Edit tour

Linux Analysis Report
Xyl3DnRyQP.elf

Overview

General Information

Sample name:	Xyl3DnRyQP.elf renamed because original name is a hash value
Original sample name:	ddbbea655c459b036698df95380c39a3.elf
Analysis ID:	1417491
MD5:	ddbbea655c459b036698df95380c39a3
SHA1:	8a0a59c1aa650b644f4c7516add05b561427ad41
SHA256:	0fa74ef30a408cf7f0cd17d2cfe5c239f8cc5a618802a0f57547c38a4f9329c3
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417491
Start date and time:	2024-03-29 13:02:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Xyl3DnRyQP.elf renamed because original name is a hash value
Original Sample Name:	ddbbea655c459b036698df95380c39a3.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@22/0

Runtime Messages

Command:	/tmp/Xyl3DnRyQP.elf
PID:	6257
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

Xyl3DnRyQP.elf (PID: 6257, Parent: 6179, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Xyl3DnRyQP.elf

Xyl3DnRyQP.elf New Fork (PID: 6259, Parent: 6257)

Xyl3DnRyQP.elf New Fork (PID: 6261, Parent: 6259)

dash New Fork (PID: 6263, Parent: 4333)

rm (PID: 6263, Parent: 4333, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.XHwzEubSU7 /tmp/tmp.CVHHxINtGa /tmp/tmp.LP09feH2ys

dash New Fork (PID: 6264, Parent: 4333)

rm (PID: 6264, Parent: 4333, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.XHwzEubSU7 /tmp/tmp.CVHHxINtGa /tmp/tmp.LP09feH2ys

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Xyl3DnRyQP.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Xyl3DnRyQP.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Xyl3DnRyQP.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a624:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a638:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a64c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a660:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a674:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a688:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a69c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a700:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a714:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a728:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a73c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a750:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a764:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a778:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a78c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Xyl3DnRyQP.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a4e4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
6257.1.00007f4968017000.00007f4968034000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6257.1.00007f4968017000.00007f4968034000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6257.1.00007f4968017000.00007f4968034000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a624:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a638:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a64c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a660:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a674:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a688:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a69c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a700:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a714:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a728:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a73c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a750:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a764:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a778:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a78c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6257.1.00007f4968017000.00007f4968034000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a4e4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: Xyl3DnRyQP.elf PID: 6257	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: Xyl3DnRyQP.elf PID: 6257	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x267:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x27b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x307:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x31b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x343:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x357:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x36b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x393:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Xyl3DnRyQP.elf PID: 6257	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x14d:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 2 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:50.390641
SID:	2030490
Source Port:	37338
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:25.139778
SID:	2030490
Source Port:	37328
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:44.760949
SID:	2030490
Source Port:	37336
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:03:46.452345
SID:	2030490
Source Port:	37314
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:03:57.723669
SID:	2030490
Source Port:	37318
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:25.996873
SID:	2030490
Source Port:	37346
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:42.041772
SID:	2030490
Source Port:	37334
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:14.776396
SID:	2030490
Source Port:	37324
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:04.138008
SID:	2030490
Source Port:	37322
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:03:37.820892
SID:	2030490
Source Port:	37312
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:16.369195
SID:	2030490
Source Port:	37344
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:00.355414
SID:	2030490
Source Port:	37320
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:35.771698
SID:	2030490
Source Port:	37330
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:31.348203
SID:	2030490
Source Port:	37350
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:39.405965
SID:	2030490
Source Port:	37332
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:03:30.183409
SID:	2030490
Source Port:	37310
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:06.741237
SID:	2030490
Source Port:	37342
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:23.423157
SID:	2030490
Source Port:	37326
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:03:48.085401
SID:	2030490
Source Port:	37316
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:00.020590
SID:	2030490
Source Port:	37340
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:29.716387
SID:	2030490
Source Port:	37348
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: Xyl3DnRyQP.elf	Virustotal: Detection: 47%			Perma Link
Source: Xyl3DnRyQP.elf	ReversingLabs: Detection: 57%

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37310 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37312 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37314 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37316 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37318 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37320 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37322 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37324 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37326 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37328 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37330 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37332 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37334 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37336 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37338 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37340 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37342 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37344 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37346 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37348 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37350 -> 103.173.178.208:43957

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: Xyl3DnRyQP.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Xyl3DnRyQP.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6257.1.00007f4968017000.00007f4968034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6257.1.00007f4968017000.00007f4968034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: Xyl3DnRyQP.elf PID: 6257, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Xyl3DnRyQP.elf PID: 6257, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	SIGKILL sent: pid: 4440, result: successful	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	SIGKILL sent: pid: 4448, result: successful	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	SIGKILL sent: pid: 4499, result: successful	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	SIGKILL sent: pid: 4504, result: successful	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	SIGKILL sent: pid: 4507, result: successful	Jump to behavior

Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/5932/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/5933/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/4507/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/5834/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/4504/cmdline	Jump to behavior
Source: /tmp/Xyl3DnRyQP.elf (PID: 6261)	File opened: /proc/5835/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 6263)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.XHwzEubSU7 /tmp/tmp.CVHHxINtGa /tmp/tmp.LP09feH2ys			Jump to behavior
Source: /usr/bin/dash (PID: 6264)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.XHwzEubSU7 /tmp/tmp.CVHHxINtGa /tmp/tmp.LP09feH2ys			Jump to behavior

Source: Xyl3DnRyQP.elf, 6257.1.00007ffdc4939000.00007ffdc495a000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Xyl3DnRyQP.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Xyl3DnRyQP.elf
Source: Xyl3DnRyQP.elf, 6257.1.00005653eca14000.00005653ecb42000.rw-.sdmp	Binary or memory string: SV!/etc/qemu-binfmt/arm
Source: Xyl3DnRyQP.elf, 6257.1.00005653eca14000.00005653ecb42000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Xyl3DnRyQP.elf, 6257.1.00007ffdc4939000.00007ffdc495a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Yara match	File source: Xyl3DnRyQP.elf, type: SAMPLE
Source: Yara match	File source: 6257.1.00007f4968017000.00007f4968034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Xyl3DnRyQP.elf PID: 6257, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
Xyl3DnRyQP.elf	48%	Virustotal		Browse
Xyl3DnRyQP.elf	58%	ReversingLabs	Linux.Trojan.Mirai
Xyl3DnRyQP.elf	100%	Avira	EXP/ELF.Mirai.Z.A

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
103.173.178.208	ap.akdns.top	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.171.230.55	arm5.elf	Get hash	malicious	Mirai	Browse
	wvp018fajS.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	V6ZLE4LLdV.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	1IE558rszZ.elf	Get hash	malicious	Unknown	Browse
	hxLoX40UD6.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	cg.elf	Get hash	malicious	Sliver	Browse
	LA17v5nS2R.elf	Get hash	malicious	Gafgyt	Browse
	ccmfwrX0Cp.elf	Get hash	malicious	Unknown	Browse
	XmuC72X6YM.elf	Get hash	malicious	Unknown	Browse
103.173.178.208	kunZqJgxWH.elf	Get hash	malicious	Mirai	Browse
	orHFzSoitL.elf	Get hash	malicious	Mirai	Browse
	9j7cNZuGBt.elf	Get hash	malicious	Mirai	Browse
	0FsVELdYxY.elf	Get hash	malicious	Mirai	Browse
	2IS7hqlz6b.elf	Get hash	malicious	Mirai	Browse
	vKJEMWrTHL.elf	Get hash	malicious	Mirai	Browse
	xX2te0Hn5o.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	0FsVELdYxY.elf	Get hash	malicious	Mirai	Browse
	xX2te0Hn5o.elf	Get hash	malicious	Mirai	Browse
	XIbeqhmmQI.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	XmztmwSit3.elf	Get hash	malicious	Unknown	Browse
	D2sLkFb0Il.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ehDbsf5C6M.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm5.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.BtcMine.791.1794.25936.elf	Get hash	malicious	Unknown	Browse
	cG90Z4Gln7.elf	Get hash	malicious	Mirai, Gafgyt	Browse
91.189.91.43	0FsVELdYxY.elf	Get hash	malicious	Mirai	Browse
	xX2te0Hn5o.elf	Get hash	malicious	Mirai	Browse
	XIbeqhmmQI.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	XmztmwSit3.elf	Get hash	malicious	Unknown	Browse
	D2sLkFb0Il.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ehDbsf5C6M.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm5.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.BtcMine.791.1794.25936.elf	Get hash	malicious	Unknown	Browse
	cG90Z4Gln7.elf	Get hash	malicious	Mirai, Gafgyt	Browse
91.189.91.42	0FsVELdYxY.elf	Get hash	malicious	Mirai	Browse
	xX2te0Hn5o.elf	Get hash	malicious	Mirai	Browse
	XIbeqhmmQI.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	XmztmwSit3.elf	Get hash	malicious	Unknown	Browse
	D2sLkFb0Il.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ehDbsf5C6M.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm5.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.BtcMine.791.1794.25936.elf	Get hash	malicious	Unknown	Browse
	cG90Z4Gln7.elf	Get hash	malicious	Mirai, Gafgyt	Browse

Process:	/tmp/Xyl3DnRyQP.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887362
Encrypted:	false
SSDEEP:	3:TgRBG:TgRBG
MD5:	32DD38C8654930501004269A690B79F4
SHA1:	695CF461C09617AA13A0775D9143A70F905A77F2
SHA-256:	868E414EC269B6F0A7C3D05781C373657DC6B6686285A790CCEB56D6F1D0C7C5
SHA-512:	618A867A549A80B92344B9581F48FD4A13B8CF4ED5ADA00B1CFDB0C342407F98382506B02767D7BEF6796FEA05520719F0F7D3F5E208B2C23B0867FC77CA6A6D
Malicious:	false
Reputation:	low
Preview:	/tmp/Xyl3DnRyQP.elf.

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.531277013499928
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Xyl3DnRyQP.elf
File size:	137'984 bytes
MD5:	ddbbea655c459b036698df95380c39a3
SHA1:	8a0a59c1aa650b644f4c7516add05b561427ad41
SHA256:	0fa74ef30a408cf7f0cd17d2cfe5c239f8cc5a618802a0f57547c38a4f9329c3
SHA512:	a3dfe9fa6028bd6317e0f106b935e4a8a6a0d2f6910dc8e1c94407579712f78442918852889af35a0938fd8fd69244a6a707b98c20cca92c5d07f84766f43943
SSDEEP:	1536:BIhcq8nZOrV3HlSdSf9RRoQF+Au4b4Vspf/TZVIfvb6IxkzQqBAlqnQwywzFHRlu:BIhuWrFxF+u4QXlVIfvQMqy9OzvQr
TLSH:	15D30945F8405F23C6C612B7FB5E428D7B2A17E8D3EE720399216F60378695B0E3B946
File Content Preview:	.ELF...a..........(.........4...p.......4. ...(.....................................................0I..............Q.td..................................-...L."...Wg..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	137584
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x19d94	0x0	0x6	AX	16
.fini	PROGBITS	0x21e44	0x19e44	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x21e58	0x19e58	0x2b70	0x0	0x2	A	4
.ctors	PROGBITS	0x2d000	0x1d000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x2d00c	0x1d00c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2d020	0x1d020	0x4910	0x0	0x3	WA	32
.bss	NOBITS	0x31930	0x21930	0x46bc	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x21930	0x3e	0x0	0x0		1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Xyl3DnRyQP.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00mRhE (deleted)

/tmp/qemu-open.01jLvE (deleted)

/tmp/qemu-open.03x4TA (deleted)

/tmp/qemu-open.078GnD (deleted)

/tmp/qemu-open.09PY7D (deleted)

/tmp/qemu-open.09vMJA (deleted)

/tmp/qemu-open.0AOnJC (deleted)

/tmp/qemu-open.0BNbdE (deleted)

/tmp/qemu-open.0BxezE (deleted)

/tmp/qemu-open.0EYFIA (deleted)

/tmp/qemu-open.0KSYhE (deleted)

/tmp/qemu-open.0Ky8WD (deleted)

/tmp/qemu-open.0Mzg6C (deleted)

/tmp/qemu-open.0O0P7E (deleted)

/tmp/qemu-open.0PXVyB (deleted)

/tmp/qemu-open.0Wlm5E (deleted)

/tmp/qemu-open.0fGfdC (deleted)

/tmp/qemu-open.0fTV0E (deleted)

/tmp/qemu-open.0mY9KE (deleted)

/tmp/qemu-open.0pxh0D (deleted)

/tmp/qemu-open.0uVvVC (deleted)

/tmp/qemu-open.12PxNE (deleted)

/tmp/qemu-open.17bQaC (deleted)

/tmp/qemu-open.19OTeE (deleted)

/tmp/qemu-open.1MZQhB (deleted)

/tmp/qemu-open.1RCz3C (deleted)

/tmp/qemu-open.1WaIpC (deleted)

/tmp/qemu-open.1b3rgE (deleted)

/tmp/qemu-open.1pAD8A (deleted)

/tmp/qemu-open.1pwovD (deleted)

Linux Analysis Report
Xyl3DnRyQP.elf

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1c9c8	0x1c9c8	6.0821	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x1d000	0x2d000	0x2d000	0x4930	0x8fec	0.4030	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 13:03:29.921248913 CET	37310	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:30.183020115 CET	43957	37310	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:30.183104038 CET	37310	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:30.183408976 CET	37310	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:30.350141048 CET	33606	443	192.168.2.23	54.171.230.55
Mar 29, 2024 13:03:30.446048021 CET	43957	37310	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:30.446069002 CET	43957	37310	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:30.531972885 CET	443	33606	54.171.230.55	192.168.2.23
Mar 29, 2024 13:03:31.011904955 CET	43928	443	192.168.2.23	91.189.91.42
Mar 29, 2024 13:03:36.391163111 CET	42836	443	192.168.2.23	91.189.91.43
Mar 29, 2024 13:03:37.555535078 CET	37312	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:37.820770025 CET	43957	37312	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:37.820830107 CET	37312	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:37.820892096 CET	37312	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:37.922940969 CET	42516	80	192.168.2.23	109.202.202.202
Mar 29, 2024 13:03:38.086076975 CET	43957	37312	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:38.086091042 CET	43957	37312	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:46.194263935 CET	37314	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:46.452203989 CET	43957	37314	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:46.452274084 CET	37314	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:46.452344894 CET	37314	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:46.710283041 CET	43957	37314	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:46.710421085 CET	43957	37314	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:47.820096970 CET	37316	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:48.085273981 CET	43957	37316	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:48.085339069 CET	37316	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:48.085401058 CET	37316	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:48.353368998 CET	43957	37316	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:48.353384018 CET	43957	37316	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:51.489166021 CET	43928	443	192.168.2.23	91.189.91.42
Mar 29, 2024 13:03:57.461644888 CET	37318	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:57.723484993 CET	43957	37318	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:57.723619938 CET	37318	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:57.723669052 CET	37318	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:03:57.985291958 CET	43957	37318	103.173.178.208	192.168.2.23
Mar 29, 2024 13:03:57.985310078 CET	43957	37318	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:00.093545914 CET	37320	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:00.355180979 CET	43957	37320	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:00.355336905 CET	37320	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:00.355413914 CET	37320	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:00.617230892 CET	43957	37320	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:00.617252111 CET	43957	37320	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:03.775491953 CET	42836	443	192.168.2.23	91.189.91.43
Mar 29, 2024 13:04:03.867954016 CET	37322	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:04.134768963 CET	43957	37322	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:04.134921074 CET	37322	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:04.138008118 CET	37322	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:04.400535107 CET	43957	37322	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:04.400846958 CET	37322	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:04.403338909 CET	43957	37322	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:04.666155100 CET	43957	37322	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:07.870996952 CET	42516	80	192.168.2.23	109.202.202.202
Mar 29, 2024 13:04:14.508414030 CET	37324	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:14.776210070 CET	43957	37324	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:14.776313066 CET	37324	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:14.776396036 CET	37324	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:15.041755915 CET	43957	37324	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:15.041775942 CET	43957	37324	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:15.041873932 CET	37324	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:15.307293892 CET	43957	37324	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:22.149347067 CET	37326	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:22.408483982 CET	43957	37326	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:22.408735037 CET	37326	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:23.164819956 CET	37326	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:23.422966003 CET	43957	37326	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:23.423099995 CET	37326	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:23.423156977 CET	37326	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:23.681263924 CET	43957	37326	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:23.681278944 CET	43957	37326	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:23.681442022 CET	37326	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:23.939542055 CET	43957	37326	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:24.877125025 CET	37328	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:25.139453888 CET	43957	37328	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:25.139642000 CET	37328	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:25.139777899 CET	37328	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:25.401308060 CET	43957	37328	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:25.401410103 CET	43957	37328	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:25.401670933 CET	37328	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:25.663851976 CET	43957	37328	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:32.443573952 CET	43928	443	192.168.2.23	91.189.91.42
Mar 29, 2024 13:04:35.509422064 CET	37330	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:35.771527052 CET	43957	37330	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:35.771640062 CET	37330	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:35.771697998 CET	37330	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:36.033401966 CET	43957	37330	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:36.033427000 CET	43957	37330	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:36.033551931 CET	37330	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:36.295053005 CET	43957	37330	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:39.144046068 CET	37332	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:39.405749083 CET	43957	37332	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:39.405836105 CET	37332	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:39.405965090 CET	37332	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:39.667541981 CET	43957	37332	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:39.667565107 CET	43957	37332	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:39.667668104 CET	37332	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:39.929143906 CET	43957	37332	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:41.778794050 CET	37334	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:42.041492939 CET	43957	37334	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:42.041635036 CET	37334	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:42.041771889 CET	37334	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:42.303455114 CET	43957	37334	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:42.303488016 CET	43957	37334	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:44.499036074 CET	37336	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:44.760746956 CET	43957	37336	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:44.760864019 CET	37336	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:44.760948896 CET	37336	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:45.022443056 CET	43957	37336	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:45.022463083 CET	43957	37336	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:45.022692919 CET	37336	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:45.284292936 CET	43957	37336	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:50.132513046 CET	37338	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:50.390480042 CET	43957	37338	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:50.390587091 CET	37338	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:50.390640974 CET	37338	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:50.648916960 CET	43957	37338	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:50.648936033 CET	43957	37338	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:50.649040937 CET	37338	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:04:50.906987906 CET	43957	37338	103.173.178.208	192.168.2.23
Mar 29, 2024 13:04:59.758621931 CET	37340	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:00.020389080 CET	43957	37340	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:00.020522118 CET	37340	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:00.020590067 CET	37340	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:00.282536983 CET	43957	37340	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:00.282552958 CET	43957	37340	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:06.479424000 CET	37342	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:06.741072893 CET	43957	37342	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:06.741190910 CET	37342	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:06.741236925 CET	37342	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:07.002769947 CET	43957	37342	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:07.002965927 CET	43957	37342	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:07.003084898 CET	37342	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:07.264632940 CET	43957	37342	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:16.110771894 CET	37344	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:16.368959904 CET	43957	37344	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:16.369115114 CET	37344	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:16.369194984 CET	37344	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:16.627060890 CET	43957	37344	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:16.627130032 CET	43957	37344	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:16.627265930 CET	37344	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:16.885293007 CET	43957	37344	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:25.735004902 CET	37346	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:25.996613979 CET	43957	37346	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:25.996732950 CET	37346	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:25.996872902 CET	37346	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:26.259180069 CET	43957	37346	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:26.259195089 CET	43957	37346	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:26.259452105 CET	37346	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:26.521080017 CET	43957	37346	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:29.454704046 CET	37348	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:29.716248035 CET	43957	37348	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:29.716335058 CET	37348	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:29.716387033 CET	37348	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:29.978179932 CET	43957	37348	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:29.978193045 CET	43957	37348	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:29.978291035 CET	37348	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:30.239803076 CET	43957	37348	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:31.086500883 CET	37350	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:31.348051071 CET	43957	37350	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:31.348155022 CET	37350	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:31.348202944 CET	37350	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:31.609677076 CET	43957	37350	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:31.609719038 CET	43957	37350	103.173.178.208	192.168.2.23
Mar 29, 2024 13:05:31.609814882 CET	37350	43957	192.168.2.23	103.173.178.208
Mar 29, 2024 13:05:31.871493101 CET	43957	37350	103.173.178.208	192.168.2.23

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 13:03:29.669359922 CET	40923	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:03:29.920684099 CET	53	40923	8.8.8.8	192.168.2.23
Mar 29, 2024 13:03:37.445914984 CET	34060	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:03:37.555403948 CET	53	34060	8.8.8.8	192.168.2.23
Mar 29, 2024 13:03:46.085340977 CET	46713	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:03:46.194143057 CET	53	46713	8.8.8.8	192.168.2.23
Mar 29, 2024 13:03:47.710534096 CET	38066	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:03:47.819987059 CET	53	38066	8.8.8.8	192.168.2.23
Mar 29, 2024 13:03:57.352544069 CET	59199	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:03:57.461452961 CET	53	59199	8.8.8.8	192.168.2.23
Mar 29, 2024 13:03:59.985352993 CET	44256	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:04:00.093350887 CET	53	44256	8.8.8.8	192.168.2.23
Mar 29, 2024 13:04:03.617204905 CET	38482	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:04:03.867753983 CET	53	38482	8.8.8.8	192.168.2.23
Mar 29, 2024 13:04:14.399723053 CET	36756	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:04:14.508302927 CET	53	36756	8.8.8.8	192.168.2.23
Mar 29, 2024 13:04:22.041112900 CET	34715	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:04:22.149055004 CET	53	34715	8.8.8.8	192.168.2.23
Mar 29, 2024 13:04:24.681529045 CET	53132	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:04:24.876820087 CET	53	53132	8.8.8.8	192.168.2.23
Mar 29, 2024 13:04:35.400484085 CET	48959	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:04:35.509268999 CET	53	48959	8.8.8.8	192.168.2.23
Mar 29, 2024 13:04:39.033330917 CET	42206	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:04:39.143702030 CET	53	42206	8.8.8.8	192.168.2.23
Mar 29, 2024 13:04:41.667676926 CET	33683	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:04:41.778561115 CET	53	33683	8.8.8.8	192.168.2.23
Mar 29, 2024 13:04:44.303685904 CET	42948	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:04:44.498832941 CET	53	42948	8.8.8.8	192.168.2.23
Mar 29, 2024 13:04:50.022357941 CET	56678	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:04:50.132292032 CET	53	56678	8.8.8.8	192.168.2.23
Mar 29, 2024 13:04:59.648085117 CET	48902	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:04:59.758467913 CET	53	48902	8.8.8.8	192.168.2.23
Mar 29, 2024 13:05:06.282160997 CET	58395	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:05:06.479111910 CET	53	58395	8.8.8.8	192.168.2.23
Mar 29, 2024 13:05:16.002190113 CET	40812	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:05:16.110471964 CET	53	40812	8.8.8.8	192.168.2.23
Mar 29, 2024 13:05:25.626367092 CET	60374	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:05:25.734847069 CET	53	60374	8.8.8.8	192.168.2.23
Mar 29, 2024 13:05:29.259447098 CET	46520	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:05:29.454355955 CET	53	46520	8.8.8.8	192.168.2.23
Mar 29, 2024 13:05:30.978387117 CET	49387	53	192.168.2.23	8.8.8.8
Mar 29, 2024 13:05:31.086244106 CET	53	49387	8.8.8.8	192.168.2.23
Mar 29, 2024 13:05:33.609833956 CET	56143	53	192.168.2.23	8.8.8.8

Start time (UTC):	12:03:28
Start date (UTC):	29/03/2024
Path:	/tmp/Xyl3DnRyQP.elf
Arguments:	/tmp/Xyl3DnRyQP.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	12:03:29
Start date (UTC):	29/03/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre