Edit tour

Linux Analysis Report
oiutpipVmw.elf

Overview

General Information

Sample name:	oiutpipVmw.elf renamed because original name is a hash value
Original sample name:	6c513d80c41ed1c9889482fe0a1655c3.elf
Analysis ID:	1417494
MD5:	6c513d80c41ed1c9889482fe0a1655c3
SHA1:	5983cc7c92e61b149164332f1b505320432ce8d5
SHA256:	b4ec4ccfc14fd89585900f245bfc950016723ee4689c6c67073efb908aaf2d07
Tags:	32elfmirairenesas
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417494
Start date and time:	2024-03-29 13:04:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	oiutpipVmw.elf renamed because original name is a hash value
Original Sample Name:	6c513d80c41ed1c9889482fe0a1655c3.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@23/0

Runtime Messages

Command:	/tmp/oiutpipVmw.elf
PID:	5488
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

oiutpipVmw.elf (PID: 5488, Parent: 5412, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/oiutpipVmw.elf

oiutpipVmw.elf New Fork (PID: 5491, Parent: 5488)

oiutpipVmw.elf New Fork (PID: 5493, Parent: 5491)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
oiutpipVmw.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
oiutpipVmw.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
oiutpipVmw.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16930:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16944:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1696c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
oiutpipVmw.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x167f0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5488.1.00007fb61c400000.00007fb61c419000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5488.1.00007fb61c400000.00007fb61c419000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5488.1.00007fb61c400000.00007fb61c419000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16930:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16944:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1696c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5488.1.00007fb61c400000.00007fb61c419000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x167f0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: oiutpipVmw.elf PID: 5488	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: oiutpipVmw.elf PID: 5488	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x7fe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7ffc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8010:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8024:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x804c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8088:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x809c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x80b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x80c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x80d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x80ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x813c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: oiutpipVmw.elf PID: 5488	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x7ece:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 2 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:08.728585
SID:	2030490
Source Port:	36590
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:43.307740
SID:	2030490
Source Port:	36580
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:06:33.797300
SID:	2030490
Source Port:	36620
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:14.354961
SID:	2030490
Source Port:	36592
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:58.470011
SID:	2030490
Source Port:	36610
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:30.954825
SID:	2030490
Source Port:	36600
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:06:05.187716
SID:	2030490
Source Port:	36612
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:33.660536
SID:	2030490
Source Port:	36602
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:47.833556
SID:	2030490
Source Port:	36608
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:06:38.430848
SID:	2030490
Source Port:	36622
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:06:46.201444
SID:	2030490
Source Port:	36624
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:29.254111
SID:	2030490
Source Port:	36598
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:06:12.445984
SID:	2030490
Source Port:	36616
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:39.300960
SID:	2030490
Source Port:	36604
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:42.136279
SID:	2030490
Source Port:	36606
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:56.374547
SID:	2030490
Source Port:	36586
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:05.096026
SID:	2030490
Source Port:	36588
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:24.619168
SID:	2030490
Source Port:	36596
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:06:07.817225
SID:	2030490
Source Port:	36614
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:06:23.161279
SID:	2030490
Source Port:	36618
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:05:16.987132
SID:	2030490
Source Port:	36594
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:46.028214
SID:	2030490
Source Port:	36582
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.173.178.208

Timestamp:	03/29/24-13:04:54.659722
SID:	2030490
Source Port:	36584
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Source: oiutpipVmw.elf	ReversingLabs: Detection: 55%
Source: oiutpipVmw.elf	Virustotal: Detection: 50%			Perma Link

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36580 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36582 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36584 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36586 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36588 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36590 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36592 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36594 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36596 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36598 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36600 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36602 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36604 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36606 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36608 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36610 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36612 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36614 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36616 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36618 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36620 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36622 -> 103.173.178.208:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:36624 -> 103.173.178.208:43957

Source: oiutpipVmw.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: oiutpipVmw.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5488.1.00007fb61c400000.00007fb61c419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5488.1.00007fb61c400000.00007fb61c419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: oiutpipVmw.elf PID: 5488, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: oiutpipVmw.elf PID: 5488, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/3757/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/3758/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/3662/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/oiutpipVmw.elf (PID: 5493)	File opened: /proc/261/cmdline	Jump to behavior

Source: oiutpipVmw.elf, 5488.1.00007ffe76332000.00007ffe76353000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/oiutpipVmw.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/oiutpipVmw.elf
Source: oiutpipVmw.elf, 5488.1.00007ffe76332000.00007ffe76353000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: oiutpipVmw.elf, 5488.1.000055c12d240000.000055c12d2a3000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: oiutpipVmw.elf, 5488.1.000055c12d240000.000055c12d2a3000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Source: Yara match	File source: oiutpipVmw.elf, type: SAMPLE
Source: Yara match	File source: 5488.1.00007fb61c400000.00007fb61c419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oiutpipVmw.elf PID: 5488, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
oiutpipVmw.elf	55%	ReversingLabs	Linux.Trojan.Mirai
oiutpipVmw.elf	51%	Virustotal		Browse
oiutpipVmw.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.173.178.208	Xyl3DnRyQP.elf	Get hash	malicious	Mirai	Browse
	kunZqJgxWH.elf	Get hash	malicious	Mirai	Browse
	orHFzSoitL.elf	Get hash	malicious	Mirai	Browse
	9j7cNZuGBt.elf	Get hash	malicious	Mirai	Browse
	0FsVELdYxY.elf	Get hash	malicious	Mirai	Browse
	2IS7hqlz6b.elf	Get hash	malicious	Mirai	Browse
	vKJEMWrTHL.elf	Get hash	malicious	Mirai	Browse
	xX2te0Hn5o.elf	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ap.akdns.top	Xyl3DnRyQP.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	kunZqJgxWH.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	orHFzSoitL.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	9j7cNZuGBt.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	0FsVELdYxY.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	2IS7hqlz6b.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	vKJEMWrTHL.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	xX2te0Hn5o.elf	Get hash	malicious	Mirai	Browse	103.173.178.208

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	Xyl3DnRyQP.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	kunZqJgxWH.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	orHFzSoitL.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	9j7cNZuGBt.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	0FsVELdYxY.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	2IS7hqlz6b.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	vKJEMWrTHL.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	xX2te0Hn5o.elf	Get hash	malicious	Mirai	Browse	103.173.178.208
	p8F35SRiO8.elf	Get hash	malicious	Mirai	Browse	103.0.78.243
	7JP4pajFXr.elf	Get hash	malicious	Mirai	Browse	103.176.106.52

Process:	/tmp/oiutpipVmw.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6841837197791887
Encrypted:	false
SSDEEP:	3:TgXQQb03:Tg+
MD5:	F56E9C637F537FAF4DC0F7925DC8BC68
SHA1:	48814D037DD669673A1A90A7E7FB847DBF0C8379
SHA-256:	92D5487CF0844ADBAD7D71CF3302E5388AE6793691DB631181923599F5B16763
SHA-512:	5CF0D6F099B51F123033B31D0575F2876FC841A47F1E767E6A312C41BD07A0BB1A3F05F08B30CD68988ACE5D7BD3780A1421B179D9AE9721D739B048073F1510
Malicious:	false
Reputation:	low
Preview:	/tmp/oiutpipVmw.elf.

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.231366606774815
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	oiutpipVmw.elf
File size:	121'664 bytes
MD5:	6c513d80c41ed1c9889482fe0a1655c3
SHA1:	5983cc7c92e61b149164332f1b505320432ce8d5
SHA256:	b4ec4ccfc14fd89585900f245bfc950016723ee4689c6c67073efb908aaf2d07
SHA512:	83ebd6b55d89cd9dc551f07de8349aef26aebad7c621d6cb487d82c3c415e30ae7b984ba4d83580d20503c9ecec5c210063a68d79518946cf7ec8f4a09388e2a
SSDEEP:	1536:bauYsy/6Ok9ZKKt2+WacCYcKvnecyHehwIdmfW3/e0D1pkyz/:bLySF3tKac5Dv8ehwffWve0rkQ/
TLSH:	B2C36B76DC266F68C699D1B0B0B08F792F53A59042875FBA19B7C2B54083CCDF605BB8
File Content Preview:	.ELF.....................@.4...........4. ...(...............@...@...........................B...B.DI..............Q.td............................././"O.n........#.@........#.*@L`...o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	121224
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x16060	0x0	0x6	AX	32
.fini	PROGBITS	0x416140	0x16140	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x416164	0x16164	0x2b40	0x0	0x2	A	4
.ctors	PROGBITS	0x429000	0x19000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x42900c	0x1900c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x429020	0x19020	0x4910	0x0	0x3	WA	32
.got	PROGBITS	0x42d930	0x1d930	0x14	0x4	0x3	WA	4
.bss	NOBITS	0x42d944	0x1d944	0x46bc	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1d944	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x18ca4	0x18ca4	6.9208	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x19000	0x429000	0x429000	0x4944	0x9000	0.4118	0x6	RW	0x10000	.ctors .dtors .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 13:04:43.043947935 CET	36580	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:43.307490110 CET	43957	36580	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:43.307555914 CET	36580	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:43.307739973 CET	36580	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:43.570686102 CET	43957	36580	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:43.570812941 CET	43957	36580	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:43.570986032 CET	36580	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:43.833137035 CET	43957	36580	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:45.766587973 CET	36582	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:46.028093100 CET	43957	36582	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:46.028213978 CET	36582	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:46.028213978 CET	36582	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:46.290291071 CET	43957	36582	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:46.290313005 CET	43957	36582	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:46.290574074 CET	36582	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:46.552500963 CET	43957	36582	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:54.401652098 CET	36584	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:54.659616947 CET	43957	36584	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:54.659667969 CET	36584	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:54.659722090 CET	36584	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:54.917818069 CET	43957	36584	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:54.917865992 CET	43957	36584	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:54.917933941 CET	36584	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:55.176043034 CET	43957	36584	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:56.112734079 CET	36586	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:56.374427080 CET	43957	36586	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:56.374485016 CET	36586	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:56.374547005 CET	36586	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:56.636409998 CET	43957	36586	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:56.636544943 CET	43957	36586	103.173.178.208	192.168.2.14
Mar 29, 2024 13:04:56.636610031 CET	36586	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:04:56.898205996 CET	43957	36586	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:04.830626011 CET	36588	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:05.095837116 CET	43957	36588	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:05.095961094 CET	36588	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:05.096025944 CET	36588	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:05.361253977 CET	43957	36588	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:05.361284018 CET	43957	36588	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:05.361464977 CET	36588	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:05.626627922 CET	43957	36588	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:08.469719887 CET	36590	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:08.728369951 CET	43957	36590	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:08.728516102 CET	36590	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:08.728585005 CET	36590	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:08.987195015 CET	43957	36590	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:08.987211943 CET	43957	36590	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:14.096906900 CET	36592	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:14.354815006 CET	43957	36592	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:14.354917049 CET	36592	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:14.354960918 CET	36592	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:14.616527081 CET	43957	36592	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:14.616605043 CET	43957	36592	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:14.616704941 CET	36592	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:14.874891043 CET	43957	36592	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:16.729023933 CET	36594	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:16.986980915 CET	43957	36594	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:16.987088919 CET	36594	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:16.987132072 CET	36594	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:17.245094061 CET	43957	36594	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:17.245129108 CET	43957	36594	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:17.245275974 CET	36594	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:17.503209114 CET	43957	36594	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:24.357333899 CET	36596	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:24.619004965 CET	43957	36596	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:24.619088888 CET	36596	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:24.619168043 CET	36596	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:24.880847931 CET	43957	36596	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:24.880909920 CET	43957	36596	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:24.881032944 CET	36596	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:25.142509937 CET	43957	36596	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:28.992057085 CET	36598	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:29.253966093 CET	43957	36598	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:29.254069090 CET	36598	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:29.254111052 CET	36598	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:29.515857935 CET	43957	36598	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:29.515894890 CET	43957	36598	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:29.515973091 CET	36598	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:29.777556896 CET	43957	36598	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:30.689371109 CET	36600	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:30.954721928 CET	43957	36600	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:30.954797029 CET	36600	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:30.954824924 CET	36600	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:31.219907045 CET	43957	36600	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:31.219933033 CET	43957	36600	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:31.220035076 CET	36600	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:31.485141993 CET	43957	36600	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:33.393675089 CET	36602	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:33.660367012 CET	43957	36602	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:33.660499096 CET	36602	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:33.660536051 CET	36602	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:33.925715923 CET	43957	36602	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:33.925729036 CET	43957	36602	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:33.925848961 CET	36602	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:34.191042900 CET	43957	36602	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:39.035674095 CET	36604	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:39.300776958 CET	43957	36604	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:39.300960064 CET	36604	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:39.300960064 CET	36604	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:39.566098928 CET	43957	36604	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:39.566159964 CET	43957	36604	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:39.566392899 CET	36604	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:39.831516027 CET	43957	36604	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:41.874578953 CET	36606	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:42.136137009 CET	43957	36606	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:42.136244059 CET	36606	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:42.136279106 CET	36606	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:42.397752047 CET	43957	36606	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:42.397936106 CET	43957	36606	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:42.398036003 CET	36606	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:42.659495115 CET	43957	36606	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:47.571708918 CET	36608	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:47.833343983 CET	43957	36608	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:47.833445072 CET	36608	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:47.833555937 CET	36608	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:48.094907999 CET	43957	36608	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:48.094923973 CET	43957	36608	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:48.095067024 CET	36608	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:48.356540918 CET	43957	36608	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:58.204608917 CET	36610	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:58.469841003 CET	43957	36610	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:58.469988108 CET	36610	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:58.470010996 CET	36610	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:58.735078096 CET	43957	36610	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:58.735232115 CET	43957	36610	103.173.178.208	192.168.2.14
Mar 29, 2024 13:05:58.735332966 CET	36610	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:05:59.000438929 CET	43957	36610	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:04.929435015 CET	36612	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:05.187582016 CET	43957	36612	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:05.187688112 CET	36612	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:05.187716007 CET	36612	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:05.445682049 CET	43957	36612	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:05.445724964 CET	43957	36612	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:05.445818901 CET	36612	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:05.704055071 CET	43957	36612	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:07.555306911 CET	36614	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:07.817012072 CET	43957	36614	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:07.817123890 CET	36614	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:07.817224979 CET	36614	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:08.078727961 CET	43957	36614	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:08.078746080 CET	43957	36614	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:12.187603951 CET	36616	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:12.445859909 CET	43957	36616	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:12.445955992 CET	36616	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:12.445983887 CET	36616	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:12.704538107 CET	43957	36616	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:12.704555988 CET	43957	36616	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:12.704648972 CET	36616	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:12.962666035 CET	43957	36616	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:22.899367094 CET	36618	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:23.161108971 CET	43957	36618	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:23.161245108 CET	36618	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:23.161278963 CET	36618	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:23.423156023 CET	43957	36618	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:23.423187017 CET	43957	36618	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:23.423290014 CET	36618	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:23.685031891 CET	43957	36618	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:33.535612106 CET	36620	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:33.797185898 CET	43957	36620	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:33.797260046 CET	36620	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:33.797300100 CET	36620	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:34.059416056 CET	43957	36620	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:34.059453011 CET	43957	36620	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:34.059546947 CET	36620	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:34.321264029 CET	43957	36620	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:38.168978930 CET	36622	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:38.430728912 CET	43957	36622	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:38.430819988 CET	36622	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:38.430847883 CET	36622	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:38.692611933 CET	43957	36622	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:38.692751884 CET	43957	36622	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:38.692851067 CET	36622	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:38.954442978 CET	43957	36622	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:45.943064928 CET	36624	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:46.201270103 CET	43957	36624	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:46.201396942 CET	36624	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:46.201443911 CET	36624	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:46.459445953 CET	43957	36624	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:46.459470034 CET	43957	36624	103.173.178.208	192.168.2.14
Mar 29, 2024 13:06:46.459604025 CET	36624	43957	192.168.2.14	103.173.178.208
Mar 29, 2024 13:06:46.721836090 CET	43957	36624	103.173.178.208	192.168.2.14

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 13:04:42.932657957 CET	34378	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:04:43.043525934 CET	53	34378	8.8.8.8	192.168.2.14
Mar 29, 2024 13:04:45.571419001 CET	38939	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:04:45.766369104 CET	53	38939	8.8.8.8	192.168.2.14
Mar 29, 2024 13:04:54.290386915 CET	57596	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:04:54.401552916 CET	53	57596	8.8.8.8	192.168.2.14
Mar 29, 2024 13:04:55.918051004 CET	37660	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:04:56.112624884 CET	53	37660	8.8.8.8	192.168.2.14
Mar 29, 2024 13:05:04.636552095 CET	39725	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:05:04.830416918 CET	53	39725	8.8.8.8	192.168.2.14
Mar 29, 2024 13:05:08.361597061 CET	46820	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:05:08.469559908 CET	53	46820	8.8.8.8	192.168.2.14
Mar 29, 2024 13:05:13.987448931 CET	53341	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:05:14.096709967 CET	53	53341	8.8.8.8	192.168.2.14
Mar 29, 2024 13:05:16.616836071 CET	60518	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:05:16.728883028 CET	53	60518	8.8.8.8	192.168.2.14
Mar 29, 2024 13:05:24.245326042 CET	47877	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:05:24.357141972 CET	53	47877	8.8.8.8	192.168.2.14
Mar 29, 2024 13:05:28.881115913 CET	56852	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:05:28.991906881 CET	53	56852	8.8.8.8	192.168.2.14
Mar 29, 2024 13:05:30.516117096 CET	48199	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:05:30.689244032 CET	53	48199	8.8.8.8	192.168.2.14
Mar 29, 2024 13:05:33.220138073 CET	49713	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:05:33.393496990 CET	53	49713	8.8.8.8	192.168.2.14
Mar 29, 2024 13:05:38.925854921 CET	51635	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:05:39.035527945 CET	53	51635	8.8.8.8	192.168.2.14
Mar 29, 2024 13:05:41.566479921 CET	42751	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:05:41.874438047 CET	53	42751	8.8.8.8	192.168.2.14
Mar 29, 2024 13:05:47.398081064 CET	48642	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:05:47.571422100 CET	53	48642	8.8.8.8	192.168.2.14
Mar 29, 2024 13:05:58.094882965 CET	44779	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:05:58.204463959 CET	53	44779	8.8.8.8	192.168.2.14
Mar 29, 2024 13:06:04.735291958 CET	33755	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:06:04.929301977 CET	53	33755	8.8.8.8	192.168.2.14
Mar 29, 2024 13:06:07.446042061 CET	55248	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:06:07.555080891 CET	53	55248	8.8.8.8	192.168.2.14
Mar 29, 2024 13:06:12.078874111 CET	42175	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:06:12.187484026 CET	53	42175	8.8.8.8	192.168.2.14
Mar 29, 2024 13:06:22.704452991 CET	40553	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:06:22.899229050 CET	53	40553	8.8.8.8	192.168.2.14
Mar 29, 2024 13:06:33.423094988 CET	45991	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:06:33.535482883 CET	53	45991	8.8.8.8	192.168.2.14
Mar 29, 2024 13:06:38.059678078 CET	41949	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:06:38.168791056 CET	53	41949	8.8.8.8	192.168.2.14
Mar 29, 2024 13:06:45.692775011 CET	49044	53	192.168.2.14	8.8.8.8
Mar 29, 2024 13:06:45.942893982 CET	53	49044	8.8.8.8	192.168.2.14

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report oiutpipVmw.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00zhcy (deleted)

/tmp/qemu-open.0NGGAA (deleted)

/tmp/qemu-open.0OV3pz (deleted)

/tmp/qemu-open.0T5oHA (deleted)

/tmp/qemu-open.0VJ7Hz (deleted)

/tmp/qemu-open.0WR1Oz (deleted)

/tmp/qemu-open.0Xqoiy (deleted)

/tmp/qemu-open.0Y1m6w (deleted)

/tmp/qemu-open.0eQsiz (deleted)

/tmp/qemu-open.0lSEBy (deleted)

/tmp/qemu-open.0rLsSz (deleted)

/tmp/qemu-open.0t2xlw (deleted)

/tmp/qemu-open.11D3Jx (deleted)

/tmp/qemu-open.14HI5z (deleted)

/tmp/qemu-open.19b6Px (deleted)

/tmp/qemu-open.1A4FrA (deleted)

/tmp/qemu-open.1C3qAx (deleted)

/tmp/qemu-open.1CIZHw (deleted)

/tmp/qemu-open.1Fk6wz (deleted)

/tmp/qemu-open.1H40Nx (deleted)

/tmp/qemu-open.1OnSLz (deleted)

/tmp/qemu-open.1UbTQA (deleted)

/tmp/qemu-open.1VO3cx (deleted)

/tmp/qemu-open.1ebSex (deleted)

/tmp/qemu-open.1ekDBx (deleted)

/tmp/qemu-open.1hqu3y (deleted)

/tmp/qemu-open.1lBPVw (deleted)

/tmp/qemu-open.1sxWGx (deleted)

/tmp/qemu-open.1tP47x (deleted)

/tmp/qemu-open.20ouMx (deleted)

Linux Analysis Report
oiutpipVmw.elf

Start time (UTC):	12:04:42
Start date (UTC):	29/03/2024
Path:	/tmp/oiutpipVmw.elf
Arguments:	/tmp/oiutpipVmw.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre