Edit tour

Linux Analysis Report
rJxGWg7lde.elf

Overview

General Information

Sample name:	rJxGWg7lde.elf renamed because original name is a hash value
Original sample name:	ad3d9023dad469be0137fe0c807ba137.elf
Analysis ID:	1427801
MD5:	ad3d9023dad469be0137fe0c807ba137
SHA1:	94646f589b63cbf49e13a2cee3de03a138f341a4
SHA256:	d2dab3b9059fb69eee55dccc3f8d146283ed798e9d144da2c35934017c408802
Tags:	32elfmiraimotorola
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427801
Start date and time:	2024-04-18 07:51:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	rJxGWg7lde.elf renamed because original name is a hash value
Original Sample Name:	ad3d9023dad469be0137fe0c807ba137.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/1025@90/0

Runtime Messages

Command:	/tmp/rJxGWg7lde.elf
PID:	5553
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

rJxGWg7lde.elf (PID: 5553, Parent: 5472, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/rJxGWg7lde.elf

rJxGWg7lde.elf New Fork (PID: 5557, Parent: 5553)

rJxGWg7lde.elf New Fork (PID: 5559, Parent: 5557)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
rJxGWg7lde.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
rJxGWg7lde.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x21327:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2133b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2134f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21363:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21377:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2138b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2139f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x213b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x213c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x213db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x213ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21403:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21417:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2142b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2143f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21453:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21467:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2147b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2148f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x214a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x214b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5553.1.00007fb2c4001000.00007fb2c4025000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5553.1.00007fb2c4001000.00007fb2c4025000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x21327:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2133b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2134f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21363:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21377:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2138b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2139f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x213b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x213c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x213db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x213ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21403:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21417:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2142b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2143f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21453:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21467:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2147b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2148f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x214a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x214b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: rJxGWg7lde.elf PID: 5553	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: rJxGWg7lde.elf PID: 5553	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x7303:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7317:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x732b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x733f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7353:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7367:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x737b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x738f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x73a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x73b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x73cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x73df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x73f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7407:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x741b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x742f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7443:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7457:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x746b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x747f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7493:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: rJxGWg7lde.elf	ReversingLabs: Detection: 57%
Source: rJxGWg7lde.elf	Virustotal: Detection: 58%			Perma Link

Source: rJxGWg7lde.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5553.1.00007fb2c4001000.00007fb2c4025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: rJxGWg7lde.elf PID: 5553, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/5390/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/3886/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/rJxGWg7lde.elf (PID: 5559)	File opened: /proc/3440/cmdline	Jump to behavior

Source: rJxGWg7lde.elf, 5553.1.0000564cd2b12000.0000564cd2b97000.rw-.sdmp	Binary or memory string: LV!/etc/qemu-binfmt/m68k
Source: rJxGWg7lde.elf, 5553.1.00007ffdcb82e000.00007ffdcb84f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: rJxGWg7lde.elf, 5553.1.0000564cd2b12000.0000564cd2b97000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: rJxGWg7lde.elf, 5553.1.00007ffdcb82e000.00007ffdcb84f000.rw-.sdmp	Binary or memory string: .x86_64/usr/bin/qemu-m68k/tmp/rJxGWg7lde.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/rJxGWg7lde.elf

Source: Yara match	File source: rJxGWg7lde.elf, type: SAMPLE
Source: Yara match	File source: 5553.1.00007fb2c4001000.00007fb2c4025000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rJxGWg7lde.elf PID: 5553, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Source	Detection	Scanner	Label	Link
rJxGWg7lde.elf	58%	ReversingLabs	Linux.Trojan.Mirai
rJxGWg7lde.elf	58%	Virustotal		Browse
rJxGWg7lde.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Process:	/tmp/rJxGWg7lde.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887362
Encrypted:	false
SSDEEP:	3:Tg5H:Tg5H
MD5:	9129F597F0A239148AEE83AF722C3C22
SHA1:	5CAF02380A13D031773027036A2367DD1AE81DC8
SHA-256:	4849BE8F43C68D07CD399B4772105434BD77910B48694D2CD6DF663F44A1DD05
SHA-512:	D52FC24055764D06473BE8C6C5622AE68E171B80F1B66F6937FBD531544E3A119C45FD6F8D399485DC9D7550A6054C81F935C76ADD704157EEFB2875041FED9B
Malicious:	false
Reputation:	low
Preview:	/tmp/rJxGWg7lde.elf.

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.729390436247619
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	rJxGWg7lde.elf
File size:	164'680 bytes
MD5:	ad3d9023dad469be0137fe0c807ba137
SHA1:	94646f589b63cbf49e13a2cee3de03a138f341a4
SHA256:	d2dab3b9059fb69eee55dccc3f8d146283ed798e9d144da2c35934017c408802
SHA512:	48552eac022ccd8c212a322f39e2077b4b1b40b496cf123733f654d931ad9f16878535681d3db8f5ab982fc2779ac35624f0bb811ed84559f32805c002fed5c6
SSDEEP:	3072:pZVjYvOkbUqZ8QeuacWjcW0JcWcBzf5NBRz/WKiRyVdUjLlK0e8kDqW7:PVjYX8QeuacWjcW0JcWcB75DRqKULzeh
TLSH:	EAF318C7F901DAFAF85AE7370C430809B230B7E145921A376267767FED3A199142BD86
File Content Preview:	.ELF.......................D...4.........4. ...(......................:F..:F...... .......:L..ZL..ZL..G,.......... .dt.Q............................NV..a....da....xN^NuNV..J9...xf>"y..Z. QJ.g.X.#...Z.N."y..Z. QJ.f.A.....J.g.Hy..ZHN.X........xN^NuNV..N^NuN

Source: rJxGWg7lde.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5553.1.00007fb2c4001000.00007fb2c4025000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: rJxGWg7lde.elf PID: 5553, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	164280
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x211a2	0x0	0x6	AX	4
.fini	PROGBITS	0x8002124a	0x2124a	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x80021258	0x21258	0x27ee	0x0	0x2	A	2
.ctors	PROGBITS	0x80025a4c	0x23a4c	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x80025a58	0x23a58	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80025a80	0x23a80	0x46f8	0x0	0x3	WA	32
.bss	NOBITS	0x8002a178	0x28178	0x4974	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x28178	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x23a46	0x23a46	6.1031	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x23a4c	0x80025a4c	0x80025a4c	0x472c	0x90a0	0.4410	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 07:52:04.224353075 CEST	35555	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:04.407658100 CEST	53	35555	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:04.408019066 CEST	39666	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:04.592169046 CEST	53	39666	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:04.592623949 CEST	55415	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:04.795656919 CEST	53	55415	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:04.796127081 CEST	43661	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:04.979562044 CEST	53	43661	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:04.979720116 CEST	37695	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:05.193162918 CEST	53	37695	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:15.193658113 CEST	55534	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:15.376950026 CEST	53	55534	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:15.377100945 CEST	39153	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:15.579672098 CEST	53	39153	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:15.579823017 CEST	58686	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:15.763310909 CEST	53	58686	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:15.763462067 CEST	40916	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:15.960253000 CEST	53	40916	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:15.960436106 CEST	51328	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:16.144031048 CEST	53	51328	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:18.144278049 CEST	38685	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:18.327948093 CEST	53	38685	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:18.328090906 CEST	44925	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:18.524924994 CEST	53	44925	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:18.525068998 CEST	43822	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:18.709064007 CEST	53	43822	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:18.709170103 CEST	50447	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:18.892406940 CEST	53	50447	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:18.892503023 CEST	36841	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:19.076430082 CEST	53	36841	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:23.076625109 CEST	60450	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:23.260524988 CEST	53	60450	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:23.260668993 CEST	46638	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:23.443670034 CEST	53	46638	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:23.443768978 CEST	48146	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:23.626580000 CEST	53	48146	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:23.626718044 CEST	48809	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:23.844733000 CEST	53	48809	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:23.844842911 CEST	48162	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:24.048633099 CEST	53	48162	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:26.048867941 CEST	57298	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:26.449785948 CEST	53	57298	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:26.449942112 CEST	33591	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:26.632333994 CEST	53	33591	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:26.634885073 CEST	52387	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:26.818846941 CEST	53	52387	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:26.819020033 CEST	47901	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:27.021486998 CEST	53	47901	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:27.021723986 CEST	44883	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:27.266387939 CEST	53	44883	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:35.266661882 CEST	36945	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:35.462863922 CEST	53	36945	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:35.463046074 CEST	33401	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:35.659559965 CEST	53	33401	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:35.659751892 CEST	52524	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:35.904913902 CEST	53	52524	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:35.905203104 CEST	43515	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:36.089442015 CEST	53	43515	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:36.089845896 CEST	51409	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:36.273720026 CEST	53	51409	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:46.273972988 CEST	38119	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:46.563388109 CEST	53	38119	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:46.563584089 CEST	52184	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:46.800954103 CEST	53	52184	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:46.801101923 CEST	52890	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:47.074929953 CEST	53	52890	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:47.075068951 CEST	59894	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:47.322418928 CEST	53	59894	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:47.322566032 CEST	47149	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:47.587802887 CEST	53	47149	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:55.588196039 CEST	43347	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:55.814096928 CEST	53	43347	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:55.814374924 CEST	34928	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:55.998332024 CEST	53	34928	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:55.998548985 CEST	44346	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:56.181761980 CEST	53	44346	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:56.182094097 CEST	53705	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:56.365746975 CEST	53	53705	8.8.8.8	192.168.2.15
Apr 18, 2024 07:52:56.365966082 CEST	44095	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:52:56.562500000 CEST	53	44095	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:02.562676907 CEST	59240	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:02.745788097 CEST	53	59240	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:02.745933056 CEST	51258	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:02.929172993 CEST	53	51258	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:02.929429054 CEST	47680	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:03.112523079 CEST	53	47680	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:03.112687111 CEST	43679	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:03.295670986 CEST	53	43679	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:03.295933962 CEST	60908	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:03.493933916 CEST	53	60908	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:04.494384050 CEST	53047	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:04.677159071 CEST	53	53047	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:04.677366018 CEST	44192	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:04.860604048 CEST	53	44192	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:04.860802889 CEST	42112	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:05.105165958 CEST	53	42112	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:05.105357885 CEST	48010	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:05.288517952 CEST	53	48010	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:05.288723946 CEST	50938	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:05.472048998 CEST	53	50938	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:10.472410917 CEST	39966	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:10.675200939 CEST	53	39966	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:10.675617933 CEST	51263	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:10.859404087 CEST	53	51263	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:10.859568119 CEST	55641	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:11.041976929 CEST	53	55641	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:11.042154074 CEST	49869	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:11.225796938 CEST	53	49869	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:11.225950956 CEST	34804	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:11.421794891 CEST	53	34804	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:13.422317982 CEST	39774	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:13.605648041 CEST	53	39774	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:13.605834961 CEST	49041	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:13.834939003 CEST	53	49041	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:13.835138083 CEST	36768	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:14.048449993 CEST	53	36768	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:14.048722029 CEST	43873	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:14.232043982 CEST	53	43873	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:14.232394934 CEST	33624	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:14.434657097 CEST	53	33624	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:24.434742928 CEST	33504	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:24.660525084 CEST	53	33504	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:24.660716057 CEST	53056	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:24.844302893 CEST	53	53056	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:24.844448090 CEST	60985	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:25.040661097 CEST	53	60985	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:25.040831089 CEST	48864	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:25.242580891 CEST	53	48864	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:25.242722034 CEST	44180	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:25.426812887 CEST	53	44180	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:27.427067041 CEST	43055	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:27.628683090 CEST	53	43055	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:27.628874063 CEST	37029	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:27.811978102 CEST	53	37029	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:27.812130928 CEST	58323	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:28.009114981 CEST	53	58323	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:28.009282112 CEST	44988	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:28.235126019 CEST	53	44988	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:28.235282898 CEST	41290	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:28.419163942 CEST	53	41290	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:37.419272900 CEST	39633	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:37.631968975 CEST	53	39633	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:37.632142067 CEST	41253	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:37.844299078 CEST	53	41253	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:37.844474077 CEST	49413	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:38.041306973 CEST	53	49413	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:38.041450977 CEST	44988	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:38.254616022 CEST	53	44988	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:38.255151033 CEST	55390	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:38.440284014 CEST	53	55390	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:43.441134930 CEST	45338	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:43.624804974 CEST	53	45338	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:43.625226021 CEST	50299	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:43.821491003 CEST	53	50299	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:43.821793079 CEST	58898	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:44.023956060 CEST	53	58898	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:44.024378061 CEST	60295	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:44.207581997 CEST	53	60295	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:44.208794117 CEST	46781	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:44.391944885 CEST	53	46781	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:53.392030001 CEST	45858	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:53.575392962 CEST	53	45858	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:53.575592041 CEST	41691	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:53.758744955 CEST	53	41691	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:53.759147882 CEST	39769	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:53.943300962 CEST	53	39769	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:53.943757057 CEST	37472	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:54.146336079 CEST	53	37472	8.8.8.8	192.168.2.15
Apr 18, 2024 07:53:54.146593094 CEST	36959	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:53:54.360024929 CEST	53	36959	8.8.8.8	192.168.2.15
Apr 18, 2024 07:54:04.360193014 CEST	35626	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:54:04.573194027 CEST	53	35626	8.8.8.8	192.168.2.15
Apr 18, 2024 07:54:04.573599100 CEST	56219	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:54:04.761179924 CEST	53	56219	8.8.8.8	192.168.2.15
Apr 18, 2024 07:54:04.761357069 CEST	35706	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:54:04.958086014 CEST	53	35706	8.8.8.8	192.168.2.15
Apr 18, 2024 07:54:04.958321095 CEST	51205	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:54:05.142168999 CEST	53	51205	8.8.8.8	192.168.2.15
Apr 18, 2024 07:54:05.142358065 CEST	58472	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:54:05.325864077 CEST	53	58472	8.8.8.8	192.168.2.15

Start time (UTC):	05:52:03
Start date (UTC):	18/04/2024
Path:	/tmp/rJxGWg7lde.elf
Arguments:	/tmp/rJxGWg7lde.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report rJxGWg7lde.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.031BDz (deleted)

/tmp/qemu-open.0BzqAx (deleted)

/tmp/qemu-open.0ESS9x (deleted)

/tmp/qemu-open.0FDk3v (deleted)

/tmp/qemu-open.0NS7zx (deleted)

/tmp/qemu-open.0OdyPx (deleted)

/tmp/qemu-open.0Q5olx (deleted)

/tmp/qemu-open.0Rjnqy (deleted)

/tmp/qemu-open.0UnWSv (deleted)

/tmp/qemu-open.0XHxDy (deleted)

/tmp/qemu-open.0ZY1Tz (deleted)

/tmp/qemu-open.0eOnCw (deleted)

/tmp/qemu-open.0gggMw (deleted)

/tmp/qemu-open.0luiyz (deleted)

/tmp/qemu-open.0rEEey (deleted)

/tmp/qemu-open.0vx8Jw (deleted)

/tmp/qemu-open.0wIYwy (deleted)

/tmp/qemu-open.175KSv (deleted)

/tmp/qemu-open.17v0Vv (deleted)

/tmp/qemu-open.19a5Wz (deleted)

/tmp/qemu-open.1EFUTy (deleted)

/tmp/qemu-open.1OTOAz (deleted)

/tmp/qemu-open.1QaASv (deleted)

/tmp/qemu-open.1WUhsw (deleted)

/tmp/qemu-open.1Wb7Az (deleted)

/tmp/qemu-open.1YSbDz (deleted)

/tmp/qemu-open.1Yinlw (deleted)

/tmp/qemu-open.1akNgw (deleted)

/tmp/qemu-open.1cBNaz (deleted)

/tmp/qemu-open.1eeAgy (deleted)

/tmp/qemu-open.1j9ymy (deleted)

Linux Analysis Report
rJxGWg7lde.elf