Edit tour

Linux Analysis Report
arm7.elf

Overview

General Information

Sample Name:	arm7.elf
Analysis ID:	1324995
MD5:	bdc72c56f1569fb173908262c6d31861
SHA1:	979ec04befef45079c027419ea3e41422fd33520
SHA256:	190bf4e62e26ea5e20fc7d64890c388f221a1342ff374dc39b704af1b70b0772
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Detected Mirai

Snort IDS alert for network traffic

Uses known network protocols on non-standard ports

Yara signature match

Uses the "uname" system call to query kernel version information (possible evasion)

Found strings indicative of a multi-platform dropper

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample and/or dropped files contains symbols with suspicious names

Sample listens on a socket

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1324995
Start date and time:	2023-10-13 00:01:11 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	arm7.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/1026@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: arm7.elf

Runtime Messages

Command:	/tmp/arm7.elf
PID:	5478
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

arm7.elf (PID: 5478, Parent: 5401, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm7.elf

arm7.elf New Fork (PID: 5500, Parent: 5478)

arm7.elf New Fork (PID: 5502, Parent: 5500)

arm7.elf New Fork (PID: 5503, Parent: 5500)

arm7.elf New Fork (PID: 5505, Parent: 5500)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
arm7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1aae4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
arm7.elf	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0x1c038:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5502.1.00007f7a0c017000.00007f7a0c035000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1aae4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5502.1.00007f7a0c017000.00007f7a0c035000.r-x.sdmp	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0x1c038:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
5478.1.00007f7a0c017000.00007f7a0c035000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1aae4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1abfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ac74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5478.1.00007f7a0c017000.00007f7a0c035000.r-x.sdmp	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0x1c038:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
Process Memory Space: arm7.elf PID: 5478	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: arm7.elf PID: 5502	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x412f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4143:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4157:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x416b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x417f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4193:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x420b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x421f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4233:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4247:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x425b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x426f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4283:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4297:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x42bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 1 entries

Snort Signatures

ET TROJAN Possible Linux.Mirai Login Attempt (ubnt) - Source IP: 192.168.2.14 - Destination IP: 90.117.81.219

Timestamp:	192.168.2.1490.117.81.21956216232023448 10/13/23-00:03:34.311475
SID:	2023448
Source Port:	56216
Destination Port:	23
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: arm7.elf

Avira: detected

Source: arm7.elf

String: /proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/mnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetwatchdog/var/spool/var/Sofia/var/Condi/usr/compress/bin//compress/bin/compress/usr/encodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//proc/sys/vm/drop_caches3

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50030

Source: unknown	TCP traffic detected without corresponding DNS query: 170.118.117.69
Source: unknown	TCP traffic detected without corresponding DNS query: 165.67.70.200
Source: unknown	TCP traffic detected without corresponding DNS query: 102.68.208.123
Source: unknown	TCP traffic detected without corresponding DNS query: 173.158.117.226
Source: unknown	TCP traffic detected without corresponding DNS query: 37.131.100.28
Source: unknown	TCP traffic detected without corresponding DNS query: 60.9.240.108
Source: unknown	TCP traffic detected without corresponding DNS query: 113.192.125.56
Source: unknown	TCP traffic detected without corresponding DNS query: 132.232.207.223
Source: unknown	TCP traffic detected without corresponding DNS query: 49.38.40.199
Source: unknown	TCP traffic detected without corresponding DNS query: 151.68.119.240
Source: unknown	TCP traffic detected without corresponding DNS query: 132.49.132.35
Source: unknown	TCP traffic detected without corresponding DNS query: 13.213.55.200
Source: unknown	TCP traffic detected without corresponding DNS query: 107.57.204.5
Source: unknown	TCP traffic detected without corresponding DNS query: 95.242.188.151
Source: unknown	TCP traffic detected without corresponding DNS query: 132.55.83.69
Source: unknown	TCP traffic detected without corresponding DNS query: 121.92.76.230
Source: unknown	TCP traffic detected without corresponding DNS query: 57.9.42.126
Source: unknown	TCP traffic detected without corresponding DNS query: 138.103.124.248
Source: unknown	TCP traffic detected without corresponding DNS query: 95.90.215.28
Source: unknown	TCP traffic detected without corresponding DNS query: 197.133.179.123
Source: unknown	TCP traffic detected without corresponding DNS query: 184.238.230.37
Source: unknown	TCP traffic detected without corresponding DNS query: 63.199.167.39
Source: unknown	TCP traffic detected without corresponding DNS query: 211.13.101.46
Source: unknown	TCP traffic detected without corresponding DNS query: 40.202.56.194
Source: unknown	TCP traffic detected without corresponding DNS query: 60.55.33.111
Source: unknown	TCP traffic detected without corresponding DNS query: 124.119.23.223
Source: unknown	TCP traffic detected without corresponding DNS query: 17.20.232.89
Source: unknown	TCP traffic detected without corresponding DNS query: 168.62.15.142
Source: unknown	TCP traffic detected without corresponding DNS query: 45.57.76.252
Source: unknown	TCP traffic detected without corresponding DNS query: 150.127.195.14
Source: unknown	TCP traffic detected without corresponding DNS query: 134.138.69.81
Source: unknown	TCP traffic detected without corresponding DNS query: 80.154.221.255
Source: unknown	TCP traffic detected without corresponding DNS query: 174.40.55.208
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.152.125
Source: unknown	TCP traffic detected without corresponding DNS query: 136.201.130.201
Source: unknown	TCP traffic detected without corresponding DNS query: 51.38.46.151
Source: unknown	TCP traffic detected without corresponding DNS query: 52.8.12.34
Source: unknown	TCP traffic detected without corresponding DNS query: 72.41.57.242
Source: unknown	TCP traffic detected without corresponding DNS query: 220.168.9.213
Source: unknown	TCP traffic detected without corresponding DNS query: 111.220.255.226
Source: unknown	TCP traffic detected without corresponding DNS query: 101.48.163.156
Source: unknown	TCP traffic detected without corresponding DNS query: 58.216.69.125
Source: unknown	TCP traffic detected without corresponding DNS query: 61.75.232.209
Source: unknown	TCP traffic detected without corresponding DNS query: 191.163.128.234
Source: unknown	TCP traffic detected without corresponding DNS query: 218.21.65.164
Source: unknown	TCP traffic detected without corresponding DNS query: 192.222.230.209
Source: unknown	TCP traffic detected without corresponding DNS query: 212.197.253.82
Source: unknown	TCP traffic detected without corresponding DNS query: 91.71.190.100
Source: unknown	TCP traffic detected without corresponding DNS query: 41.206.244.74
Source: unknown	TCP traffic detected without corresponding DNS query: 74.235.147.212

Source: arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5502.1.00007f7a0c017000.00007f7a0c035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5502.1.00007f7a0c017000.00007f7a0c035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 5478.1.00007f7a0c017000.00007f7a0c035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5478.1.00007f7a0c017000.00007f7a0c035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: Process Memory Space: arm7.elf PID: 5478, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm7.elf PID: 5502, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/mnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetwatchdog/var/spool/var/Sofia/var/Condi/usr/compress/bin//compress/bin/compress/usr/encodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//proc/sys/vm/drop_caches3

Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/3790/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/3791/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/3792/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/3793/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5503)	File opened: /proc/262/cmdline	Jump to behavior

Source: arm7.elf, 5478.1.0000558df97f3000.0000558df9944000.rw-.sdmp, arm7.elf, 5502.1.0000558df97f3000.0000558df9921000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: arm7.elf, 5478.1.0000558df97f3000.0000558df9944000.rw-.sdmp, arm7.elf, 5502.1.0000558df97f3000.0000558df9921000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7.elf, 5478.1.00007ffebb461000.00007ffebb482000.rw-.sdmp, arm7.elf, 5502.1.00007ffebb461000.00007ffebb482000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm7.elf, 5478.1.00007ffebb461000.00007ffebb482000.rw-.sdmp, arm7.elf, 5502.1.00007ffebb461000.00007ffebb482000.rw-.sdmp	Binary or memory string: 22x86_64/usr/bin/qemu-arm/tmp/arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.elf

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: arm7.elf, type: SAMPLE

Source: Traffic	Snort IDS: ET TROJAN Possible Linux.Mirai Login Attempt (ubnt)
Source: Traffic	Snort IDS: ET TROJAN Possible Linux.Mirai Login Attempt (ubnt)

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Scripting	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

IP	Domain	Country	ASN	ASN Name	Malicious
37.186.162.134	unknown	Italy	20811	BRENNERCOM-ASIT	false
72.23.64.188	unknown	United States	27364	ACS-INTERNETUS	false
187.136.246.53	unknown	Mexico	8151	UninetSAdeCVMX	false
27.162.72.251	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
46.187.142.202	unknown	Poland	43118	EAW-ASEastandWestNetworkPL	false
147.175.228.76	unknown	Slovakia (SLOVAK Republic)	2607	SANETSlovakAcademicNetworkSK	false
200.249.243.187	unknown	Brazil	4230	CLAROSABR	false
43.52.145.23	unknown	Japan	4249	LILLY-ASUS	false
73.254.82.119	unknown	United States	7922	COMCAST-7922US	false
217.90.113.31	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
105.6.201.218	unknown	South Africa	37168	CELL-CZA	false
64.112.242.45	unknown	United States	5078	ONENET-AS-1US	false
57.234.176.228	unknown	Belgium	2686	ATGS-MMD-ASUS	false
63.182.238.25	unknown	United States	1239	SPRINTLINKUS	false
173.182.225.81	unknown	Canada	852	ASN852CA	false
103.156.143.195	unknown	unknown	134687	TWIDC-AS-APTWIDCLimitedHK	false
65.190.215.29	unknown	United States	11426	TWC-11426-CAROLINASUS	false
106.184.206.36	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
165.104.225.172	unknown	United States	26305	ASN-SSMUS	false
196.33.186.168	unknown	South Africa	3741	ISZA	false
137.172.44.40	unknown	Australia	3549	LVLT-3549US	false
54.106.19.24	unknown	United States	16509	AMAZON-02US	false
91.53.232.25	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
121.23.4.227	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
98.26.127.122	unknown	United States	11426	TWC-11426-CAROLINASUS	false
130.25.198.249	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
139.147.0.172	unknown	United States	22198	LAFAYEUS	false
206.246.191.231	unknown	United States	7332	LIGHTBOUND-ASUS	false
80.24.86.17	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
4.84.3.205	unknown	United States	3356	LEVEL3US	false
37.21.121.108	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
123.135.155.108	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
171.17.236.102	unknown	Germany	12888	Berghamerstr5DE	false
103.11.5.118	unknown	Japan	17819	ASN-EQUINIX-APEquinixAsiaPacificSG	false
159.177.132.244	unknown	Canada	34058	LIFECELL-ASUA	false
73.193.44.207	unknown	United States	7922	COMCAST-7922US	false
115.32.140.1	unknown	China	4766	KIXS-AS-KRKoreaTelecomKR	false
126.149.55.129	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
91.121.98.236	unknown	France	16276	OVHFR	false
141.187.19.193	unknown	United States	12897	HEAGMEDIANETDarmstadtGermanyDE	false
63.32.242.20	unknown	United States	16509	AMAZON-02US	false
216.253.71.93	unknown	United States	3549	LVLT-3549US	false
144.29.251.219	unknown	United States	26258	BASF-CORPUS	false
194.229.225.221	unknown	Netherlands	702	UUNETUS	false
105.199.60.91	unknown	Egypt	36935	Vodafone-EG	false
61.70.50.25	unknown	Taiwan; Republic of China (ROC)	9416	MULTIMEDIA-AS-APHoshinMultimediaCenterIncTW	false
125.247.173.178	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
81.18.94.28	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	false
53.157.116.193	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
25.77.229.162	unknown	United Kingdom	7922	COMCAST-7922US	false
216.59.220.6	unknown	United States	35985	ONERINGNET-ATL-1US	false
9.103.2.140	unknown	United States	3356	LEVEL3US	false
189.89.246.18	unknown	Brazil	28188	ProntoNetLtdaBR	false
190.53.111.87	unknown	El Salvador	27773	MILLICOMCABLEELSALVADORSADECVSV	false
158.26.59.215	unknown	United States	1766	ASN-EXXONMOBIL-US	false
136.18.217.25	unknown	United States	60311	ONEFMCH	false
206.50.86.33	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
51.166.63.52	unknown	United States	2686	ATGS-MMD-ASUS	false
2.21.81.230	unknown	European Union	20940	AKAMAI-ASN1EU	false
67.233.116.105	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
169.253.124.17	unknown	United States	6966	USDOSUS	false
81.51.130.230	unknown	France	3215	FranceTelecom-OrangeFR	false
113.52.88.82	unknown	Macau	4609	CTM-MOCompanhiadeTelecomunicacoesdeMacauSARLMO	false
147.104.168.246	unknown	United States	5953	DNIC-ASBLK-05800-06055US	false
167.91.64.167	unknown	United States	394167	DALLASISDUS	false
220.236.115.2	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
25.101.205.191	unknown	United Kingdom	7922	COMCAST-7922US	false
83.90.202.128	unknown	Denmark	3292	TDCTDCASDK	false
63.198.191.18	unknown	United States	7018	ATT-INTERNET4US	false
25.107.187.172	unknown	United Kingdom	7922	COMCAST-7922US	false
5.11.63.224	unknown	Russian Federation	56578	ALCOM-ASRU	false
152.116.148.19	unknown	United States	2018	TENET-1ZA	false
179.185.45.99	unknown	Brazil	18881	TELEFONICABRASILSABR	false
64.142.173.146	unknown	United States	16415	ALORICAUS	false
171.135.251.128	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
157.63.24.150	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
123.227.251.154	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
60.152.200.222	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
72.61.5.179	unknown	United States	10507	SPCSUS	false
114.75.41.207	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
191.141.228.147	unknown	Brazil	26615	TIMSABR	false
49.7.69.86	unknown	China	23724	CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation	false
53.20.2.66	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
159.1.108.51	unknown	United States	4193	WA-STATE-GOVUS	false
204.149.116.238	unknown	United States	701	UUNETUS	false
97.119.159.2	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
202.65.140.78	unknown	India	18229	CTRLS-AS-INCtrlSDatacentersLtdIN	false
70.45.115.220	unknown	Puerto Rico	14638	LCPRLUS	false
42.198.166.190	unknown	China	7497	CSTNET-AS-APComputerNetworkInformationCenterCN	false
182.82.92.30	unknown	China	23771	SXBCTV-APSXBCTVInternetServiceProviderCN	false
50.124.178.48	unknown	United States	5650	FRONTIER-FRTRUS	false
102.142.67.247	unknown	Gabon	36924	GVA-CanalboxBJ	false
54.219.59.252	unknown	United States	16509	AMAZON-02US	false
113.140.139.139	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
137.10.156.196	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
76.33.233.106	unknown	United States	18494	CENTURYLINK-LEGACY-EMBARQ-WRBGUS	false
184.75.25.232	unknown	United States	12271	TWC-12271-NYCUS	false
143.179.241.139	unknown	Netherlands	13127	VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo	false
31.23.166.85	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
92.140.8.68	unknown	France	3215	FranceTelecom-OrangeFR	false

Source: arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5502.1.00007f7a0c017000.00007f7a0c035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5502.1.00007f7a0c017000.00007f7a0c035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 5478.1.00007f7a0c017000.00007f7a0c035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5478.1.00007f7a0c017000.00007f7a0c035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: Process Memory Space: arm7.elf PID: 5478, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: arm7.elf PID: 5502, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
217.90.113.31	mips	Get hash	malicious	Mirai, Moobot	Browse
105.6.201.218	sora.x86	Get hash	malicious	Mirai	Browse
37.21.121.108	YNGJlsyCem	Get hash	malicious	Mirai	Browse
37.21.121.108	0xLNdGVNNk	Get hash	malicious	Unknown	Browse
106.184.206.36	4c8SdxcpqI	Get hash	malicious	Mirai	Browse
147.175.228.76	X5bKvoLX1E	Get hash	malicious	Mirai	Browse
200.249.243.187	jdp03FGDcV.elf	Get hash	malicious	Mirai	Browse
54.106.19.24	557IyF5NeE	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mirai.diicot.net	x86.elf	Get hash	malicious	Unknown	Browse	80.94.92.20
	0d1pbS7iS5.elf	Get hash	malicious	Unknown	Browse	80.94.92.20
	qWRPhfG8ma.elf	Get hash	malicious	Unknown	Browse	80.94.92.20
	iOSVNJ4jjM.elf	Get hash	malicious	Mirai	Browse	80.94.92.20
	eeHcRU4OrS.elf	Get hash	malicious	Mirai	Browse	80.94.92.20
	FH8EJ7g2Sb.elf	Get hash	malicious	Mirai	Browse	80.94.92.20
	lyjROImFLY.elf	Get hash	malicious	Unknown	Browse	80.94.92.20
	y38hqBMqeN.elf	Get hash	malicious	Mirai, Moobot	Browse	80.94.92.20
	dXOsJqCBq7.elf	Get hash	malicious	Moobot	Browse	80.94.92.20
	9zlTgCkNNG.elf	Get hash	malicious	Moobot	Browse	80.94.92.20
	w0FemtdVXq.elf	Get hash	malicious	Mirai, Moobot	Browse	80.94.92.20
	Ea6q3U71g8.elf	Get hash	malicious	Mirai, Moobot	Browse	80.94.92.20
	DlLK6b8tSR.elf	Get hash	malicious	Moobot	Browse	80.94.92.20
	hydro.arm7-20230929-2339.elf	Get hash	malicious	Mirai, Moobot	Browse	80.94.92.20
	hydro.x86-20230929-2339.elf	Get hash	malicious	Moobot	Browse	80.94.92.20
	hydro.x86_64.elf	Get hash	malicious	Moobot	Browse	80.94.92.20

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UninetSAdeCVMX	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	187.204.6.164
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader	Browse	187.204.6.164
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	187.147.232.147
	file.exe	Get hash	malicious	Amadey, Babuk, Djvu, RedLine, SmokeLoader, Vidar, Xmrig	Browse	187.212.189.11
	GMUDTQ4Ggf.exe	Get hash	malicious	Amadey, DanaBot, SmokeLoader	Browse	201.124.243.137
	NzkDh4Jw6w.elf	Get hash	malicious	Mirai	Browse	189.229.118.3
	1.exe	Get hash	malicious	Agent Tesla, AgentTesla, Amadey, DanaBot, SmokeLoader	Browse	189.169.84.19
	U7nL8525Jp.elf	Get hash	malicious	Mirai	Browse	187.143.136.124
	KObYu4bON9.elf	Get hash	malicious	Mirai	Browse	189.172.2.97
	xd.x86.elf	Get hash	malicious	Mirai	Browse	189.153.199.237
	xd.arm.elf	Get hash	malicious	Mirai	Browse	201.124.127.72
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse	189.169.84.19
	jklarm7-20231011-2200.elf	Get hash	malicious	Mirai	Browse	189.137.209.95
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse	187.212.189.11
	file.exe	Get hash	malicious	Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse	201.119.100.130
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader, Stealc	Browse	187.134.80.172
	E7oBtT1xtt.exe	Get hash	malicious	SmokeLoader	Browse	187.204.6.164
	tdhonP8hHQ.exe	Get hash	malicious	SmokeLoader	Browse	187.204.6.164
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Stealc, Vidar	Browse	201.124.243.137
	qWRPhfG8ma.elf	Get hash	malicious	Unknown	Browse	189.248.104.35
BRENNERCOM-ASIT	t6fSbo83L8.elf	Get hash	malicious	Mirai	Browse	89.190.172.42
	OlxFYE2euF.elf	Get hash	malicious	Mirai	Browse	89.190.184.44
	4OaS4LBRdP.elf	Get hash	malicious	Mirai	Browse	89.190.184.43
	yU0I6rwu8X.elf	Get hash	malicious	Mirai	Browse	89.190.184.21
	skyline.mips.elf	Get hash	malicious	Unknown	Browse	84.18.155.109
	qXxAn4eR98.elf	Get hash	malicious	Mirai	Browse	84.18.155.116
	xsoM1Q7B1g.elf	Get hash	malicious	Mirai	Browse	89.190.184.36
	JSbTSVeXJr.elf	Get hash	malicious	Mirai	Browse	89.190.184.11
	tgpRP2PrY0.elf	Get hash	malicious	Mirai, Moobot	Browse	46.234.228.171
	ACXsZxWsCS.elf	Get hash	malicious	Mirai	Browse	89.190.191.108
	SecuriteInfo.com.Trojan.Linux.Mirai.TNB.21216.17216.elf	Get hash	malicious	Unknown	Browse	217.199.23.166
	x86-20230311-1411.elf	Get hash	malicious	Mirai, Moobot	Browse	37.186.162.147
	12VpS0OsFI.elf	Get hash	malicious	Mirai, Moobot	Browse	37.186.162.147
	KKveTTgaAAsecNNaaaa.arm7.elf	Get hash	malicious	Mirai	Browse	89.190.191.108
	pVHowVapO3.elf	Get hash	malicious	Unknown	Browse	217.199.23.151
	NhX6mDdKZD.elf	Get hash	malicious	Mirai	Browse	89.190.184.29
	PkbywPP8pJ.elf	Get hash	malicious	Mirai	Browse	95.171.54.135
	nVViXjfiE0.elf	Get hash	malicious	Mirai	Browse	89.190.172.64
	tfFA1yjBIa.elf	Get hash	malicious	Mirai	Browse	217.199.23.170
	HXOIPEoZVp.elf	Get hash	malicious	Mirai	Browse	37.186.162.165
ACS-INTERNETUS	ANGvvU583T.elf	Get hash	malicious	Mirai	Browse	24.239.102.35
	29b1b3c4f1f664aa03a53858592d54a7501b9c1c5cb67477bc871f28.elf	Get hash	malicious	Unknown	Browse	24.144.223.91
	3ush6bY3dj.elf	Get hash	malicious	Mirai	Browse	24.101.229.41
	XO9yrA8GlB.elf	Get hash	malicious	Mirai	Browse	24.239.78.177
	S9cW2IvdI9.elf	Get hash	malicious	Mirai	Browse	72.23.64.161
	B1si2xBkUr.elf	Get hash	malicious	Mirai	Browse	24.144.247.43
	pandora.arm.elf	Get hash	malicious	Mirai	Browse	72.23.186.130
	x86.elf	Get hash	malicious	Unknown	Browse	24.239.225.196
	5V9OJ0vIoy.elf	Get hash	malicious	Mirai	Browse	24.101.81.206
	yourbiggestnightmare.arm7.elf	Get hash	malicious	Mirai	Browse	24.144.223.84
	4FSBe9PA75.elf	Get hash	malicious	Mirai	Browse	24.101.229.63
	b3i1fY3wNn.elf	Get hash	malicious	Mirai	Browse	24.101.230.21
	Oh5siiD8WY.elf	Get hash	malicious	Mirai	Browse	24.154.154.250
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	24.239.225.198
	SbuBAP1Hxv.elf	Get hash	malicious	Mirai	Browse	24.144.247.90
	VRx86.elf	Get hash	malicious	Mirai	Browse	24.144.223.97
	05x13U4frm.elf	Get hash	malicious	Mirai	Browse	24.101.254.47
	P82pEZ0o1k.elf	Get hash	malicious	Mirai	Browse	24.154.154.224
	XIN7a48SxM.elf	Get hash	malicious	Mirai	Browse	24.101.81.207
	v7HsAJ14Ts.elf	Get hash	malicious	Unknown	Browse	24.144.136.133

Process:	/tmp/arm7.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:o:o
MD5:	6D7FCE9FEE471194AA8B5B6E47267F03
SHA1:	A3DB5C13FF90A36963278C6A39E4EE3C22E2A436
SHA-256:	1121CFCCD5913F0A63FEC40A6FFD44EA64F9DC135C66634BA001D10BCF4302A2
SHA-512:	2B59D179D9815994F687383A886EA34109889756EFCA5AB27318CC67CE2A21261D12FA6FEE6B8C716F72214EAD55EE0D789D6C35CFF977D40EF5728BA9188A80
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	3.

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.990427322938682
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm7.elf
File size:	198'632 bytes
MD5:	bdc72c56f1569fb173908262c6d31861
SHA1:	979ec04befef45079c027419ea3e41422fd33520
SHA256:	190bf4e62e26ea5e20fc7d64890c388f221a1342ff374dc39b704af1b70b0772
SHA512:	68f5d467ac8e31d22810124d098d03a18ff16e8ae328c8b48aee53bed27a776b2a5c7ca98170020c8a231569641fdfd146b460b094805ac40b198c43af807013
SSDEEP:	6144:CUtcDtF0WQBB0abFymktTe77PCLyfJM/RfsmkjF:CUtcMBB0abFymktKPTfS/GR
TLSH:	47142A45EA404B13C4D72BBAFA9F4245333397A493EB73069528AFB43F8679E4E23505
File Content Preview:	.ELF..............(.........4...._......4. ...(........p.....T...T..p...p...........................h...h...............h...h...h.......\V..............l...l...l...................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	155544
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1a904	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x229f4	0x1a9f4	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x22a08	0x1aa08	0x2ad8	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x254e0	0x1d4e0	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x254f8	0x1d4f8	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2d668	0x1d668	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x2d66c	0x1d66c	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x2d670	0x1d670	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2d670	0x1d670	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2d674	0x1d674	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2d678	0x1d678	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2d67c	0x1d67c	0xc4	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2d740	0x1d740	0x2dc	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2da1c	0x1da1c	0x52a8	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1da1c	0xf10	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1e930	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1ea90	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1ecce	0x29df	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x216ad	0x986	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x22033	0x10da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x23110	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x2344c	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x23f08	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x25732	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x25e62	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x25e78	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x26448	0x6940	0x10	0x0		29	974	4
.strtab	STRTAB	0x0	0x2cd88	0x3a60	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1d4f8	0x254f8	0x254f8	0x170	0x170	4.7332	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1d668	0x1d668	6.1183	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1d668	0x2d668	0x2d668	0x3b4	0x565c	4.3439	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1d66c	0x2d66c	0x2d66c	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm7.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/proc/sys/vm/drop_caches

/tmp/qemu-open.03mIVj (deleted)

/tmp/qemu-open.04DGuk (deleted)

/tmp/qemu-open.0CexRk (deleted)

/tmp/qemu-open.0DYhzh (deleted)

/tmp/qemu-open.0Kedvi (deleted)

/tmp/qemu-open.0Kt5oj (deleted)

/tmp/qemu-open.0R6qRi (deleted)

/tmp/qemu-open.0WCWFh (deleted)

/tmp/qemu-open.0WWS6j (deleted)

/tmp/qemu-open.0Wln9k (deleted)

/tmp/qemu-open.0ZdC5h (deleted)

/tmp/qemu-open.0cP4Qj (deleted)

/tmp/qemu-open.0k9IGi (deleted)

/tmp/qemu-open.0knJAj (deleted)

/tmp/qemu-open.0vW3jh (deleted)

/tmp/qemu-open.0x0oWj (deleted)

/tmp/qemu-open.1Dltji (deleted)

/tmp/qemu-open.1ESJVk (deleted)

/tmp/qemu-open.1IFjhk (deleted)

/tmp/qemu-open.1IhTtk (deleted)

/tmp/qemu-open.1JFT0h (deleted)

/tmp/qemu-open.1JGszk (deleted)

/tmp/qemu-open.1NEvRi (deleted)

/tmp/qemu-open.1TLJ1h (deleted)

Linux Analysis Report
arm7.elf