Edit tour

Linux Analysis Report
orHFzSoitL.elf

Overview

General Information

Sample name:	orHFzSoitL.elf renamed because original name is a hash value
Original sample name:	51463bc82373f55c2f79070357cf7a80.elf
Analysis ID:	1417489
MD5:	51463bc82373f55c2f79070357cf7a80
SHA1:	012de079de0f903711947437703290bf907460e3
SHA256:	b886c8b3aeb7d47f224b9d6dda790a37779c65980fb25857d8a5f1a4d9f17e9e
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417489
Start date and time:	2024-03-29 12:59:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	orHFzSoitL.elf renamed because original name is a hash value
Original Sample Name:	51463bc82373f55c2f79070357cf7a80.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@20/0

Runtime Messages

Command:	/tmp/orHFzSoitL.elf
PID:	5549
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

orHFzSoitL.elf (PID: 5549, Parent: 5467, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/orHFzSoitL.elf

orHFzSoitL.elf New Fork (PID: 5553, Parent: 5549)

orHFzSoitL.elf New Fork (PID: 5555, Parent: 5553)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
orHFzSoitL.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
orHFzSoitL.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
orHFzSoitL.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19a1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19aa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19abc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ad0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ae4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19af8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
orHFzSoitL.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x198dc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5549.1.00007fdce8017000.00007fdce8033000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5549.1.00007fdce8017000.00007fdce8033000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5549.1.00007fdce8017000.00007fdce8033000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x19a1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19aa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19abc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ad0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ae4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19af8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5549.1.00007fdce8017000.00007fdce8033000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x198dc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: orHFzSoitL.elf PID: 5549	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: orHFzSoitL.elf PID: 5549	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xeb65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeba1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebf1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeca5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeccd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xece1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecf5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: orHFzSoitL.elf PID: 5549	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xea4b:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 2 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:02:03.442161
SID:	2030490
Source Port:	36620
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:01:35.135325
SID:	2030490
Source Port:	36610
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:01:12.943914
SID:	2030490
Source Port:	36600
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:02:45.484744
SID:	2030490
Source Port:	36632
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:01:38.770815
SID:	2030490
Source Port:	36612
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:01:15.585071
SID:	2030490
Source Port:	36602
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:01:32.499679
SID:	2030490
Source Port:	36608
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:02:13.076987
SID:	2030490
Source Port:	36622
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:02:15.707761
SID:	2030490
Source Port:	36624
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:01:03.302592
SID:	2030490
Source Port:	36598
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:01:52.029264
SID:	2030490
Source Port:	36616
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:01:17.225883
SID:	2030490
Source Port:	36604
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:01:27.865513
SID:	2030490
Source Port:	36606
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:02:26.336769
SID:	2030490
Source Port:	36626
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:02:35.216352
SID:	2030490
Source Port:	36628
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:01:00.668431
SID:	2030490
Source Port:	36596
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:01:49.399316
SID:	2030490
Source Port:	36614
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:01:58.803645
SID:	2030490
Source Port:	36618
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:00:52.037319
SID:	2030490
Source Port:	36594
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:02:40.850734
SID:	2030490
Source Port:	36630
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: orHFzSoitL.elf	Virustotal: Detection: 44%			Perma Link
Source: orHFzSoitL.elf	ReversingLabs: Detection: 47%

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36594 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36596 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36598 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36600 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36602 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36604 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36606 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36608 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36610 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36612 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36614 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36616 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36618 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36620 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36622 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36624 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36626 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36628 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36630 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36632 -> 103.173.178.208:43957

Source: orHFzSoitL.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: orHFzSoitL.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5549.1.00007fdce8017000.00007fdce8033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5549.1.00007fdce8017000.00007fdce8033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: orHFzSoitL.elf PID: 5549, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: orHFzSoitL.elf PID: 5549, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/5386/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/3874/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/3758/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/orHFzSoitL.elf (PID: 5555)	File opened: /proc/260/cmdline	Jump to behavior

Source: orHFzSoitL.elf, 5549.1.0000559c850d4000.0000559c85202000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: orHFzSoitL.elf, 5549.1.00007ffca188e000.00007ffca18af000.rw-.sdmp	Binary or memory string: Nh*bDx86_64/usr/bin/qemu-arm/tmp/orHFzSoitL.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/orHFzSoitL.elf
Source: orHFzSoitL.elf, 5549.1.0000559c850d4000.0000559c85202000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: orHFzSoitL.elf, 5549.1.00007ffca188e000.00007ffca18af000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Yara match	File source: orHFzSoitL.elf, type: SAMPLE
Source: Yara match	File source: 5549.1.00007fdce8017000.00007fdce8033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: orHFzSoitL.elf PID: 5549, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
orHFzSoitL.elf	44%	Virustotal		Browse
orHFzSoitL.elf	47%	ReversingLabs	Linux.Trojan.Mirai
orHFzSoitL.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.173.178.208	9j7cNZuGBt.elf	Get hash	malicious	Mirai	Browse
	0FsVELdYxY.elf	Get hash	malicious	Mirai	Browse
	2IS7hqlz6b.elf	Get hash	malicious	Mirai	Browse
	vKJEMWrTHL.elf	Get hash	malicious	Mirai	Browse
	xX2te0Hn5o.elf	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ap.akdns.top	0FsVELdYxY.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	2IS7hqlz6b.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	vKJEMWrTHL.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	xX2te0Hn5o.elf	Get hash	malicious	Mirai	Browse	103.173.178.208

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	9j7cNZuGBt.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	0FsVELdYxY.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	2IS7hqlz6b.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	vKJEMWrTHL.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	xX2te0Hn5o.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	p8F35SRiO8.elf	Get hash	malicious	Mirai	Browse	103.0.78.243
	7JP4pajFXr.elf	Get hash	malicious	Mirai	Browse	103.176.106.52
	bot.arm7-20240327-1054.elf	Get hash	malicious	Mirai	Browse	103.188.244.189
	Whj7PiS4fK.elf	Get hash	malicious	Mirai, Okiru	Browse	144.205.100.69
	F7u5JkRhpi.elf	Get hash	malicious	Mirai, Okiru	Browse	132.234.242.205

Process:	/tmp/orHFzSoitL.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887362
Encrypted:	false
SSDEEP:	3:TgM5Bn:TgM5Bn
MD5:	F50A7BC5D5B5C68B5740F6F6378FE881
SHA1:	DC51C62A76CC071ECBBF1E0BF9191CA4466582D7
SHA-256:	32D5225606C25F41A59360879D34DE99F441ED82CB3BF7A627E274DA20351385
SHA-512:	CD0F1370F5E5BA3EF80D172794665B98E74FB596159F977A80482BA357636C9F8BEF3367CA2619E36E1D266877287FABDDFB0A885B1214316456077AE37ACB9D
Malicious:	false
Reputation:	low
Preview:	/tmp/orHFzSoitL.elf.

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.537280901234405
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	orHFzSoitL.elf
File size:	133'888 bytes
MD5:	51463bc82373f55c2f79070357cf7a80
SHA1:	012de079de0f903711947437703290bf907460e3
SHA256:	b886c8b3aeb7d47f224b9d6dda790a37779c65980fb25857d8a5f1a4d9f17e9e
SHA512:	e4bb23d25e996cd774a3f757fee08ba379fdb56c9c85612fc25865788fc15f28610e1d501dceeb9b49f5e79f1111f3f58290b8fee5ca9f865cf1070780aa33ab
SSDEEP:	1536:6P8h2C+JG5RHKdC6E8YCTeL1qA1R94V7PqT8ytwrO36F6q+vjZAlkKwywaFpO8TX:60CGP8lw1qK4dq4ytwrWq+rjYQc
TLSH:	ABD30845FC405F23C6D612BBFB5E428D3B2917E8D3EE720399216F21379685B0E36A42
File Content Preview:	.ELF...a..........(.........4...p.......4. ...(.....................................................0I..............Q.td..................................-...L."...Ud..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	133488
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x1918c	0x0	0x6	AX	16
.fini	PROGBITS	0x2123c	0x1923c	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x21250	0x19250	0x2b70	0x0	0x2	A	4
.ctors	PROGBITS	0x2c000	0x1c000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x2c00c	0x1c00c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2c020	0x1c020	0x4910	0x0	0x3	WA	32
.bss	NOBITS	0x30930	0x20930	0x46bc	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x20930	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1bdc0	0x1bdc0	6.0751	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x1c000	0x2c000	0x2c000	0x4930	0x8fec	0.3990	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 13:00:51.778779984 CET	36594	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:00:52.036981106 CET	43957	36594	103.173.178.208	192.168.2.14
Mar 29, 2024 13:00:52.037058115 CET	36594	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:00:52.037318945 CET	36594	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:00:52.295106888 CET	43957	36594	103.173.178.208	192.168.2.14
Mar 29, 2024 13:00:52.295135975 CET	43957	36594	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:00.406424046 CET	36596	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:00.668268919 CET	43957	36596	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:00.668364048 CET	36596	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:00.668431044 CET	36596	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:00.930114985 CET	43957	36596	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:00.930140972 CET	43957	36596	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:00.930214882 CET	36596	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:01.191927910 CET	43957	36596	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:03.040715933 CET	36598	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:03.302450895 CET	43957	36598	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:03.302527905 CET	36598	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:03.302592039 CET	36598	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:03.564172029 CET	43957	36598	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:03.564202070 CET	43957	36598	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:03.564281940 CET	36598	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:03.825978994 CET	43957	36598	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:12.678486109 CET	36600	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:12.943733931 CET	43957	36600	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:12.943846941 CET	36600	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:12.943913937 CET	36600	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:13.209012032 CET	43957	36600	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:13.209032059 CET	43957	36600	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:13.209151030 CET	36600	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:13.475759029 CET	43957	36600	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:15.319506884 CET	36602	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:15.584883928 CET	43957	36602	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:15.585071087 CET	36602	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:15.585071087 CET	36602	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:15.850550890 CET	43957	36602	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:15.850574970 CET	43957	36602	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:15.850775003 CET	36602	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:16.116184950 CET	43957	36602	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:16.960575104 CET	36604	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:17.225708961 CET	43957	36604	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:17.225826025 CET	36604	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:17.225883007 CET	36604	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:17.491108894 CET	43957	36604	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:17.491369009 CET	43957	36604	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:17.491595030 CET	36604	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:17.756972075 CET	43957	36604	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:27.602433920 CET	36606	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:27.865360975 CET	43957	36606	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:27.865470886 CET	36606	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:27.865513086 CET	36606	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:28.127283096 CET	43957	36606	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:28.127310991 CET	43957	36606	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:28.127476931 CET	36606	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:28.389127016 CET	43957	36606	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:32.237694979 CET	36608	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:32.499480963 CET	43957	36608	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:32.499679089 CET	36608	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:32.499679089 CET	36608	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:32.761456966 CET	43957	36608	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:32.761482000 CET	43957	36608	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:32.761734009 CET	36608	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:33.023509979 CET	43957	36608	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:34.869817972 CET	36610	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:35.135117054 CET	43957	36610	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:35.135234118 CET	36610	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:35.135324955 CET	36610	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:35.402865887 CET	43957	36610	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:35.402899981 CET	43957	36610	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:35.403069019 CET	36610	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:35.669032097 CET	43957	36610	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:38.512092113 CET	36612	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:38.770627975 CET	43957	36612	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:38.770800114 CET	36612	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:38.770814896 CET	36612	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:39.028887033 CET	43957	36612	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:39.028903961 CET	43957	36612	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:49.137296915 CET	36614	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:49.399115086 CET	43957	36614	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:49.399271011 CET	36614	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:49.399316072 CET	36614	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:49.661359072 CET	43957	36614	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:49.661412001 CET	43957	36614	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:51.770833015 CET	36616	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:52.029066086 CET	43957	36616	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:52.029263020 CET	36616	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:52.029263973 CET	36616	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:52.287489891 CET	43957	36616	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:52.287513018 CET	43957	36616	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:52.287717104 CET	36616	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:52.545933962 CET	43957	36616	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:58.541116953 CET	36618	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:58.803484917 CET	43957	36618	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:58.803596973 CET	36618	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:58.803644896 CET	36618	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:59.065917015 CET	43957	36618	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:59.065964937 CET	43957	36618	103.173.178.208	192.168.2.14
Mar 29, 2024 13:01:59.066076994 CET	36618	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:01:59.327601910 CET	43957	36618	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:03.179332018 CET	36620	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:03.441932917 CET	43957	36620	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:03.442161083 CET	36620	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:03.442161083 CET	36620	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:03.703955889 CET	43957	36620	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:03.703974962 CET	43957	36620	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:03.704159975 CET	36620	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:03.965802908 CET	43957	36620	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:12.814560890 CET	36622	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:13.076822042 CET	43957	36622	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:13.076948881 CET	36622	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:13.076987028 CET	36622	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:13.340317965 CET	43957	36622	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:13.340415001 CET	43957	36622	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:13.340527058 CET	36622	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:13.602273941 CET	43957	36622	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:15.448981047 CET	36624	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:15.707472086 CET	43957	36624	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:15.707577944 CET	36624	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:15.707761049 CET	36624	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:15.965774059 CET	43957	36624	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:15.965823889 CET	43957	36624	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:15.965920925 CET	36624	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:16.224040031 CET	43957	36624	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:26.075301886 CET	36626	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:26.336517096 CET	43957	36626	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:26.336649895 CET	36626	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:26.336769104 CET	36626	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:26.594743013 CET	43957	36626	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:26.594762087 CET	43957	36626	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:26.594961882 CET	36626	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:26.853048086 CET	43957	36626	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:34.954569101 CET	36628	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:35.216089010 CET	43957	36628	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:35.216207027 CET	36628	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:35.216351986 CET	36628	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:35.477993965 CET	43957	36628	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:35.478009939 CET	43957	36628	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:35.478204012 CET	36628	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:35.740067959 CET	43957	36628	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:40.588810921 CET	36630	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:40.850573063 CET	43957	36630	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:40.850693941 CET	36630	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:40.850733995 CET	36630	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:41.112382889 CET	43957	36630	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:41.112411022 CET	43957	36630	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:41.112670898 CET	36630	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:41.374664068 CET	43957	36630	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:45.222816944 CET	36632	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:45.484556913 CET	43957	36632	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:45.484708071 CET	36632	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:45.484744072 CET	36632	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:02:45.746535063 CET	43957	36632	103.173.178.208	192.168.2.14
Mar 29, 2024 13:02:45.746623993 CET	43957	36632	103.173.178.208	192.168.2.14

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 13:00:51.439043045 CET	43100	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:00:51.778310061 CET	53	43100	8.8.8.8	192.168.2.14
Mar 29, 2024 13:01:00.295464039 CET	54339	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:01:00.405045986 CET	53	54339	8.8.8.8	192.168.2.14
Mar 29, 2024 13:01:02.930339098 CET	41365	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:01:03.040391922 CET	53	41365	8.8.8.8	192.168.2.14
Mar 29, 2024 13:01:12.564141035 CET	33158	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:01:12.675364017 CET	53	33158	8.8.8.8	192.168.2.14
Mar 29, 2024 13:01:15.209414959 CET	40753	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:01:15.319396019 CET	53	40753	8.8.8.8	192.168.2.14
Mar 29, 2024 13:01:16.850936890 CET	55240	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:01:16.960319996 CET	53	55240	8.8.8.8	192.168.2.14
Mar 29, 2024 13:01:27.491420031 CET	57043	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:01:27.602274895 CET	53	57043	8.8.8.8	192.168.2.14
Mar 29, 2024 13:01:32.127542019 CET	34363	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:01:32.237483025 CET	53	34363	8.8.8.8	192.168.2.14
Mar 29, 2024 13:01:34.761951923 CET	57288	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:01:34.869610071 CET	53	57288	8.8.8.8	192.168.2.14
Mar 29, 2024 13:01:38.403179884 CET	60994	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:01:38.511873007 CET	53	60994	8.8.8.8	192.168.2.14
Mar 29, 2024 13:01:49.028949022 CET	43234	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:01:49.137073040 CET	53	43234	8.8.8.8	192.168.2.14
Mar 29, 2024 13:01:51.661606073 CET	38368	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:01:51.770653009 CET	53	38368	8.8.8.8	192.168.2.14
Mar 29, 2024 13:01:58.287702084 CET	52119	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:01:58.540924072 CET	53	52119	8.8.8.8	192.168.2.14
Mar 29, 2024 13:02:03.066267967 CET	40731	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:02:03.179012060 CET	53	40731	8.8.8.8	192.168.2.14
Mar 29, 2024 13:02:12.704145908 CET	42533	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:02:12.814327002 CET	53	42533	8.8.8.8	192.168.2.14
Mar 29, 2024 13:02:15.340645075 CET	53570	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:02:15.448807001 CET	53	53570	8.8.8.8	192.168.2.14
Mar 29, 2024 13:02:25.965787888 CET	46112	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:02:26.075115919 CET	53	46112	8.8.8.8	192.168.2.14
Mar 29, 2024 13:02:34.594898939 CET	45607	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:02:34.954269886 CET	53	45607	8.8.8.8	192.168.2.14
Mar 29, 2024 13:02:40.478324890 CET	48782	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:02:40.588556051 CET	53	48782	8.8.8.8	192.168.2.14
Mar 29, 2024 13:02:45.112715006 CET	47613	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:02:45.222548008 CET	53	47613	8.8.8.8	192.168.2.14

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report orHFzSoitL.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.01VGzf (deleted)

/tmp/qemu-open.01sOMe (deleted)

/tmp/qemu-open.0A7otf (deleted)

/tmp/qemu-open.0BVj1f (deleted)

/tmp/qemu-open.0CWgsh (deleted)

/tmp/qemu-open.0Fv3ch (deleted)

/tmp/qemu-open.0GgaLf (deleted)

/tmp/qemu-open.0KNywg (deleted)

/tmp/qemu-open.0UHksf (deleted)

/tmp/qemu-open.0VZOqf (deleted)

/tmp/qemu-open.0XK95d (deleted)

/tmp/qemu-open.0cDxHd (deleted)

/tmp/qemu-open.0fOmhf (deleted)

/tmp/qemu-open.0mYiqe (deleted)

/tmp/qemu-open.0plHWc (deleted)

/tmp/qemu-open.0teVvg (deleted)

/tmp/qemu-open.11hdRd (deleted)

/tmp/qemu-open.19BrXc (deleted)

/tmp/qemu-open.19fLlg (deleted)

/tmp/qemu-open.1Ey6od (deleted)

/tmp/qemu-open.1LsPDe (deleted)

/tmp/qemu-open.1TBvog (deleted)

/tmp/qemu-open.1YPPDf (deleted)

/tmp/qemu-open.1b0aTc (deleted)

/tmp/qemu-open.1n7urd (deleted)

/tmp/qemu-open.1o1w9e (deleted)

/tmp/qemu-open.1sUSBe (deleted)

/tmp/qemu-open.1xRhFd (deleted)

/tmp/qemu-open.20cV3f (deleted)

/tmp/qemu-open.24Eh4f (deleted)

Linux Analysis Report
orHFzSoitL.elf

Start time (UTC):	12:00:50
Start date (UTC):	29/03/2024
Path:	/tmp/orHFzSoitL.elf
Arguments:	/tmp/orHFzSoitL.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre