Edit tour

Linux Analysis Report
m7Bm4mCkhy.elf

Overview

General Information

Sample Name:	m7Bm4mCkhy.elf
Original Sample Name:	b90c3936318a477ab27d5f95caa3deee.elf
Analysis ID:	1351989
MD5:	b90c3936318a477ab27d5f95caa3deee
SHA1:	d0bedb107e84bd16fa8212ee9a415affe20aba9c
SHA256:	d34e502121da37a559a5154935cf3079a3f99d320373020f4f48e5509a96c5a8
Tags:	32elfintelmirai
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample tries to kill multiple processes (SIGKILL)

Connects to many ports of the same IP (likely port scanning)

Reads CPU information from /sys indicative of miner or evasive malware

Yara signature match

Creates hidden files and/or directories

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample tries to kill a process (SIGKILL)

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1351989
Start date and time:	2023-12-02 10:43:34 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	m7Bm4mCkhy.elf renamed because original name is a hash value
Original Sample Name:	b90c3936318a477ab27d5f95caa3deee.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/0@1/0

Runtime Messages

Command:	/tmp/m7Bm4mCkhy.elf
PID:	5431
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	J4d3Gr33n.
Standard Error:

Process Tree

system is lnxubuntu20

m7Bm4mCkhy.elf (PID: 5431, Parent: 5349, MD5: b90c3936318a477ab27d5f95caa3deee) Arguments: /tmp/m7Bm4mCkhy.elf

m7Bm4mCkhy.elf New Fork (PID: 5432, Parent: 5431)

m7Bm4mCkhy.elf New Fork (PID: 5433, Parent: 5432)

m7Bm4mCkhy.elf New Fork (PID: 5434, Parent: 5432)

m7Bm4mCkhy.elf New Fork (PID: 5435, Parent: 5432)

xfce4-panel New Fork (PID: 5439, Parent: 3147)

wrapper-2.0 (PID: 5439, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5440, Parent: 3147)

wrapper-2.0 (PID: 5440, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5441, Parent: 3147)

wrapper-2.0 (PID: 5441, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5442, Parent: 3147)

wrapper-2.0 (PID: 5442, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 5462, Parent: 5442)

xfpm-power-backlight-helper (PID: 5462, Parent: 5442, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 5443, Parent: 3147)

wrapper-2.0 (PID: 5443, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5444, Parent: 3147)

wrapper-2.0 (PID: 5444, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 5464, Parent: 5463)

xfconfd (PID: 5464, Parent: 5463, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
m7Bm4mCkhy.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
m7Bm4mCkhy.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
m7Bm4mCkhy.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x47b0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
m7Bm4mCkhy.elf	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x16d7a:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
m7Bm4mCkhy.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xf612:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
m7Bm4mCkhy.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x12ca5:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
m7Bm4mCkhy.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x115e1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
m7Bm4mCkhy.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xf5e2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5435.1.0000000008048000.0000000008061000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5435.1.0000000008048000.0000000008061000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5435.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x47b0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5435.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x16d7a:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
5435.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xf612:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5435.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x12ca5:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5435.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x115e1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5435.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xf5e2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5433.1.0000000008048000.0000000008061000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5433.1.0000000008048000.0000000008061000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5433.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x47b0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5433.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x16d7a:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
5433.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xf612:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5433.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x12ca5:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5433.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x115e1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5433.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xf5e2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5431.1.0000000008048000.0000000008061000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5431.1.0000000008048000.0000000008061000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5431.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x47b0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5431.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x16d7a:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
5431.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xf612:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5431.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x12ca5:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5431.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x115e1:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5431.1.0000000008048000.0000000008061000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xf5e2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: m7Bm4mCkhy.elf PID: 5431	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: m7Bm4mCkhy.elf PID: 5433	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: m7Bm4mCkhy.elf PID: 5435	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 22 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: m7Bm4mCkhy.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: m7Bm4mCkhy.elf	ReversingLabs: Detection: 70%
Source: m7Bm4mCkhy.elf	Virustotal: Detection: 60%			Perma Link

Machine Learning detection for sample

Source: m7Bm4mCkhy.elf

Joe Sandbox ML: detected

Source: /tmp/m7Bm4mCkhy.elf (PID: 5432)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/thread_siblings_list			Jump to behavior
Source: /tmp/m7Bm4mCkhy.elf (PID: 5432)	Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/thread_siblings_list			Jump to behavior

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 156.73.121.132 ports 1,2,3,5,7,37215

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.49.133.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.251.64.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.160.183.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.92.113.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.112.38.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.1.105.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.48.224.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.37.151.16:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.250.172.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.56.254.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.238.27.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.11.165.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.158.202.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.29.52.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.91.134.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.122.4.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.7.33.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.55.107.235:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.75.212.49:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.45.176.186:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.159.239.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.96.218.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.236.210.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.241.195.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.3.229.141:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.55.78.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.16.148.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.33.200.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.103.103.44:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.253.177.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.101.206.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.103.86.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.156.25.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.154.170.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.2.255.158:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.190.217.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.42.228.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.125.55.210:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.170.220.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.135.137.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.148.5.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.83.154.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.151.84.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.53.152.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.98.87.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.114.35.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.27.85.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.62.94.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.224.100.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.54.36.175:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.216.217.186:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.0.149.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.196.113.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.142.178.145:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.97.126.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.254.5.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.23.10.113:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.167.245.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.163.249.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.247.90.164:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.112.59.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.181.252.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.149.141.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.152.185.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.236.80.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.52.116.192:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.44.134.201:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.214.28.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.67.238.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.91.28.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.221.223.149:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.216.124.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.21.69.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.179.92.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.102.118.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.19.205.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.169.143.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.250.92.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.97.62.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.182.27.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.118.254.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.179.66.252:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.58.7.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.44.128.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.125.214.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.9.160.67:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.138.6.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.37.0.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.15.16.247:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.249.64.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.176.157.46:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.217.68.212:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.24.90.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.195.8.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.198.69.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.13.216.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.95.237.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.210.219.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.117.182.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.102.207.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.222.249.7:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.250.57.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.50.61.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.37.227.114:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.3.206.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.181.149.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.186.39.210:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.231.114.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.30.9.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.85.175.165:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.137.22.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.210.52.16:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.152.138.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.74.43.47:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.170.52.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.219.8.51:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.87.231.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.118.163.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.245.145.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.2.62.189:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.168.8.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.59.237.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.215.75.131:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.119.232.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.113.142.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.159.157.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.27.133.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.66.180.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.218.85.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.217.91.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.158.143.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.40.44.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.0.211.93:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.10.87.149:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.9.66.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.132.0.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.164.255.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.119.34.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.155.75.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.101.71.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.196.231.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.178.14.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.253.88.58:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.242.31.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.131.64.51:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.95.102.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.92.68.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.16.94.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.136.164.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.218.181.32:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.110.136.59:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.166.74.124:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.33.57.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.60.132.145:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.166.183.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.166.142.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.57.236.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.42.246.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.146.88.44:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.162.153.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.79.169.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.252.181.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.113.47.215:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.140.16.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.78.220.137:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.94.205.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.252.242.3:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.200.162.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.211.139.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.137.120.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.156.98.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.110.26.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.179.109.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.93.230.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.203.253.15:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.1.129.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.22.142.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.79.104.158:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.113.142.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.38.82.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.140.240.192:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.251.246.80:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.115.103.224:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.183.243.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.133.54.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.205.74.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.50.165.38:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.119.91.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.15.72.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.73.121.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.114.31.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.168.239.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.218.165.217:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.80.77.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.43.34.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.221.90.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.177.69.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.59.134.225:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.176.93.208:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.93.237.231:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.209.39.54:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.9.172.145:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.93.14.59:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.176.50.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.6.141.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.164.209.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.130.2.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.185.153.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.233.158.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.126.56.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.101.16.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.123.164.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.235.76.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.198.54.224:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.194.77.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.119.192.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.248.228.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.147.243.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.46.136.130:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.26.235.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.239.212.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.143.220.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.156.171.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.159.158.0:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.162.207.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.36.144.67:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.117.25.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.225.189.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.178.158.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.179.221.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.103.60.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.253.166.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.223.112.14:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.129.75.96:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.94.180.154:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.204.253.186:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.98.219.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.212.244.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.54.3.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.204.121.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.236.202.40:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.40.18.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.108.56.192:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.156.59.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.173.235.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.219.249.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.174.241.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.27.207.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.142.35.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.42.115.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.241.6.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.9.149.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.124.141.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.204.102.59:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.98.148.144:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.237.18.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.189.121.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.68.195.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.247.191.40:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.156.172.124:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.68.254.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.143.12.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.160.96.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.21.251.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.66.133.252:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.187.182.49:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.190.31.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.53.62.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.63.26.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.47.1.47:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.255.76.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.246.227.62:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.84.100.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.164.130.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.1.14.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.210.99.84:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.142.182.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.155.189.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.237.253.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.105.37.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.154.212.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.17.196.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.45.76.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.170.86.180:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.51.245.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.220.235.137:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.153.108.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.118.58.137:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.36.140.10:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.228.129.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.169.78.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.204.108.79:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.191.19.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.202.192.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.172.145.32:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.178.60.144:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.223.25.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.153.188.52:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.164.183.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.14.103.235:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.8.39.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.155.193.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.24.175.175:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.79.178.15:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.142.243.41:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.4.175.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.63.69.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:23725 -> 156.81.64.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:2372

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report
m7Bm4mCkhy.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report m7Bm4mCkhy.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

Linux Analysis Report
m7Bm4mCkhy.elf