Source: YLjhvMJyOO.elf |
ReversingLabs: Detection: 42% |
Source: |
DNS query: kovey.mezo-api.xyz |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.= f66a1PV!E(j~5uG= fOOPV!a1EA;@@x |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.= fvK66a1PV!E(%:5;= fMOOPV!a1EAP@@x |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.= f66a1PV!E(j5`V= fOOPV!a1EAc@@x |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.= f66a1PV!E(:#5I= fOOPV!a1EAe@@x |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.= fk66a1PV!E(:,5 = fJJJPV!a1E<=@@h |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.= fG/66a1PV!E(`mj5$= f1OOPV!a1EA@@t |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.= f66a1PV!E(x:5;= fOOPV!a1EA@@t |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.= ftc66a1PV!E(:5P= feOOPV!a1EA@@t |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.= f66a1PV!E(je5!{= fNOOPV!a1EA*@@t |
Source: unknown |
DNS traffic detected: query: kovey.mezo-api.xyz.= fR66a1PV!E(|:1I5OL= fJJPV!a1E<Z@@5L |
Source: global traffic |
TCP traffic: 192.168.2.15:39686 -> 45.131.111.219:33966 |
Source: unknown |
DNS traffic detected: queries for: kovey.mezo-api.xyz |
Source: YLjhvMJyOO.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5534.1.00007fad58017000.00007fad58026000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: YLjhvMJyOO.elf PID: 5534, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: ELF static info symbol of initial sample |
.symtab present: no |
Source: YLjhvMJyOO.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5534.1.00007fad58017000.00007fad58026000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: YLjhvMJyOO.elf PID: 5534, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: classification engine |
Classification label: mal84.troj.evad.linELF@0/1@11/0 |
Source: /tmp/YLjhvMJyOO.elf (PID: 5536) |
File: /tmp/YLjhvMJyOO.elf |
Jump to behavior |
Source: /tmp/YLjhvMJyOO.elf (PID: 5534) |
Queries kernel information via 'uname': |
Jump to behavior |
Source: YLjhvMJyOO.elf, 5534.1.00007ffe35983000.00007ffe359a4000.rw-.sdmp |
Binary or memory string: /tmp/qemu-open.nrn8tC |
Source: YLjhvMJyOO.elf, 5534.1.00007ffe35983000.00007ffe359a4000.rw-.sdmp |
Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/YLjhvMJyOO.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/YLjhvMJyOO.elf |
Source: YLjhvMJyOO.elf, 5534.1.000055bd24f72000.000055bd250a0000.rw-.sdmp |
Binary or memory string: U!/etc/qemu-binfmt/arm |
Source: YLjhvMJyOO.elf, 5534.1.00007ffe35983000.00007ffe359a4000.rw-.sdmp |
Binary or memory string: U/tmp/qemu-open.nrn8tC: |
Source: YLjhvMJyOO.elf, 5534.1.000055bd24f72000.000055bd250a0000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/arm |
Source: YLjhvMJyOO.elf, 5534.1.00007ffe35983000.00007ffe359a4000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-arm |
Source: Yara match |
File source: YLjhvMJyOO.elf, type: SAMPLE |
Source: Yara match |
File source: 5534.1.00007fad58017000.00007fad58026000.r-x.sdmp, type: MEMORY |
Source: Yara match |
File source: YLjhvMJyOO.elf, type: SAMPLE |
Source: Yara match |
File source: 5534.1.00007fad58017000.00007fad58026000.r-x.sdmp, type: MEMORY |