Edit tour

Linux Analysis Report
bot.arm7.elf

Overview

General Information

Sample Name:	bot.arm7.elf
Analysis ID:	1352205
MD5:	1da07e3e7e2fe89c3514d1185c1f4ad8
SHA1:	f649d9a0cc88500428bfd221f26662e957e975ff
SHA256:	40c0d853cca1c20782fa57452f631a5075492f545119fd967afeaf11e741ae1b
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Detected Mirai

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Connects to many ports of the same IP (likely port scanning)

Yara signature match

Uses the "uname" system call to query kernel version information (possible evasion)

Found strings indicative of a multi-platform dropper

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1352205
Start date and time:	2023-12-02 19:41:15 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	bot.arm7.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@19/0

Runtime Messages

Command:	/tmp/bot.arm7.elf
PID:	5426
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

bot.arm7.elf (PID: 5426, Parent: 5349, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/bot.arm7.elf

bot.arm7.elf New Fork (PID: 5428, Parent: 5426)

bot.arm7.elf New Fork (PID: 5430, Parent: 5428)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
bot.arm7.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
bot.arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
bot.arm7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1720c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1725c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1734c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5426.1.00007f525c017000.00007f525c031000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5426.1.00007f525c017000.00007f525c031000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1720c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1725c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1734c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: bot.arm7.elf PID: 5426	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: bot.arm7.elf PID: 5426	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x13993:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x139a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x139bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x139cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x139e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x139f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13aab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13abf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ad3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ae7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13afb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13b0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13b23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558096439572030490 12/02/23-19:41:57.966464
SID:	2030490
Source Port:	58096
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558114439572030490 12/02/23-19:42:52.297551
SID:	2030490
Source Port:	58114
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558104439572030490 12/02/23-19:42:22.882034
SID:	2030490
Source Port:	58104
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558124439572030490 12/02/23-19:43:25.660908
SID:	2030490
Source Port:	58124
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558126439572030490 12/02/23-19:43:36.131460
SID:	2030490
Source Port:	58126
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558098439572030490 12/02/23-19:41:59.445200
SID:	2030490
Source Port:	58098
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558112439572030490 12/02/23-19:42:49.817570
SID:	2030490
Source Port:	58112
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558116439572030490 12/02/23-19:43:01.768018
SID:	2030490
Source Port:	58116
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558102439572030490 12/02/23-19:42:13.408779
SID:	2030490
Source Port:	58102
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558106439572030490 12/02/23-19:42:27.352764
SID:	2030490
Source Port:	58106
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558130439572030490 12/02/23-19:43:51.080537
SID:	2030490
Source Port:	58130
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558110439572030490 12/02/23-19:42:43.341905
SID:	2030490
Source Port:	58110
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558118439572030490 12/02/23-19:43:10.236536
SID:	2030490
Source Port:	58118
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558100439572030490 12/02/23-19:42:05.928773
SID:	2030490
Source Port:	58100
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558108439572030490 12/02/23-19:42:34.827184
SID:	2030490
Source Port:	58108
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558120439572030490 12/02/23-19:43:17.712039
SID:	2030490
Source Port:	58120
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558122439572030490 12/02/23-19:43:24.188586
SID:	2030490
Source Port:	58122
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558128439572030490 12/02/23-19:43:40.606022
SID:	2030490
Source Port:	58128
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1345.142.182.9558132439572030490 12/02/23-19:43:56.557846
SID:	2030490
Source Port:	58132
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: bot.arm7.elf	ReversingLabs: Detection: 67%
Source: bot.arm7.elf	Virustotal: Detection: 64%			Perma Link

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58096 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58098 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58100 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58102 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58104 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58106 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58108 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58110 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58112 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58114 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58116 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58118 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58120 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58122 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58124 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58126 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58128 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58130 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:58132 -> 45.142.182.95:43957

Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26

Source: bot.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5426.1.00007f525c017000.00007f525c031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: bot.arm7.elf PID: 5426, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/5275/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/3643/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/bot.arm7.elf (PID: 5430)	File opened: /proc/816/cmdline	Jump to behavior

Source: bot.arm7.elf, 5426.1.00007ffe6c829000.00007ffe6c84a000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/bot.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/bot.arm7.elf
Source: bot.arm7.elf, 5426.1.0000555f8a738000.0000555f8a888000.rw-.sdmp	Binary or memory string: _U!/etc/qemu-binfmt/arm
Source: bot.arm7.elf, 5426.1.0000555f8a738000.0000555f8a888000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: bot.arm7.elf, 5426.1.00007ffe6c829000.00007ffe6c84a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Yara match	File source: bot.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5426.1.00007f525c017000.00007f525c031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bot.arm7.elf PID: 5426, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Scripting	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	2 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names

Source	Detection	Scanner	Label	Link
bot.arm7.elf	68%	ReversingLabs	Linux.Trojan.Mirai
bot.arm7.elf	65%	Virustotal		Browse
bot.arm7.elf	100%	Avira	EXP/ELF.Mirai.Gen.Z.A

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false
45.142.182.95	botnet.shoprbx.com	Germany		207959	XSSERVERNL	true

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	KKb8ltPB5k.elf	Get hash	malicious	Mirai	Browse
	bot.x86.elf	Get hash	malicious	Mirai	Browse
	mips-20231127-1933.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.Merlin-C.17284.15348.elf	Get hash	malicious	Unknown	Browse
	Va82JacCbA.elf	Get hash	malicious	Unknown	Browse
	5Hgh2qHKJN.elf	Get hash	malicious	Unknown	Browse
	J7acd48WGL.elf	Get hash	malicious	Unknown	Browse
	arm5-20231125-2108.elf	Get hash	malicious	Unknown	Browse
	Bc25hLUROc.elf	Get hash	malicious	Mirai	Browse
	dTTHbSSstN.elf	Get hash	malicious	Mirai	Browse
	syms.x86.elf	Get hash	malicious	Mirai	Browse
	most-x86.elf	Get hash	malicious	Mirai	Browse
	most-arm6.elf	Get hash	malicious	Unknown	Browse
	neUqi2Zx0U.elf	Get hash	malicious	Unknown	Browse
	tIxjwpo9tA.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Moobot	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	sora.x86.elf	Get hash	malicious	Mirai	Browse
	mirai.arm.elf	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
botnet.shoprbx.com	6tD7vXVSda.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	gsFxMe3HhC.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	bApst4aAEZ.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.mips.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.mpsl.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.x86.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.x86_64.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.arm7.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.arm.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.arm5.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	4dxWfgCK6v.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.mpsl.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.x86.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.arm7.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.arm.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.arm5.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.mips.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.x86_64.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.arm.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.x86.elf	Get hash	malicious	Mirai	Browse	194.180.49.237

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
XSSERVERNL	I3jWg7oPwM.exe	Get hash	malicious	Xmrig	Browse	45.142.182.146
	file.exe	Get hash	malicious	Unknown	Browse	45.142.182.146
	http://www.ttin1.blogspot.hu	Get hash	malicious	Unknown	Browse	195.62.46.135
	http://www.jjiklo9988.blogspot.fi	Get hash	malicious	Unknown	Browse	195.62.46.135
	mipsel-20221002-2102.elf	Get hash	malicious	Moobot	Browse	45.142.182.116
	x86_64-20221002-2102.elf	Get hash	malicious	Moobot	Browse	45.142.182.116
	mips-20221002-2102.elf	Get hash	malicious	Moobot	Browse	45.142.182.116
	i686-20221002-2102.elf	Get hash	malicious	Moobot	Browse	45.142.182.116
	arm6-20221002-2102.elf	Get hash	malicious	Mirai, Moobot	Browse	45.142.182.116
	arm7-20221002-2102.elf	Get hash	malicious	Mirai, Moobot	Browse	45.142.182.116
	arm-20221002-2102.elf	Get hash	malicious	Moobot	Browse	45.142.182.116
	x86	Get hash	malicious	Mirai	Browse	195.62.33.226
	59716B314BA0D53B7E8DE32A73AF01B7B383834BF038C.exe	Get hash	malicious	RedLine Socelars	Browse	45.142.182.152
	FE3AE99417E0D632995AD5CEECCC4C0B308B8A30D2C93.exe	Get hash	malicious	Nitol RedLine SmokeLoader Socelars Vidar	Browse	45.142.182.152
	lr11Y0eF0m.exe	Get hash	malicious	Metasploit Raccoon RedLine Socelars Vidar	Browse	45.142.182.152
	setup_x86_x64_install.exe	Get hash	malicious	Backstage Stealer Socelars	Browse	45.142.182.152
	5AHyELsVLZ.exe	Get hash	malicious	Metasploit RedLine Socelars Vidar	Browse	45.142.182.152
	1B0DAF8B1B8A09AE26A72E30FA638B000A991A7DFAF7C.exe	Get hash	malicious	RedLine Socelars Vidar	Browse	45.142.182.152
	setup_x86_x64_install.exe	Get hash	malicious	Cookie Stealer RedLine Socelars	Browse	45.142.182.152
	0A223AA68AF0C2AF0BAABDA61D82748629078720A017E.exe	Get hash	malicious	FormBook RedLine Socelars Vidar	Browse	45.142.182.152
CANONICAL-ASGB	xaarch64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	KKb8ltPB5k.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	eIsiU6BbPe.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	tvOnVQPlql.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	gjh7N6186u.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm7-20231201-1833.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	tgLEk39U	Get hash	malicious	Unknown	Browse	91.189.91.42
	rPmpxBOqv6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	ZlokKccCkK.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	oLiCZWdCxX.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	hAr9ItLrN3.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bot.x86.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	bot.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	bot.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	kinsing_aarch64.elf	Get hash	malicious	Kinsing	Browse	91.189.91.42
	http://45.95.146.26/g/x86	Get hash	malicious	Unknown	Browse	91.189.91.42
	my_miner_test	Get hash	malicious	Xmrig	Browse	91.189.91.42
	3bEvPJYNHw.elf	Get hash	malicious	Mirai	Browse	91.189.91.42

Process:	/tmp/bot.arm7.elf
File Type:	data
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.725480556997868
Encrypted:	false
SSDEEP:	3:Tgul:Tgc
MD5:	7B1712559AB99292868E7939218D6E19
SHA1:	0FE475F3FCA75C260DF62EADDEC3CBC637395A0C
SHA-256:	C65A3C477E7B82C3A242ECEA865098D988A908AF483F0DDFC6FA8886C4E78F27
SHA-512:	515AFC68342EFC3AE1766D67441A3162E637D369224F566023AFFDB092DD765DC70C3248D067D241C8CCA0E0BA3C88FD9D343A9D560CB67B92E4878233299DE3
Malicious:	false
Reputation:	low
Preview:	/tmp/bot.arm7.elf.

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.96899569681944
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	bot.arm7.elf
File size:	179'805 bytes
MD5:	1da07e3e7e2fe89c3514d1185c1f4ad8
SHA1:	f649d9a0cc88500428bfd221f26662e957e975ff
SHA256:	40c0d853cca1c20782fa57452f631a5075492f545119fd967afeaf11e741ae1b
SHA512:	1990a0aa980222d4a0a45b2c6d718c45ca04b53e9084fbe4109472b45a102cb9fdcd182bb15d08dbfccc9e165aa869881cb2b1216624fd0ba8cb32bc12e89275
SSDEEP:	3072:HK/lcxNbBLbcBCkoajwdyqkk4/T/6EBp+u/hJjogM/RHWT+M:HK/CBLbEloajwdybkwRBgu/XMgM/RHWL
TLSH:	C6042A46EA404B13C0D627B5F6DF42453333ABA497EB73069628ABF43F8679E4F22505
File Content Preview:	.ELF..............(.........4...........4. ...(........p............p...p................................................................V..........................................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	138472
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x16fdc	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1f0cc	0x170cc	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1f0e0	0x170e0	0x21a8	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x21288	0x19288	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x212a0	0x192a0	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x29410	0x19410	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x29414	0x19414	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x29418	0x19418	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x29418	0x19418	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2941c	0x1941c	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x29420	0x19420	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x29424	0x19424	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x294e4	0x194e4	0x2f4	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x297d8	0x197d8	0x5304	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x197d8	0xea4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1a680	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1a7e0	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1aa1e	0x29df	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1d3fd	0x986	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1dd83	0x10da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1ee60	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1f19c	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1fc58	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x21482	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x21bb2	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x21bc8	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x22198	0x64c0	0x10	0x0		29	930	4
.strtab	STRTAB	0x0	0x28658	0x3805	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x192a0	0x212a0	0x212a0	0x170	0x170	4.6993	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x19410	0x19410	6.1235	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x19410	0x29410	0x29410	0x3c8	0x56cc	4.3235	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x19414	0x29414	0x29414	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report bot.arm7.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.050OwM (deleted)

/tmp/qemu-open.07GarN (deleted)

/tmp/qemu-open.0QSK9L (deleted)

/tmp/qemu-open.0UZKTK (deleted)

/tmp/qemu-open.0fcLcN (deleted)

/tmp/qemu-open.0qNELN (deleted)

/tmp/qemu-open.0womCM (deleted)

/tmp/qemu-open.11BghN (deleted)

/tmp/qemu-open.12LutL (deleted)

/tmp/qemu-open.169ZMO (deleted)

/tmp/qemu-open.1LkkRL (deleted)

/tmp/qemu-open.1QBIVL (deleted)

/tmp/qemu-open.1UrkXN (deleted)

/tmp/qemu-open.1bC04K (deleted)

/tmp/qemu-open.1gOVLO (deleted)

/tmp/qemu-open.1kWS5O (deleted)

/tmp/qemu-open.1kcosO (deleted)

/tmp/qemu-open.1lw7SM (deleted)

/tmp/qemu-open.1qOOqL (deleted)

/tmp/qemu-open.1vJtKL (deleted)

/tmp/qemu-open.1wSleP (deleted)

/tmp/qemu-open.269sFO (deleted)

/tmp/qemu-open.2FV5bO (deleted)

/tmp/qemu-open.2Kog4M (deleted)

/tmp/qemu-open.2LmU4O (deleted)

/tmp/qemu-open.2NWAcM (deleted)

/tmp/qemu-open.2TdhUM (deleted)

/tmp/qemu-open.2VWQLL (deleted)

/tmp/qemu-open.2h6ZjL (deleted)

/tmp/qemu-open.2kJcDL (deleted)

Linux Analysis Report
bot.arm7.elf

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2023 19:41:57.781459093 CET	58096	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:41:57.966139078 CET	43957	58096	45.142.182.95	192.168.2.13
Dec 2, 2023 19:41:57.966242075 CET	58096	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:41:57.966464043 CET	58096	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:41:58.151036978 CET	43957	58096	45.142.182.95	192.168.2.13
Dec 2, 2023 19:41:58.151061058 CET	43957	58096	45.142.182.95	192.168.2.13
Dec 2, 2023 19:41:58.151401997 CET	58096	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:41:58.336023092 CET	43957	58096	45.142.182.95	192.168.2.13
Dec 2, 2023 19:41:59.257627964 CET	58098	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:41:59.445034981 CET	43957	58098	45.142.182.95	192.168.2.13
Dec 2, 2023 19:41:59.445122004 CET	58098	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:41:59.445199966 CET	58098	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:41:59.632663012 CET	43957	58098	45.142.182.95	192.168.2.13
Dec 2, 2023 19:41:59.632848024 CET	43957	58098	45.142.182.95	192.168.2.13
Dec 2, 2023 19:41:59.633074045 CET	58098	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:41:59.824179888 CET	43957	58098	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:05.740772009 CET	58100	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:05.928572893 CET	43957	58100	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:05.928772926 CET	58100	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:05.928772926 CET	58100	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:06.116672993 CET	43957	58100	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:06.116775036 CET	43957	58100	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:08.529525042 CET	48202	443	192.168.2.13	185.125.190.26
Dec 2, 2023 19:42:13.220757008 CET	58102	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:13.408598900 CET	43957	58102	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:13.408699989 CET	58102	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:13.408778906 CET	58102	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:13.597136021 CET	43957	58102	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:13.597229958 CET	43957	58102	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:13.597310066 CET	58102	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:13.785336971 CET	43957	58102	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:22.696213007 CET	58104	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:22.881892920 CET	43957	58104	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:22.881977081 CET	58104	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:22.882034063 CET	58104	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:23.067768097 CET	43957	58104	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:23.067790031 CET	43957	58104	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:23.067881107 CET	58104	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:23.253608942 CET	43957	58104	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:27.166877031 CET	58106	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:27.352621078 CET	43957	58106	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:27.352691889 CET	58106	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:27.352763891 CET	58106	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:27.538929939 CET	43957	58106	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:27.539110899 CET	43957	58106	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:27.539189100 CET	58106	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:27.725083113 CET	43957	58106	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:34.639015913 CET	58108	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:34.826957941 CET	43957	58108	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:34.827127934 CET	58108	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:34.827183962 CET	58108	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:35.014729023 CET	43957	58108	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:35.014847994 CET	43957	58108	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:35.015063047 CET	58108	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:35.202855110 CET	43957	58108	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:40.529952049 CET	48202	443	192.168.2.13	185.125.190.26
Dec 2, 2023 19:42:43.153925896 CET	58110	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:43.341655016 CET	43957	58110	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:43.341856003 CET	58110	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:43.341905117 CET	58110	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:43.529694080 CET	43957	58110	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:43.529758930 CET	43957	58110	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:43.529990911 CET	58110	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:43.717756987 CET	43957	58110	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:49.629580975 CET	58112	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:49.817367077 CET	43957	58112	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:49.817500114 CET	58112	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:49.817569971 CET	58112	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:50.007108927 CET	43957	58112	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:50.007184982 CET	43957	58112	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:50.007313967 CET	58112	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:50.195398092 CET	43957	58112	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:52.110016108 CET	58114	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:52.297295094 CET	43957	58114	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:52.297472000 CET	58114	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:52.297550917 CET	58114	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:52.484785080 CET	43957	58114	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:52.484869957 CET	43957	58114	45.142.182.95	192.168.2.13
Dec 2, 2023 19:42:52.485003948 CET	58114	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:42:52.672255039 CET	43957	58114	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:01.584696054 CET	58116	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:01.767793894 CET	43957	58116	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:01.767944098 CET	58116	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:01.768018007 CET	58116	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:01.950994968 CET	43957	58116	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:01.951015949 CET	43957	58116	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:01.951149940 CET	58116	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:02.134124994 CET	43957	58116	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:10.050736904 CET	58118	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:10.236345053 CET	43957	58118	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:10.236495972 CET	58118	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:10.236536026 CET	58118	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:10.422220945 CET	43957	58118	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:10.422429085 CET	43957	58118	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:10.422698975 CET	58118	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:10.608237982 CET	43957	58118	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:17.521939039 CET	58120	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:17.711675882 CET	43957	58120	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:17.712038040 CET	58120	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:17.712038994 CET	58120	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:17.901329041 CET	43957	58120	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:17.901345015 CET	43957	58120	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:24.000379086 CET	58122	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:24.188240051 CET	43957	58122	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:24.188585997 CET	58122	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:24.188585997 CET	58122	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:24.375981092 CET	43957	58122	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:24.376023054 CET	43957	58122	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:25.475027084 CET	58124	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:25.660657883 CET	43957	58124	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:25.660840034 CET	58124	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:25.660907984 CET	58124	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:25.846486092 CET	43957	58124	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:25.846532106 CET	43957	58124	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:25.846762896 CET	58124	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:26.032218933 CET	43957	58124	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:35.945470095 CET	58126	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:36.131191015 CET	43957	58126	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:36.131320953 CET	58126	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:36.131459951 CET	58126	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:36.316962957 CET	43957	58126	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:36.317078114 CET	43957	58126	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:36.317189932 CET	58126	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:36.502702951 CET	43957	58126	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:40.419868946 CET	58128	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:40.605772018 CET	43957	58128	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:40.605931044 CET	58128	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:40.606021881 CET	58128	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:40.791670084 CET	43957	58128	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:40.791724920 CET	43957	58128	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:40.791965961 CET	58128	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:40.977726936 CET	43957	58128	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:50.891531944 CET	58130	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:51.080370903 CET	43957	58130	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:51.080535889 CET	58130	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:51.080537081 CET	58130	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:51.269460917 CET	43957	58130	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:51.269499063 CET	43957	58130	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:51.269679070 CET	58130	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:51.458453894 CET	43957	58130	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:56.368419886 CET	58132	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:56.557679892 CET	43957	58132	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:56.557771921 CET	58132	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:56.557846069 CET	58132	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:56.747066975 CET	43957	58132	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:56.747178078 CET	43957	58132	45.142.182.95	192.168.2.13
Dec 2, 2023 19:43:56.747373104 CET	58132	43957	192.168.2.13	45.142.182.95
Dec 2, 2023 19:43:56.936629057 CET	43957	58132	45.142.182.95	192.168.2.13

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2023 19:41:57.675415993 CET	48402	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:41:57.780975103 CET	53	48402	8.8.8.8	192.168.2.13
Dec 2, 2023 19:41:59.151602030 CET	48311	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:41:59.257477045 CET	53	48311	8.8.8.8	192.168.2.13
Dec 2, 2023 19:42:05.633222103 CET	46492	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:42:05.738975048 CET	53	46492	8.8.8.8	192.168.2.13
Dec 2, 2023 19:42:13.117192030 CET	51459	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:42:13.220555067 CET	53	51459	8.8.8.8	192.168.2.13
Dec 2, 2023 19:42:22.597492933 CET	48275	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:42:22.696079969 CET	53	48275	8.8.8.8	192.168.2.13
Dec 2, 2023 19:42:27.068051100 CET	56968	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:42:27.166706085 CET	53	56968	8.8.8.8	192.168.2.13
Dec 2, 2023 19:42:34.539467096 CET	47992	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:42:34.638803005 CET	53	47992	8.8.8.8	192.168.2.13
Dec 2, 2023 19:42:43.015412092 CET	45611	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:42:43.153620005 CET	53	45611	8.8.8.8	192.168.2.13
Dec 2, 2023 19:42:49.530083895 CET	33796	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:42:49.629371881 CET	53	33796	8.8.8.8	192.168.2.13
Dec 2, 2023 19:42:52.007505894 CET	37143	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:42:52.109730959 CET	53	37143	8.8.8.8	192.168.2.13
Dec 2, 2023 19:43:01.485264063 CET	47824	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:43:01.584446907 CET	53	47824	8.8.8.8	192.168.2.13
Dec 2, 2023 19:43:09.951338053 CET	34203	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:43:10.050482035 CET	53	34203	8.8.8.8	192.168.2.13
Dec 2, 2023 19:43:17.422918081 CET	40574	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:43:17.521480083 CET	53	40574	8.8.8.8	192.168.2.13
Dec 2, 2023 19:43:23.901664972 CET	33651	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:43:24.000174046 CET	53	33651	8.8.8.8	192.168.2.13
Dec 2, 2023 19:43:25.376375914 CET	48188	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:43:25.474838972 CET	53	48188	8.8.8.8	192.168.2.13
Dec 2, 2023 19:43:35.846920967 CET	59069	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:43:35.945338964 CET	53	59069	8.8.8.8	192.168.2.13
Dec 2, 2023 19:43:40.317358017 CET	33948	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:43:40.419707060 CET	53	33948	8.8.8.8	192.168.2.13
Dec 2, 2023 19:43:50.792088032 CET	41435	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:43:50.891328096 CET	53	41435	8.8.8.8	192.168.2.13
Dec 2, 2023 19:43:56.269983053 CET	54694	53	192.168.2.13	8.8.8.8
Dec 2, 2023 19:43:56.368233919 CET	53	54694	8.8.8.8	192.168.2.13

Start time (UTC):	18:41:56
Start date (UTC):	02/12/2023
Path:	/tmp/bot.arm7.elf
Arguments:	/tmp/bot.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre