Edit tour

Linux Analysis Report
va2ZcYaLHe.elf

Overview

General Information

Sample name:	va2ZcYaLHe.elf renamed because original name is a hash value
Original sample name:	b925490f03913c77566629e3e2393e7e.elf
Analysis ID:	1427796
MD5:	b925490f03913c77566629e3e2393e7e
SHA1:	aa41eb009b44b37394a48d285ce4073b44a4f1b0
SHA256:	9e8f0f96ec93cb215ed1a180047889840c9170eba97b82db775e5566531ae0f2
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample tries to kill a process (SIGKILL)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427796
Start date and time:	2024-04-18 07:47:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	va2ZcYaLHe.elf renamed because original name is a hash value
Original Sample Name:	b925490f03913c77566629e3e2393e7e.elf
Detection:	MAL
Classification:	mal80.troj.linELF@0/1025@90/0

Runtime Messages

Command:	/tmp/va2ZcYaLHe.elf
PID:	5524
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

va2ZcYaLHe.elf (PID: 5524, Parent: 5440, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/va2ZcYaLHe.elf

va2ZcYaLHe.elf New Fork (PID: 5526, Parent: 5524)

va2ZcYaLHe.elf New Fork (PID: 5528, Parent: 5526)

dash New Fork (PID: 5530, Parent: 3672)

rm (PID: 5530, Parent: 3672, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.oQi6T9KGYr /tmp/tmp.C7IgMf5NvF /tmp/tmp.b6R03l7rwg

dash New Fork (PID: 5531, Parent: 3672)

rm (PID: 5531, Parent: 3672, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.oQi6T9KGYr /tmp/tmp.C7IgMf5NvF /tmp/tmp.b6R03l7rwg

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
va2ZcYaLHe.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
va2ZcYaLHe.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
va2ZcYaLHe.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1720c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1725c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1734c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5524.1.00007f8cb8017000.00007f8cb8031000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5524.1.00007f8cb8017000.00007f8cb8031000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1720c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1725c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1734c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: va2ZcYaLHe.elf PID: 5524	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: va2ZcYaLHe.elf PID: 5524	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11b15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ba1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bf1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ca5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: va2ZcYaLHe.elf	ReversingLabs: Detection: 60%
Source: va2ZcYaLHe.elf	Virustotal: Detection: 61%			Perma Link

Source: unknown	Network traffic detected: HTTP traffic on port 44524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44524

Source: va2ZcYaLHe.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5524.1.00007f8cb8017000.00007f8cb8031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: va2ZcYaLHe.elf PID: 5524, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/3768/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/3672/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/va2ZcYaLHe.elf (PID: 5528)	File opened: /proc/3440/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 5530)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.oQi6T9KGYr /tmp/tmp.C7IgMf5NvF /tmp/tmp.b6R03l7rwg			Jump to behavior
Source: /usr/bin/dash (PID: 5531)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.oQi6T9KGYr /tmp/tmp.C7IgMf5NvF /tmp/tmp.b6R03l7rwg			Jump to behavior

Source: va2ZcYaLHe.elf, 5524.1.000055ac05a15000.000055ac05b65000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: va2ZcYaLHe.elf, 5524.1.000055ac05a15000.000055ac05b65000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: va2ZcYaLHe.elf, 5524.1.00007ffef26ea000.00007ffef270b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: va2ZcYaLHe.elf, 5524.1.00007ffef26ea000.00007ffef270b000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/va2ZcYaLHe.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/va2ZcYaLHe.elf

Source: Yara match	File source: va2ZcYaLHe.elf, type: SAMPLE
Source: Yara match	File source: 5524.1.00007f8cb8017000.00007f8cb8031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: va2ZcYaLHe.elf PID: 5524, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
va2ZcYaLHe.elf	61%	ReversingLabs	Linux.Trojan.Mirai
va2ZcYaLHe.elf	61%	Virustotal		Browse
va2ZcYaLHe.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Source: va2ZcYaLHe.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5524.1.00007f8cb8017000.00007f8cb8031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: va2ZcYaLHe.elf PID: 5524, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.254.182.186	SecuriteInfo.com.ELF.Kaiji-P.1244.10082.elf	Get hash	malicious	Chaos	Browse
	SecuriteInfo.com.ELF.Agent-BSR.23757.4302.elf	Get hash	malicious	Chaos	Browse
	z3u7dnBStL.elf	Get hash	malicious	Mirai	Browse
	YE6HFLEfb4.elf	Get hash	malicious	Unknown	Browse
	00kDn01FGP.elf	Get hash	malicious	Mirai	Browse
	F5owD542qK.elf	Get hash	malicious	Mirai	Browse
	6nuXoz7rzo.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	CT9oaKX3q3.elf	Get hash	malicious	Unknown	Browse
	xulknaY6vd.elf	Get hash	malicious	Mirai, Moobot	Browse
	gEqPcxJPs4.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://site24x7.com	Get hash	malicious	Unknown	Browse	108.139.15.104
	rc21AW1MZD.elf	Get hash	malicious	Mirai	Browse	108.137.8.194
	QFR4Qsnm6y.elf	Get hash	malicious	Mirai	Browse	54.122.72.117
	jLntRRok3B.elf	Get hash	malicious	Mirai	Browse	71.152.60.96
	hYN45tzxwl.elf	Get hash	malicious	Mirai	Browse	99.79.220.122
	https://ortelia.com/download-ortelia-curator/	Get hash	malicious	Havoc	Browse	3.161.136.116
	https://staticcontent.cricut.com/a/software/win32-native/CricutDesignSpace-Install-v8.24.60.exe?Expires=1713405575&Signature=2WQC5y2N-HrvfbwCMSuJ2AepXckGrbtsXEdZfqTTcjsjIKwZ48XDUv2do7SKzLJZWbg3r4Qt-YcgcCEnlL4U8K~rZtlF1Sign5lBZQZ-qWq6nwQhfqOgI~2AzpwFlKa5Z0ZnNvk2QuBEm0NcoBXnTJbNIFUhXCXRo~PkpHmlp-Y848hU1zn-5iSX5OQNww3WIYg3K44DIbQxYvphEE2jdUyUTtrCWjluOBokHPH6E~RD6qKswmjzuLGyXmsEyq2FGQou~BS4AMtEkggT4nGQgr237R7z6oZi4w27o~lPIOGwMp1OZKYPzPyFXWTVDDIRSWrWSGeDI6ePgo8Ifcsj4g__&Key-Pair-Id=K2W1AJ47IQWIOI	Get hash	malicious	Unknown	Browse	13.32.151.60
	http://ranchpools.com	Get hash	malicious	Unknown	Browse	3.162.125.63
	http://t.cm.morganstanley.com/r/?id=h1b92d14%2C134cc33c%2C1356be32&p1=www.saiengroup.com%2Fteaz%2F648c482b60b3906833c9304bab170add%2FJBVNhz%2FYW15LmNoZW5AZG91YmxlbGluZS5jb20=	Get hash	malicious	HTMLPhisher	Browse	44.236.226.13

Process:	/tmp/va2ZcYaLHe.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887362
Encrypted:	false
SSDEEP:	3:TgqqJ5n:Tgqw
MD5:	286F06DE85E9A2ACA1DBF26A61C598AB
SHA1:	5D0B106441F3EBD9AFB92DC73235B0B68D6BF780
SHA-256:	2A97B9182F50B9D9A35CB6194EFF32454EFD6DB782682F0278BBCD5C319ECF3B
SHA-512:	D1C3BC47F2DF80AA311A279EEC6A63AE85C9D58B0CBB43D40DAFA94716CE96A3DC86FA5372DB80C1FCF9A685F300CEEBE4FD93F14ACC3D93A55DFA62DD93A1D7
Malicious:	false
Reputation:	low
Preview:	/tmp/va2ZcYaLHe.elf.

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.968798882134998
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	va2ZcYaLHe.elf
File size:	179'805 bytes
MD5:	b925490f03913c77566629e3e2393e7e
SHA1:	aa41eb009b44b37394a48d285ce4073b44a4f1b0
SHA256:	9e8f0f96ec93cb215ed1a180047889840c9170eba97b82db775e5566531ae0f2
SHA512:	87f7e10131b11fa01c52475c5272b62efed222628ce46cae6c42b19caf83ca30f0ebbf1798e7e0f6087b3ef1529e51e367b6015cf9c6e5d032b7daa42f06e707
SSDEEP:	3072:HK/lcbNbBLbcBCkoajwdyqkk4/T/6EBpZu/hJjogM/RHWT+M:HK/MBLbEloajwdybkwRBzu/XMgM/RHWL
TLSH:	78042A46EA404B13C0D627B5F6DF42453333ABA497EB73069628ABF43F8679E4F22505
File Content Preview:	.ELF..............(.........4...........4. ...(........p............p...p................................................................V..........................................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	138472
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x16fdc	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1f0cc	0x170cc	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1f0e0	0x170e0	0x21a8	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x21288	0x19288	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x212a0	0x192a0	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x29410	0x19410	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x29414	0x19414	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x29418	0x19418	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x29418	0x19418	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2941c	0x1941c	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x29420	0x19420	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x29424	0x19424	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x294e4	0x194e4	0x2f4	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x297d8	0x197d8	0x5304	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x197d8	0xea4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1a680	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1a7e0	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1aa1e	0x29df	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1d3fd	0x986	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1dd83	0x10da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1ee60	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1f19c	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1fc58	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x21482	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x21bb2	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x21bc8	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x22198	0x64c0	0x10	0x0		29	930	4
.strtab	STRTAB	0x0	0x28658	0x3805	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x192a0	0x212a0	0x212a0	0x170	0x170	4.6993	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x19410	0x19410	6.1231	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x19410	0x29410	0x29410	0x3c8	0x56cc	4.3235	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x19414	0x29414	0x29414	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 07:47:59.739336014 CEST	44524	443	192.168.2.15	34.254.182.186
Apr 18, 2024 07:47:59.957190037 CEST	443	44524	34.254.182.186	192.168.2.15

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 07:47:57.850718975 CEST	37645	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:47:58.049256086 CEST	53	37645	8.8.8.8	192.168.2.15
Apr 18, 2024 07:47:58.049597979 CEST	36240	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:47:58.245865107 CEST	53	36240	8.8.8.8	192.168.2.15
Apr 18, 2024 07:47:58.246000051 CEST	36798	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:47:58.428436041 CEST	53	36798	8.8.8.8	192.168.2.15
Apr 18, 2024 07:47:58.428543091 CEST	50458	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:47:58.611217022 CEST	53	50458	8.8.8.8	192.168.2.15
Apr 18, 2024 07:47:58.611377954 CEST	35876	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:47:58.794487000 CEST	53	35876	8.8.8.8	192.168.2.15
Apr 18, 2024 07:47:59.795274973 CEST	46429	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:47:59.997221947 CEST	53	46429	8.8.8.8	192.168.2.15
Apr 18, 2024 07:47:59.997333050 CEST	45385	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:00.179923058 CEST	53	45385	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:00.180082083 CEST	50606	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:00.406332970 CEST	53	50606	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:00.406438112 CEST	57798	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:00.589725971 CEST	53	57798	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:00.589822054 CEST	54565	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:00.772871017 CEST	53	54565	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:10.772767067 CEST	48032	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:10.957250118 CEST	53	48032	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:10.957406044 CEST	38386	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:11.166935921 CEST	53	38386	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:11.167109013 CEST	41148	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:11.350224018 CEST	53	41148	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:11.350352049 CEST	51990	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:11.575175047 CEST	53	51990	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:11.575294971 CEST	38370	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:11.775202990 CEST	53	38370	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:15.775422096 CEST	39121	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:15.957465887 CEST	53	39121	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:15.957592964 CEST	55649	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:16.143030882 CEST	53	55649	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:16.143153906 CEST	44165	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:16.363132000 CEST	53	44165	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:16.363228083 CEST	48291	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:16.545825958 CEST	53	48291	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:16.545931101 CEST	35722	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:16.729434967 CEST	53	35722	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:18.729624033 CEST	53396	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:18.913242102 CEST	53	53396	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:18.913398981 CEST	39978	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:19.095673084 CEST	53	39978	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:19.095799923 CEST	45138	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:19.279402971 CEST	53	45138	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:19.279511929 CEST	50238	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:19.461227894 CEST	53	50238	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:19.461349964 CEST	53157	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:19.643369913 CEST	53	53157	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:21.643567085 CEST	37019	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:21.825083017 CEST	53	37019	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:21.825203896 CEST	54903	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:22.007678032 CEST	53	54903	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:22.007822990 CEST	35337	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:22.190692902 CEST	53	35337	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:22.190862894 CEST	43071	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:22.373203039 CEST	53	43071	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:22.373330116 CEST	37695	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:22.555643082 CEST	53	37695	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:28.555690050 CEST	35170	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:28.810163021 CEST	53	35170	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:28.810309887 CEST	60411	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:29.046068907 CEST	53	60411	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:29.046176910 CEST	50054	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:29.229612112 CEST	53	50054	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:29.229746103 CEST	42540	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:29.426491022 CEST	53	42540	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:29.426625013 CEST	35898	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:29.628272057 CEST	53	35898	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:35.628386021 CEST	42449	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:35.811767101 CEST	53	42449	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:35.812016964 CEST	42861	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:35.995408058 CEST	53	42861	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:35.995604038 CEST	59826	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:36.197401047 CEST	53	59826	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:36.197590113 CEST	59312	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:36.381900072 CEST	53	59312	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:36.382210016 CEST	52724	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:36.595837116 CEST	53	52724	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:43.596235991 CEST	48577	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:43.810517073 CEST	53	48577	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:43.810812950 CEST	48597	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:43.993206024 CEST	53	48597	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:43.993417978 CEST	53921	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:44.206896067 CEST	53	53921	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:44.207120895 CEST	55105	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:44.408842087 CEST	53	55105	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:44.409071922 CEST	33832	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:44.591883898 CEST	53	33832	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:54.591850042 CEST	46917	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:54.788893938 CEST	53	46917	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:54.789076090 CEST	42049	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:54.972480059 CEST	53	42049	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:54.972723007 CEST	51952	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:55.156446934 CEST	53	51952	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:55.156641006 CEST	49613	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:55.338404894 CEST	53	49613	8.8.8.8	192.168.2.15
Apr 18, 2024 07:48:55.338675976 CEST	44685	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:48:55.522900105 CEST	53	44685	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:01.523261070 CEST	49150	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:01.704919100 CEST	53	49150	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:01.705162048 CEST	39661	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:01.919548035 CEST	53	39661	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:01.919796944 CEST	49445	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:02.122221947 CEST	53	49445	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:02.122469902 CEST	40098	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:02.348735094 CEST	53	40098	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:02.348968983 CEST	46010	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:02.574279070 CEST	53	46010	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:11.574325085 CEST	59821	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:11.786443949 CEST	53	59821	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:11.786827087 CEST	35097	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:12.000152111 CEST	53	35097	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:12.000374079 CEST	59568	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:12.183582067 CEST	53	59568	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:12.183892012 CEST	46199	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:12.365470886 CEST	53	46199	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:12.365643978 CEST	50031	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:12.549926996 CEST	53	50031	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:17.550158024 CEST	42400	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:17.733300924 CEST	53	42400	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:17.733561993 CEST	34064	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:17.964366913 CEST	53	34064	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:17.964545012 CEST	58196	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:18.147542000 CEST	53	58196	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:18.147892952 CEST	36489	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:18.352025032 CEST	53	36489	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:18.352392912 CEST	42481	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:18.535218000 CEST	53	42481	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:22.535422087 CEST	50359	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:22.731106043 CEST	53	50359	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:22.731313944 CEST	32880	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:22.913379908 CEST	53	32880	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:22.913605928 CEST	45891	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:23.096981049 CEST	53	45891	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:23.097157001 CEST	53670	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:23.280375957 CEST	53	53670	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:23.280599117 CEST	52715	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:23.492918968 CEST	53	52715	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:31.492983103 CEST	46201	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:31.693604946 CEST	53	46201	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:31.693784952 CEST	45772	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:31.898703098 CEST	53	45772	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:31.898861885 CEST	34847	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:32.124650002 CEST	53	34847	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:32.124855995 CEST	43099	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:32.320223093 CEST	53	43099	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:32.320384026 CEST	38642	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:32.503360987 CEST	53	38642	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:42.503413916 CEST	50439	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:42.699104071 CEST	53	50439	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:42.699279070 CEST	36728	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:42.895046949 CEST	53	36728	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:42.895283937 CEST	39204	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:43.091974974 CEST	53	39204	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:43.092211962 CEST	34132	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:43.275293112 CEST	53	34132	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:43.275563955 CEST	54418	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:43.471540928 CEST	53	54418	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:49.471765041 CEST	46898	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:49.654479980 CEST	53	46898	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:49.654649019 CEST	56730	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:49.837078094 CEST	53	56730	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:49.837282896 CEST	46617	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:50.032210112 CEST	53	46617	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:50.032421112 CEST	54716	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:50.215421915 CEST	53	54716	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:50.215621948 CEST	34918	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:50.398736000 CEST	53	34918	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:58.398857117 CEST	44276	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:58.612004042 CEST	53	44276	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:58.612221956 CEST	60106	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:58.814307928 CEST	53	60106	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:58.814496040 CEST	33205	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:58.997601986 CEST	53	33205	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:58.997788906 CEST	35477	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:59.194503069 CEST	53	35477	8.8.8.8	192.168.2.15
Apr 18, 2024 07:49:59.194763899 CEST	54580	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:49:59.408217907 CEST	53	54580	8.8.8.8	192.168.2.15

Start time (UTC):	05:47:56
Start date (UTC):	18/04/2024
Path:	/tmp/va2ZcYaLHe.elf
Arguments:	/tmp/va2ZcYaLHe.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report va2ZcYaLHe.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.007Kqe (deleted)

/tmp/qemu-open.04oKYb (deleted)

/tmp/qemu-open.04pjKb (deleted)

/tmp/qemu-open.083reb (deleted)

/tmp/qemu-open.0Coclc (deleted)

/tmp/qemu-open.0ESpXc (deleted)

/tmp/qemu-open.0Jo2ze (deleted)

/tmp/qemu-open.0KW27a (deleted)

/tmp/qemu-open.0RM1Mc (deleted)

/tmp/qemu-open.0WU9Jb (deleted)

/tmp/qemu-open.0c6fVc (deleted)

/tmp/qemu-open.0jqQvb (deleted)

/tmp/qemu-open.0pHTkc (deleted)

/tmp/qemu-open.0qEnYc (deleted)

/tmp/qemu-open.14zrGb (deleted)

/tmp/qemu-open.161WTd (deleted)

/tmp/qemu-open.1Cu0gc (deleted)

/tmp/qemu-open.1D7Xjc (deleted)

/tmp/qemu-open.1HLQTe (deleted)

/tmp/qemu-open.1IwFZb (deleted)

/tmp/qemu-open.1JsgCb (deleted)

/tmp/qemu-open.1UAuge (deleted)

/tmp/qemu-open.1UsUyb (deleted)

/tmp/qemu-open.1lexta (deleted)

/tmp/qemu-open.1oqIqb (deleted)

/tmp/qemu-open.1rBpcb (deleted)

/tmp/qemu-open.1rGnBb (deleted)

/tmp/qemu-open.1yWi2b (deleted)

Linux Analysis Report
va2ZcYaLHe.elf

Start time (UTC):	05:47:58
Start date (UTC):	18/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre