Source: 6pZSqZEAa2.elf |
ReversingLabs: Detection: 39% |
Source: |
DNS query: kovey.mezo-api.xyz |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.: f66a1PV!E(_j5u!}: fOOPV!a1EA |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.: fJ66a1PV!E(b9L5K}: fKOOPV!a1EA |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.: f66a1PV!E(C:j5}: fOOPV!a1EA |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.: fz66a1PV!E(j5kmQ}: f{OOPV!a1EA |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.: f-66a1PV!E(Oa:^54}: fNNPV!a1E@ |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.; fi66a1PV!E(e95o%; fOOPV!a1EA.@@.aV5-%koveymezo-apixyzm; fU[66a1PV!E(:.5.%; fc]OOPV!a1EA@@bH5-%.kovey.mezo-api.xyz.; f66a1PV!E(z95%; fOOPV!a1EA.@@.=5-I%koveymezo-apixyzm; f66a1PV!E(89.5 |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.; fU[66a1PV!E(:5V%; fc]OOPV!a1EA.@@.H5-%koveymezo-apixyzm; f66a1PV!E(z9.5.%; fO |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.; f66a1PV!E(z95%; fOOPV!a1EA.@@.=5-I%koveymezo-apixyzm; f66a1PV!E(89.5 |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.; f66a1PV!E(895D%; f#OOPV!a1EA.@@.2x5-%koveymezo-apixyzm; f(66a1PV!E(mj.5.%; f)NNPV!a1E@@@b15,U\mezo-koveymezo-apixyz; f6 |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.; f(66a1PV!E(mj5x%; f)NNPV!a1E@.@@.15,U\mezo-koveymezo-apixyz; f66a1PV!E(g:.5 |
Source: global traffic |
TCP traffic: 192.168.2.15:39686 -> 45.131.111.219:33966 |
Source: unknown |
DNS traffic detected: queries for: kovey.mezo-api.xyz |
Source: 6pZSqZEAa2.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5545.1.00007efea8001000.00007efea8011000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: 6pZSqZEAa2.elf PID: 5545, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: ELF static info symbol of initial sample |
.symtab present: no |
Source: 6pZSqZEAa2.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5545.1.00007efea8001000.00007efea8011000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: 6pZSqZEAa2.elf PID: 5545, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: classification engine |
Classification label: mal84.troj.evad.linELF@0/1@11/0 |
Source: /tmp/6pZSqZEAa2.elf (PID: 5547) |
File: /tmp/6pZSqZEAa2.elf |
Jump to behavior |
Source: /tmp/6pZSqZEAa2.elf (PID: 5545) |
Queries kernel information via 'uname': |
Jump to behavior |
Source: 6pZSqZEAa2.elf, 5545.1.00007fff22786000.00007fff227a7000.rw-.sdmp |
Binary or memory string: /qemu-open.XXXXX |
Source: 6pZSqZEAa2.elf, 5545.1.00007fff22786000.00007fff227a7000.rw-.sdmp |
Binary or memory string: OV/tmp/qemu-open.5NmYtw\t |
Source: 6pZSqZEAa2.elf, 5545.1.00007fff22786000.00007fff227a7000.rw-.sdmp |
Binary or memory string: ~/qemu-open.XXXXX |
Source: 6pZSqZEAa2.elf, 5545.1.0000564fe8932000.0000564fe89b7000.rw-.sdmp |
Binary or memory string: OV!/etc/qemu-binfmt/m68k |
Source: 6pZSqZEAa2.elf, 5545.1.00007fff22786000.00007fff227a7000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-m68k |
Source: 6pZSqZEAa2.elf, 5545.1.00007fff22786000.00007fff227a7000.rw-.sdmp |
Binary or memory string: /tmp/qemu-open.5NmYtw |
Source: 6pZSqZEAa2.elf, 5545.1.0000564fe8932000.0000564fe89b7000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/m68k |
Source: 6pZSqZEAa2.elf, 5545.1.00007fff22786000.00007fff227a7000.rw-.sdmp |
Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/6pZSqZEAa2.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/6pZSqZEAa2.elf |
Source: Yara match |
File source: 6pZSqZEAa2.elf, type: SAMPLE |
Source: Yara match |
File source: 5545.1.00007efea8001000.00007efea8011000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: 6pZSqZEAa2.elf, type: SAMPLE |
Source: Yara match |
File source: 5545.1.00007efea8001000.00007efea8011000.r-x.sdmp, type: MEMORY |