Edit tour

Linux Analysis Report
jPa5GP7YWR.elf

Overview

General Information

Sample name:	jPa5GP7YWR.elf renamed because original name is a hash value
Original sample name:	a39aacba3ea473a91eb962c37e95ad46.elf
Analysis ID:	1427795
MD5:	a39aacba3ea473a91eb962c37e95ad46
SHA1:	953b0054dec3899c2b1afa7ffbe3bcbeb83d95b1
SHA256:	46b1137f3b9eca9aebb1d51377384c03727c2f0771037a125bcff5b4488d2c4d
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427795
Start date and time:	2024-04-18 07:47:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	jPa5GP7YWR.elf renamed because original name is a hash value
Original Sample Name:	a39aacba3ea473a91eb962c37e95ad46.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/1025@105/0

Runtime Messages

Command:	/tmp/jPa5GP7YWR.elf
PID:	5450
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

jPa5GP7YWR.elf (PID: 5450, Parent: 5372, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/jPa5GP7YWR.elf

jPa5GP7YWR.elf New Fork (PID: 5452, Parent: 5450)

jPa5GP7YWR.elf New Fork (PID: 5454, Parent: 5452)

dash New Fork (PID: 5457, Parent: 3590)

rm (PID: 5457, Parent: 3590, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.cuByqNa7W8 /tmp/tmp.irMllgjoJ1 /tmp/tmp.3m9jzPxcFS

dash New Fork (PID: 5458, Parent: 3590)

rm (PID: 5458, Parent: 3590, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.cuByqNa7W8 /tmp/tmp.irMllgjoJ1 /tmp/tmp.3m9jzPxcFS

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
jPa5GP7YWR.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
jPa5GP7YWR.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a7a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a808:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a81c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a86c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a90c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5450.1.00007f2fdc017000.00007f2fdc034000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5450.1.00007f2fdc017000.00007f2fdc034000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a7a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a808:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a81c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a86c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a8f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a90c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: jPa5GP7YWR.elf PID: 5450	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: jPa5GP7YWR.elf PID: 5450	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12e3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12e53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12e67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12e7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12e8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ea3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12eb7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ecb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12edf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ef3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fa7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fbb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fcf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: jPa5GP7YWR.elf	Virustotal: Detection: 43%			Perma Link
Source: jPa5GP7YWR.elf	ReversingLabs: Detection: 55%

Source: global traffic	TCP traffic: 192.168.2.13:58866 -> 54.171.230.55:443
Source: global traffic	TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26

Source: unknown	Network traffic detected: HTTP traffic on port 58866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48202 -> 443

Source: jPa5GP7YWR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5450.1.00007f2fdc017000.00007f2fdc034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: jPa5GP7YWR.elf PID: 5450, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/3640/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/3639/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/3755/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/3636/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/3637/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/5396/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/jPa5GP7YWR.elf (PID: 5454)	File opened: /proc/259/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 5457)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.cuByqNa7W8 /tmp/tmp.irMllgjoJ1 /tmp/tmp.3m9jzPxcFS			Jump to behavior
Source: /usr/bin/dash (PID: 5458)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.cuByqNa7W8 /tmp/tmp.irMllgjoJ1 /tmp/tmp.3m9jzPxcFS			Jump to behavior

Source: jPa5GP7YWR.elf, 5450.1.00007fff46a95000.00007fff46ab6000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/jPa5GP7YWR.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jPa5GP7YWR.elf
Source: jPa5GP7YWR.elf, 5450.1.00005576dff33000.00005576e0061000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: jPa5GP7YWR.elf, 5450.1.00007fff46a95000.00007fff46ab6000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: jPa5GP7YWR.elf, 5450.1.00005576dff33000.00005576e0061000.rw-.sdmp	Binary or memory string: vU!/etc/qemu-binfmt/arm

Source: Yara match	File source: jPa5GP7YWR.elf, type: SAMPLE
Source: Yara match	File source: 5450.1.00007f2fdc017000.00007f2fdc034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jPa5GP7YWR.elf PID: 5450, type: MEMORYSTR

Source: jPa5GP7YWR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5450.1.00007f2fdc017000.00007f2fdc034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: jPa5GP7YWR.elf PID: 5450, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
jPa5GP7YWR.elf	44%	Virustotal		Browse
jPa5GP7YWR.elf	55%	ReversingLabs	Linux.Trojan.Mirai
jPa5GP7YWR.elf	100%	Avira	EXP/ELF.Mirai.Z.A

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States		16509	AMAZON-02US	false
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.171.230.55	KxTpfpJzPK.elf	Get hash	malicious	Mirai	Browse
	MCKV8ZxDFs.elf	Get hash	malicious	Mirai	Browse
	n7h2Ze4ezf.elf	Get hash	malicious	Mirai	Browse
	IRtucjku4f.elf	Get hash	malicious	Mirai	Browse
	0nfIIyGr0B.elf	Get hash	malicious	Mirai	Browse
	IOBZiJI5W8.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	pKz76hY1YS.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	1b0uLqaErv.elf	Get hash	malicious	Mirai	Browse
	DYQCCl3BLP.elf	Get hash	malicious	Gafgyt	Browse
185.125.190.26	arm.elf	Get hash	malicious	Unknown	Browse
	AkV7DALWTe.elf	Get hash	malicious	Mirai	Browse
	n3l6rOHrCy.elf	Get hash	malicious	Mirai	Browse
	f0OnF0zQl1.elf	Get hash	malicious	Mirai	Browse
	MP364bXXBM.elf	Get hash	malicious	Mirai	Browse
	MCKV8ZxDFs.elf	Get hash	malicious	Mirai	Browse
	5kPAYNJulv.elf	Get hash	malicious	Mirai, Gafgyt	Browse
	yRXn4O3AgO.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	SecuriteInfo.com.Linux.Kaiji.16.13149.10467.elf	Get hash	malicious	Chaos	Browse
	SecuriteInfo.com.ELF.Agent-BSR.23757.4302.elf	Get hash	malicious	Chaos	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	F7tyGvYaTl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	skid.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	dQV40zAvGT.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	YgpPblX7Ct.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	epLN92K8RM.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	LJTtnwewUQ.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	NvmCe2XrqN.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	AkV7DALWTe.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
AMAZON-02US	https://site24x7.com	Get hash	malicious	Unknown	Browse	108.139.15.104
	rc21AW1MZD.elf	Get hash	malicious	Mirai	Browse	108.137.8.194
	QFR4Qsnm6y.elf	Get hash	malicious	Mirai	Browse	54.122.72.117
	jLntRRok3B.elf	Get hash	malicious	Mirai	Browse	71.152.60.96
	hYN45tzxwl.elf	Get hash	malicious	Mirai	Browse	99.79.220.122
	https://ortelia.com/download-ortelia-curator/	Get hash	malicious	Havoc	Browse	3.161.136.116
	https://staticcontent.cricut.com/a/software/win32-native/CricutDesignSpace-Install-v8.24.60.exe?Expires=1713405575&Signature=2WQC5y2N-HrvfbwCMSuJ2AepXckGrbtsXEdZfqTTcjsjIKwZ48XDUv2do7SKzLJZWbg3r4Qt-YcgcCEnlL4U8K~rZtlF1Sign5lBZQZ-qWq6nwQhfqOgI~2AzpwFlKa5Z0ZnNvk2QuBEm0NcoBXnTJbNIFUhXCXRo~PkpHmlp-Y848hU1zn-5iSX5OQNww3WIYg3K44DIbQxYvphEE2jdUyUTtrCWjluOBokHPH6E~RD6qKswmjzuLGyXmsEyq2FGQou~BS4AMtEkggT4nGQgr237R7z6oZi4w27o~lPIOGwMp1OZKYPzPyFXWTVDDIRSWrWSGeDI6ePgo8Ifcsj4g__&Key-Pair-Id=K2W1AJ47IQWIOI	Get hash	malicious	Unknown	Browse	13.32.151.60
	http://ranchpools.com	Get hash	malicious	Unknown	Browse	3.162.125.63
	http://t.cm.morganstanley.com/r/?id=h1b92d14%2C134cc33c%2C1356be32&p1=www.saiengroup.com%2Fteaz%2F648c482b60b3906833c9304bab170add%2FJBVNhz%2FYW15LmNoZW5AZG91YmxlbGluZS5jb20=	Get hash	malicious	HTMLPhisher	Browse	44.236.226.13

Process:	/tmp/jPa5GP7YWR.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:Tgy173:Tgyp3
MD5:	228431734C87B99B8966B5940F4DE1F2
SHA1:	884B04E9419A373BBAACDEC5EDB832EEE96B1249
SHA-256:	67CA81CC47B818BFB1F55C002B80B32006C920C9087794B32808EA66692A1066
SHA-512:	ED5E725DCA5FF94BA033622C4DAD9CFCD18C0D6EBA8D8A6B67542C1D526B8E03F371CA867D2198C82E37BFA3C6BE4221FDD7FC66B2489680D31832ACCDFFA8D8
Malicious:	false
Reputation:	low
Preview:	/tmp/jPa5GP7YWR.elf.

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.583371419946984
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	jPa5GP7YWR.elf
File size:	137'516 bytes
MD5:	a39aacba3ea473a91eb962c37e95ad46
SHA1:	953b0054dec3899c2b1afa7ffbe3bcbeb83d95b1
SHA256:	46b1137f3b9eca9aebb1d51377384c03727c2f0771037a125bcff5b4488d2c4d
SHA512:	e0d6960b14913d2a094da25880f2aa1082e5d4d400d464ba1a8d8f3313020f8af7d57bc9291ca186c842b0d01c150a125ef76092c61fbcb5d875c4845c54eb2e
SSDEEP:	3072:rHZo3hdkQCa90fnveB9FnVh0wX9ejr1rnpke:scQCaWve3SwXEtnue
TLSH:	D7D31A45F8808F13C6D652BBFB5D428D372A17E8D2EA72039D206F61378B95B0E3B546
File Content Preview:	.ELF...a..........(.........4...t.......4. ...(......................................................G..............Q.td..................................-...L."...si..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	137076
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x1a604	0x0	0x6	AX	16
.fini	PROGBITS	0x226b4	0x1a6b4	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x226c8	0x1a6c8	0x28c8	0x0	0x2	A	4
.ctors	PROGBITS	0x2d004	0x1d004	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x2d010	0x1d010	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2d020	0x1d020	0x46f4	0x0	0x3	WA	32
.bss	NOBITS	0x31714	0x21714	0x49d0	0x0	0x3	WA	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x21714	0x10	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x21724	0x4e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1cf90	0x1cf90	6.0771	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x1d004	0x2d004	0x2d004	0x4710	0x90e0	0.3995	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 07:47:54.680078030 CEST	58866	443	192.168.2.13	54.171.230.55
Apr 18, 2024 07:48:04.663559914 CEST	48202	443	192.168.2.13	185.125.190.26
Apr 18, 2024 07:48:36.407236099 CEST	48202	443	192.168.2.13	185.125.190.26

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report jPa5GP7YWR.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00DtfD (deleted)

/tmp/qemu-open.00Q5AD (deleted)

/tmp/qemu-open.01ZZ5A (deleted)

/tmp/qemu-open.028m7C (deleted)

/tmp/qemu-open.067glD (deleted)

/tmp/qemu-open.0983jA (deleted)

/tmp/qemu-open.0SL9aD (deleted)

/tmp/qemu-open.0UTTwC (deleted)

/tmp/qemu-open.0V58Xz (deleted)

/tmp/qemu-open.0dUB1z (deleted)

/tmp/qemu-open.0fYCbD (deleted)

/tmp/qemu-open.0gywyz (deleted)

/tmp/qemu-open.0hnuxC (deleted)

/tmp/qemu-open.0ms4cD (deleted)

/tmp/qemu-open.0uDzRC (deleted)

/tmp/qemu-open.0xaWpD (deleted)

/tmp/qemu-open.131CLD (deleted)

/tmp/qemu-open.14hcQB (deleted)

/tmp/qemu-open.16KGjA (deleted)

/tmp/qemu-open.16xIhC (deleted)

/tmp/qemu-open.18rx8z (deleted)

/tmp/qemu-open.1DuKpB (deleted)

/tmp/qemu-open.1GJXoA (deleted)

/tmp/qemu-open.1JYPpz (deleted)

/tmp/qemu-open.1N6aBB (deleted)

/tmp/qemu-open.1Q82rA (deleted)

/tmp/qemu-open.1RJW2C (deleted)

/tmp/qemu-open.1SGjlB (deleted)

/tmp/qemu-open.1SIGPA (deleted)

/tmp/qemu-open.1ooGVz (deleted)

Linux Analysis Report
jPa5GP7YWR.elf

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 07:47:55.866189957 CEST	38886	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:47:56.067214012 CEST	53	38886	8.8.8.8	192.168.2.13
Apr 18, 2024 07:47:56.067518950 CEST	41646	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:47:56.270195007 CEST	53	41646	8.8.8.8	192.168.2.13
Apr 18, 2024 07:47:56.270315886 CEST	56339	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:47:56.453778028 CEST	53	56339	8.8.8.8	192.168.2.13
Apr 18, 2024 07:47:56.453876972 CEST	55484	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:47:56.636027098 CEST	53	55484	8.8.8.8	192.168.2.13
Apr 18, 2024 07:47:56.636183023 CEST	46927	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:47:56.819175005 CEST	53	46927	8.8.8.8	192.168.2.13
Apr 18, 2024 07:47:58.819853067 CEST	43028	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:47:59.003087044 CEST	53	43028	8.8.8.8	192.168.2.13
Apr 18, 2024 07:47:59.003231049 CEST	54744	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:47:59.185102940 CEST	53	54744	8.8.8.8	192.168.2.13
Apr 18, 2024 07:47:59.185208082 CEST	33833	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:47:59.369091988 CEST	53	33833	8.8.8.8	192.168.2.13
Apr 18, 2024 07:47:59.369182110 CEST	41521	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:47:59.552313089 CEST	53	41521	8.8.8.8	192.168.2.13
Apr 18, 2024 07:47:59.552440882 CEST	58234	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:47:59.734355927 CEST	53	58234	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:01.734625101 CEST	49319	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:01.917160988 CEST	53	49319	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:01.917303085 CEST	39008	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:02.099729061 CEST	53	39008	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:02.099874020 CEST	46106	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:02.282975912 CEST	53	46106	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:02.283138990 CEST	59377	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:02.467012882 CEST	53	59377	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:02.467210054 CEST	39722	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:02.649208069 CEST	53	39722	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:04.649523020 CEST	38991	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:04.832324028 CEST	53	38991	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:04.832495928 CEST	42380	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:05.013828993 CEST	53	42380	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:05.014328957 CEST	36526	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:05.215389013 CEST	53	36526	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:05.215495110 CEST	35226	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:05.416016102 CEST	53	35226	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:05.416158915 CEST	54808	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:05.598989010 CEST	53	54808	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:13.599294901 CEST	50448	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:13.795511007 CEST	53	50448	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:13.795696020 CEST	53857	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:13.990761995 CEST	53	53857	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:13.990864038 CEST	33636	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:14.191821098 CEST	53	33636	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:14.191947937 CEST	49696	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:14.374759912 CEST	53	49696	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:14.374907017 CEST	48649	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:14.575778961 CEST	53	48649	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:23.576080084 CEST	51317	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:23.790308952 CEST	53	51317	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:23.790613890 CEST	50716	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:24.249576092 CEST	53	50716	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:24.249892950 CEST	50796	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:24.432455063 CEST	53	50796	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:24.432636023 CEST	50970	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:24.656436920 CEST	53	50970	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:24.656888008 CEST	32833	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:24.839958906 CEST	53	32833	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:25.840600967 CEST	39082	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:26.048389912 CEST	53	39082	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:26.048780918 CEST	48516	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:26.300496101 CEST	53	48516	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:26.300690889 CEST	45392	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:26.761689901 CEST	53	45392	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:26.762020111 CEST	45331	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:27.344981909 CEST	53	45331	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:27.345253944 CEST	38153	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:27.545939922 CEST	53	38153	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:29.546458006 CEST	58497	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:29.747375011 CEST	53	58497	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:29.747627974 CEST	55592	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:29.935161114 CEST	53	55592	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:29.935486078 CEST	49386	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:30.128400087 CEST	53	49386	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:30.128820896 CEST	57758	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:30.373084068 CEST	53	57758	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:30.373346090 CEST	51576	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:30.573978901 CEST	53	51576	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:37.574357033 CEST	51023	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:37.757819891 CEST	53	51023	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:37.758101940 CEST	49390	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:37.940932035 CEST	53	49390	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:37.941154957 CEST	39875	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:38.143398046 CEST	53	39875	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:38.143572092 CEST	51306	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:38.343329906 CEST	53	51306	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:38.343485117 CEST	39747	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:38.526794910 CEST	53	39747	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:45.527297974 CEST	40128	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:45.738944054 CEST	53	40128	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:45.739378929 CEST	46620	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:45.936166048 CEST	53	46620	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:45.936484098 CEST	35871	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:46.119091988 CEST	53	35871	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:46.119364977 CEST	57283	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:46.302123070 CEST	53	57283	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:46.302405119 CEST	35502	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:46.498958111 CEST	53	35502	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:48.499314070 CEST	52761	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:48.681670904 CEST	53	52761	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:48.681869984 CEST	55823	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:48.882580996 CEST	53	55823	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:48.882756948 CEST	48945	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:49.079730988 CEST	53	48945	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:49.080120087 CEST	47643	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:49.263777971 CEST	53	47643	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:49.263967991 CEST	56640	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:49.446552992 CEST	53	56640	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:54.446954966 CEST	39102	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:54.630482912 CEST	53	39102	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:54.631006002 CEST	42418	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:54.826828957 CEST	53	42418	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:54.827084064 CEST	57223	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:55.028543949 CEST	53	57223	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:55.028930902 CEST	42909	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:55.223870993 CEST	53	42909	8.8.8.8	192.168.2.13
Apr 18, 2024 07:48:55.224181890 CEST	48286	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:48:55.406174898 CEST	53	48286	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:03.406755924 CEST	52449	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:03.602349043 CEST	53	52449	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:03.602554083 CEST	54384	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:03.784439087 CEST	53	54384	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:03.784673929 CEST	50245	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:04.016663074 CEST	53	50245	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:04.016992092 CEST	59190	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:04.217916965 CEST	53	59190	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:04.218252897 CEST	42122	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:04.414139986 CEST	53	42122	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:11.414638042 CEST	50463	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:11.598897934 CEST	53	50463	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:11.599081993 CEST	45769	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:11.781284094 CEST	53	45769	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:11.781480074 CEST	33666	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:11.977274895 CEST	53	33666	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:11.977464914 CEST	38778	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:12.173640966 CEST	53	38778	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:12.173826933 CEST	51105	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:12.356774092 CEST	53	51105	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:14.357156038 CEST	53108	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:14.553096056 CEST	53	53108	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:14.553390026 CEST	34032	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:14.753760099 CEST	53	34032	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:14.753936052 CEST	40421	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:14.936819077 CEST	53	40421	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:14.936968088 CEST	37827	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:15.120945930 CEST	53	37827	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:15.121145010 CEST	38639	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:15.335187912 CEST	53	38639	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:20.335716009 CEST	60768	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:20.536322117 CEST	53	60768	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:20.536665916 CEST	38726	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:20.718719006 CEST	53	38726	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:20.719053984 CEST	33904	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:20.901930094 CEST	53	33904	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:20.902396917 CEST	57668	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:21.084151983 CEST	53	57668	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:21.084481001 CEST	40587	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:21.267697096 CEST	53	40587	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:29.268228054 CEST	48322	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:29.465821028 CEST	53	48322	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:29.466072083 CEST	56301	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:29.647911072 CEST	53	56301	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:29.648200989 CEST	37411	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:29.835372925 CEST	53	37411	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:29.835613012 CEST	59107	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:30.019813061 CEST	53	59107	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:30.020128012 CEST	50558	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:30.217500925 CEST	53	50558	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:36.218234062 CEST	58110	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:36.400614977 CEST	53	58110	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:36.401005983 CEST	34053	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:36.598428011 CEST	53	34053	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:36.598962069 CEST	44480	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:36.781079054 CEST	53	44480	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:36.781546116 CEST	56823	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:36.996052027 CEST	53	56823	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:36.996361971 CEST	40776	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:37.208884954 CEST	53	40776	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:47.209233046 CEST	48161	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:47.391980886 CEST	53	48161	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:47.392292976 CEST	53666	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:47.575593948 CEST	53	53666	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:47.575786114 CEST	56957	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:47.757975101 CEST	53	56957	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:47.758141041 CEST	60195	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:47.940505028 CEST	53	60195	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:47.940705061 CEST	55012	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:48.135606050 CEST	53	55012	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:49.136183977 CEST	36618	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:49.318197012 CEST	53	36618	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:49.318629980 CEST	51291	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:49.501609087 CEST	53	51291	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:49.501919985 CEST	52521	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:49.703882933 CEST	53	52521	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:49.704443932 CEST	43417	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:49.886938095 CEST	53	43417	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:49.887309074 CEST	33444	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:50.070571899 CEST	53	33444	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:56.071106911 CEST	47299	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:56.271775961 CEST	53	47299	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:56.272233963 CEST	34831	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:56.473992109 CEST	53	34831	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:56.474523067 CEST	32920	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:56.658356905 CEST	53	32920	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:56.658595085 CEST	34400	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:56.841804981 CEST	53	34400	8.8.8.8	192.168.2.13
Apr 18, 2024 07:49:56.842097044 CEST	48596	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:49:57.024713039 CEST	53	48596	8.8.8.8	192.168.2.13

Start time (UTC):	05:47:54
Start date (UTC):	18/04/2024
Path:	/tmp/jPa5GP7YWR.elf
Arguments:	/tmp/jPa5GP7YWR.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	05:47:56
Start date (UTC):	18/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre