024 10:58:34.262073040 CEST	53	37910	51.254.162.59	192.168.2.13
Apr 24, 2024 10:58:34.262415886 CEST	42911	53	192.168.2.13	51.254.162.59
Apr 24, 2024 10:58:34.569291115 CEST	53	42911	51.254.162.59	192.168.2.13
Apr 24, 2024 10:58:34.569632053 CEST	46989	53	192.168.2.13	51.254.162.59
Apr 24, 2024 10:58:34.879728079 CEST	53	46989	51.254.162.59	192.168.2.13
Apr 24, 2024 10:58:34.879972935 CEST	35274	53	192.168.2.13	51.254.162.59
Apr 24, 2024 10:58:35.186902046 CEST	53	35274	51.254.162.59	192.168.2.13
Apr 24, 2024 10:58:37.514334917 CEST	50148	53	192.168.2.13	51.158.108.203
Apr 24, 2024 10:58:37.805547953 CEST	53	50148	51.158.108.203	192.168.2.13
Apr 24, 2024 10:58:40.133846998 CEST	46261	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:58:40.441004038 CEST	53	46261	51.77.149.139	192.168.2.13
Apr 24, 2024 10:58:40.441299915 CEST	36207	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:58:40.758447886 CEST	53	36207	51.77.149.139	192.168.2.13
Apr 24, 2024 10:58:40.758658886 CEST	33544	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:58:41.134124994 CEST	53	33544	51.77.149.139	192.168.2.13
Apr 24, 2024 10:58:41.134320974 CEST	60824	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:58:41.443811893 CEST	53	60824	51.77.149.139	192.168.2.13
Apr 24, 2024 10:58:41.444091082 CEST	34569	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:58:41.752899885 CEST	53	34569	51.77.149.139	192.168.2.13
Apr 24, 2024 10:58:44.079926968 CEST	38404	53	192.168.2.13	94.16.114.254
Apr 24, 2024 10:58:49.081254959 CEST	41787	53	192.168.2.13	94.16.114.254
Apr 24, 2024 10:58:54.086536884 CEST	56639	53	192.168.2.13	94.16.114.254
Apr 24, 2024 10:58:59.091737032 CEST	59855	53	192.168.2.13	94.16.114.254
Apr 24, 2024 10:59:04.104593039 CEST	54591	53	192.168.2.13	94.16.114.254
Apr 24, 2024 10:59:11.439615011 CEST	36175	53	192.168.2.13	91.217.137.37
Apr 24, 2024 10:59:16.444818020 CEST	39534	53	192.168.2.13	91.217.137.37
Apr 24, 2024 10:59:21.450050116 CEST	43959	53	192.168.2.13	91.217.137.37
Apr 24, 2024 10:59:26.455229998 CEST	50950	53	192.168.2.13	91.217.137.37
Apr 24, 2024 10:59:31.460372925 CEST	45235	53	192.168.2.13	91.217.137.37
Apr 24, 2024 10:59:38.793472052 CEST	52358	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:59:39.100649118 CEST	53	52358	51.77.149.139	192.168.2.13
Apr 24, 2024 10:59:39.101006031 CEST	60768	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:59:39.408070087 CEST	53	60768	51.77.149.139	192.168.2.13
Apr 24, 2024 10:59:39.408582926 CEST	60381	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:59:39.719038963 CEST	53	60381	51.77.149.139	192.168.2.13
Apr 24, 2024 10:59:39.719460964 CEST	39585	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:59:40.026556969 CEST	53	39585	51.77.149.139	192.168.2.13
Apr 24, 2024 10:59:40.026803017 CEST	32776	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:59:40.335963011 CEST	53	32776	51.77.149.139	192.168.2.13
Apr 24, 2024 10:59:42.663521051 CEST	48330	53	192.168.2.13	51.254.162.59
Apr 24, 2024 10:59:42.970443964 CEST	53	48330	51.254.162.59	192.168.2.13
Apr 24, 2024 10:59:42.970669031 CEST	49045	53	192.168.2.13	51.254.162.59
Apr 24, 2024 10:59:43.273282051 CEST	53	49045	51.254.162.59	192.168.2.13
Apr 24, 2024 10:59:43.273499966 CEST	35645	53	192.168.2.13	51.254.162.59
Apr 24, 2024 10:59:43.580207109 CEST	53	35645	51.254.162.59	192.168.2.13
Apr 24, 2024 10:59:43.580478907 CEST	58013	53	192.168.2.13	51.254.162.59
Apr 24, 2024 10:59:43.888185978 CEST	53	58013	51.254.162.59	192.168.2.13
Apr 24, 2024 10:59:43.888392925 CEST	34726	53	192.168.2.13	51.254.162.59
Apr 24, 2024 10:59:44.196475983 CEST	53	34726	51.254.162.59	192.168.2.13
Apr 24, 2024 10:59:46.523507118 CEST	47771	53	192.168.2.13	185.181.61.24
Apr 24, 2024 10:59:46.846268892 CEST	53	47771	185.181.61.24	192.168.2.13
Apr 24, 2024 10:59:46.846836090 CEST	54292	53	192.168.2.13	185.181.61.24
Apr 24, 2024 10:59:47.168649912 CEST	53	54292	185.181.61.24	192.168.2.13
Apr 24, 2024 10:59:47.169198990 CEST	34936	53	192.168.2.13	185.181.61.24
Apr 24, 2024 10:59:47.490906000 CEST	53	34936	185.181.61.24	192.168.2.13
Apr 24, 2024 10:59:47.491437912 CEST	34026	53	192.168.2.13	185.181.61.24
Apr 24, 2024 10:59:47.813054085 CEST	53	34026	185.181.61.24	192.168.2.13
Apr 24, 2024 10:59:47.813406944 CEST	35466	53	192.168.2.13	185.181.61.24
Apr 24, 2024 10:59:48.135298014 CEST	53	35466	185.181.61.24	192.168.2.13
Apr 24, 2024 10:59:50.463210106 CEST	47933	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:59:50.771748066 CEST	53	47933	51.77.149.139	192.168.2.13
Apr 24, 2024 10:59:50.772161961 CEST	48325	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:59:51.079488993 CEST	53	48325	51.77.149.139	192.168.2.13
Apr 24, 2024 10:59:51.079859972 CEST	33520	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:59:51.396220922 CEST	53	33520	51.77.149.139	192.168.2.13
Apr 24, 2024 10:59:51.396677971 CEST	33185	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:59:51.703886032 CEST	53	33185	51.77.149.139	192.168.2.13
Apr 24, 2024 10:59:51.704359055 CEST	36642	53	192.168.2.13	51.77.149.139
Apr 24, 2024 10:59:52.012482882 CEST	53	36642	51.77.149.139	192.168.2.13
Apr 24, 2024 10:59:54.340229988 CEST	44905	53	192.168.2.13	94.16.114.254
Apr 24, 2024 10:59:59.345390081 CEST	50876	53	192.168.2.13	94.16.114.254
Apr 24, 2024 11:00:04.350707054 CEST	49167	53	192.168.2.13	94.16.114.254
Apr 24, 2024 11:00:09.355878115 CEST	59920	53	192.168.2.13	94.16.114.254
Apr 24, 2024 11:00:14.361112118 CEST	42168	53	192.168.2.13	94.16.114.254
Apr 24, 2024 11:00:21.693627119 CEST	37684	53	192.168.2.13	51.158.108.203
Apr 24, 2024 11:00:21.984572887 CEST	53	37684	51.158.108.203	192.168.2.13

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 24, 2024 10:58:01.382989883 CEST	192.168.2.13	192.168.2.1	8279	(Port unreachable)	Destination Unreachable
Apr 24, 2024 10:59:21.410352945 CEST	192.168.2.13	192.168.2.1	8279	(Port unreachable)	Destination Unreachable

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 10:59:46.846268892 CEST	185.181.61.24	192.168.2.13	0xf795	Format error (1)	security.rebirth-network.su	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:59:47.168649912 CEST	185.181.61.24	192.168.2.13	0xf795	Format error (1)	security.rebirth-network.su	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:59:47.490906000 CEST	185.181.61.24	192.168.2.13	0xf795	Format error (1)	security.rebirth-network.su	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:59:47.813054085 CEST	185.181.61.24	192.168.2.13	0xf795	Format error (1)	security.rebirth-network.su	none	none	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:59:48.135298014 CEST	185.181.61.24	192.168.2.13	0xf795	Format error (1)	security.rebirth-network.su	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: XHYKEGTtfq.elf PID: 5432, Parent PID: 5353

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/tmp/XHYKEGTtfq.elf
Arguments:	/tmp/XHYKEGTtfq.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: XHYKEGTtfq.elf PID: 5434, Parent PID: 5432

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/tmp/XHYKEGTtfq.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: XHYKEGTtfq.elf PID: 5436, Parent PID: 5434

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/tmp/XHYKEGTtfq.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: XHYKEGTtfq.elf PID: 5438, Parent PID: 5434

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/tmp/XHYKEGTtfq.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: XHYKEGTtfq.elf PID: 5440, Parent PID: 5434

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/tmp/XHYKEGTtfq.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: XHYKEGTtfq.elf PID: 5441, Parent PID: 5434

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/tmp/XHYKEGTtfq.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: systemd PID: 5444, Parent PID: 1

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: journalctl PID: 5444, Parent PID: 1

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/usr/bin/journalctl
Arguments:	/usr/bin/journalctl --smart-relinquish-var
File size:	80120 bytes
MD5 hash:	bf3a987344f3bacafc44efd882abda8b

Chronological Activities

Analysis Process: systemd PID: 5461, Parent PID: 1

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 5461, Parent PID: 1

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 5478, Parent PID: 1

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5478, Parent PID: 1

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: gvfsd-fuse PID: 5479, Parent PID: 3122

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Chronological Activities

Analysis Process: fusermount PID: 5479, Parent PID: 3122

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/bin/fusermount
Arguments:	fusermount -u -q -z -- /run/user/1000/gvfs
File size:	39144 bytes
MD5 hash:	576a1b135c82bdcbc97a91acea900566

Chronological Activities

Analysis Process: systemd PID: 5480, Parent PID: 2935

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: pulseaudio PID: 5480, Parent PID: 2935

General

Start time (UTC):	08:57:51
Start date (UTC):	24/04/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Chronological Activities

Analysis Process: systemd PID: 5484, Parent PID: 1

General

Start time (UTC):	08:57:52
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-journald PID: 5484, Parent PID: 1

General

Start time (UTC):	08:57:52
Start date (UTC):	24/04/2024
Path:	/lib/systemd/systemd-journald
Arguments:	/lib/systemd/systemd-journald
File size:	162032 bytes
MD5 hash:	474667ece6cecb5e04c6eb897a1d0d9e

Chronological Activities

Analysis Process: systemd PID: 5485, Parent PID: 1

General

Start time (UTC):	08:57:52
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 5485, Parent PID: 1

General

Start time (UTC):	08:57:52
Start date (UTC):	24/04/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 5486, Parent PID: 1

General

Start time (UTC):	08:57:52
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5486, Parent PID: 1

General

Start time (UTC):	08:57:52
Start date (UTC):	24/04/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5490, Parent PID: 1

General

Start time (UTC):	08:57:52
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-journald PID: 5490, Parent PID: 1

General

Start time (UTC):	08:57:52
Start date (UTC):	24/04/2024
Path:	/lib/systemd/systemd-journald
Arguments:	/lib/systemd/systemd-journald
File size:	162032 bytes
MD5 hash:	474667ece6cecb5e04c6eb897a1d0d9e

Chronological Activities

Analysis Process: systemd PID: 5491, Parent PID: 1

General

Start time (UTC):	08:57:52
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 5491, Parent PID: 1

General

Start time (UTC):	08:57:52
Start date (UTC):	24/04/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 5492, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-journald PID: 5492, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/lib/systemd/systemd-journald
Arguments:	/lib/systemd/systemd-journald
File size:	162032 bytes
MD5 hash:	474667ece6cecb5e04c6eb897a1d0d9e

Chronological Activities

Analysis Process: systemd PID: 5493, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5493, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5494, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 5494, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 5495, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-journald PID: 5495, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/lib/systemd/systemd-journald
Arguments:	/lib/systemd/systemd-journald
File size:	162032 bytes
MD5 hash:	474667ece6cecb5e04c6eb897a1d0d9e

Chronological Activities

Analysis Process: systemd PID: 5496, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 5496, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 5497, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-journald PID: 5497, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/lib/systemd/systemd-journald
Arguments:	/lib/systemd/systemd-journald
File size:	162032 bytes
MD5 hash:	474667ece6cecb5e04c6eb897a1d0d9e

Chronological Activities

Analysis Process: systemd PID: 5498, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5498, Parent PID: 1

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: gdm3 PID: 5499, Parent PID: 1400

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 5499, Parent PID: 1400

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm3 PID: 5500, Parent PID: 1400

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 5500, Parent PID: 1400

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm3 PID: 5501, Parent PID: 1400

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 5501, Parent PID: 1400

General

Start time (UTC):	08:57:53
Start date (UTC):	24/04/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemd PID: 5502, Parent PID: 1

General

Start time (UTC):	08:57:54
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 5502, Parent PID: 1

General

Start time (UTC):	08:57:54
Start date (UTC):	24/04/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 5505, Parent PID: 1

General

Start time (UTC):	08:57:55
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 5505, Parent PID: 1

General

Start time (UTC):	08:57:55
Start date (UTC):	24/04/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: gpu-manager PID: 5506, Parent PID: 5505

General

Start time (UTC):	08:57:55
Start date (UTC):	24/04/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 5506, Parent PID: 5505

General

Start time (UTC):	08:57:55
Start date (UTC):	24/04/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5507, Parent PID: 5506

General

Start time (UTC):	08:57:55
Start date (UTC):	24/04/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 5507, Parent PID: 5506

General

Start time (UTC):	08:57:55
Start date (UTC):	24/04/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: systemd PID: 5508, Parent PID: 1

General

Start time (UTC):	08:57:55
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 5508, Parent PID: 1

General

Start time (UTC):	08:57:55
Start date (UTC):	24/04/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: generate-config PID: 5509, Parent PID: 5508

General

Start time (UTC):	08:57:55
Start date (UTC):	24/04/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5509, Parent PID: 5508

General

Start time (UTC):	08:57:55
Start date (UTC):	24/04/2024
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: systemd PID: 5510, Parent PID: 1

General

Start time (UTC):	08:57:56
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 5510, Parent PID: 1

General

Start time (UTC):	08:57:56
Start date (UTC):	24/04/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: systemd PID: 5511, Parent PID: 1

General

Start time (UTC):	08:57:56
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 5511, Parent PID: 1

General

Start time (UTC):	08:57:56
Start date (UTC):	24/04/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: generate-config PID: 5512, Parent PID: 5511

General

Start time (UTC):	08:57:56
Start date (UTC):	24/04/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5512, Parent PID: 5511

General

Start time (UTC):	08:57:56
Start date (UTC):	24/04/2024
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: systemd PID: 5513, Parent PID: 1

General

Start time (UTC):	08:57:57
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 5513, Parent PID: 1

General

Start time (UTC):	08:57:57
Start date (UTC):	24/04/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: gpu-manager PID: 5514, Parent PID: 5513

General

Start time (UTC):	08:57:57
Start date (UTC):	24/04/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 5514, Parent PID: 5513

General

Start time (UTC):	08:57:57
Start date (UTC):	24/04/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5515, Parent PID: 5514

General

Start time (UTC):	08:57:57
Start date (UTC):	24/04/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 5515, Parent PID: 5514

General

Start time (UTC):	08:57:57
Start date (UTC):	24/04/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: systemd PID: 5516, Parent PID: 1

General

Start time (UTC):	08:57:57
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 5516, Parent PID: 1

General

Start time (UTC):	08:57:57
Start date (UTC):	24/04/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: generate-config PID: 5517, Parent PID: 5516

General

Start time (UTC):	08:57:57
Start date (UTC):	24/04/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5517, Parent PID: 5516

General

Start time (UTC):	08:57:57
Start date (UTC):	24/04/2024
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: systemd PID: 5518, Parent PID: 1

General

Start time (UTC):	08:57:58
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 5518, Parent PID: 1

General

Start time (UTC):	08:57:58
Start date (UTC):	24/04/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: systemd PID: 5519, Parent PID: 1

General

Start time (UTC):	08:57:58
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 5519, Parent PID: 1

General

Start time (UTC):	08:57:58
Start date (UTC):	24/04/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: generate-config PID: 5520, Parent PID: 5519

General

Start time (UTC):	08:57:58
Start date (UTC):	24/04/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5520, Parent PID: 5519

General

Start time (UTC):	08:57:58
Start date (UTC):	24/04/2024
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: systemd PID: 5521, Parent PID: 1

General

Start time (UTC):	08:58:00
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 5521, Parent PID: 1

General

Start time (UTC):	08:58:00
Start date (UTC):	24/04/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: systemd PID: 5522, Parent PID: 1

General

Start time (UTC):	08:58:00
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 5522, Parent PID: 1

General

Start time (UTC):	08:58:00
Start date (UTC):	24/04/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: generate-config PID: 5523, Parent PID: 5522

General

Start time (UTC):	08:58:00
Start date (UTC):	24/04/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5523, Parent PID: 5522

General

Start time (UTC):	08:58:00
Start date (UTC):	24/04/2024
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: systemd PID: 5524, Parent PID: 1

General

Start time (UTC):	08:58:01
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: plymouth PID: 5524, Parent PID: 1

General

Start time (UTC):	08:58:01
Start date (UTC):	24/04/2024
Path:	/bin/plymouth
Arguments:	/bin/plymouth quit
File size:	51352 bytes
MD5 hash:	87003efd8dad470042f5e75360a8f49f

Chronological Activities

Analysis Process: systemd PID: 5526, Parent PID: 2935

General

Start time (UTC):	08:59:21
Start date (UTC):	24/04/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 5526, Parent PID: 2935

General

Start time (UTC):	08:59:21
Start date (UTC):	24/04/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report XHYKEGTtfq.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Answers

System Behavior

Analysis Process: XHYKEGTtfq.elf PID: 5432, Parent PID: 5353

General

Chronological Activities

Analysis Process: XHYKEGTtfq.elf PID: 5434, Parent PID: 5432

General

Chronological Activities

Analysis Process: XHYKEGTtfq.elf PID: 5436, Parent PID: 5434

General

Chronological Activities

Analysis Process: XHYKEGTtfq.elf PID: 5438, Parent PID: 5434

General

Chronological Activities

Analysis Process: XHYKEGTtfq.elf PID: 5440, Parent PID: 5434

General

Chronological Activities

Analysis Process: XHYKEGTtfq.elf PID: 5441, Parent PID: 5434

General

Chronological Activities

Analysis Process: systemd PID: 5444, Parent PID: 1

General

Chronological Activities

Linux Analysis Report
XHYKEGTtfq.elf