Edit tour

Linux Analysis Report
80SO06dMRV.elf

Overview

General Information

Sample name:	80SO06dMRV.elf renamed because original name is a hash value
Original sample name:	caa9cd99e5c8476af9df276a84d0d7c8.elf
Analysis ID:	1427803
MD5:	caa9cd99e5c8476af9df276a84d0d7c8
SHA1:	297ad9a1439c704422962e8258c05a5486978fe8
SHA256:	3b9a170902335984dfef5c60ba8ae09b0fd0944637ceb7999c5f409139cebd47
Tags:	32elfmirairenesas
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427803
Start date and time:	2024-04-18 07:55:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	80SO06dMRV.elf renamed because original name is a hash value
Original Sample Name:	caa9cd99e5c8476af9df276a84d0d7c8.elf
Detection:	MAL
Classification:	mal56.linELF@0/1025@110/0

Runtime Messages

Command:	/tmp/80SO06dMRV.elf
PID:	6230
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

80SO06dMRV.elf (PID: 6230, Parent: 6151, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/80SO06dMRV.elf

80SO06dMRV.elf New Fork (PID: 6232, Parent: 6230)

80SO06dMRV.elf New Fork (PID: 6234, Parent: 6232)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
80SO06dMRV.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdf28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6230.1.00007f80b4400000.00007f80b4410000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdf28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 80SO06dMRV.elf PID: 6230	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4ec5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ed9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4eed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4fa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4fb5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4fc9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4fdd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ff1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5005:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5019:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x502d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5041:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5055:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Source: 80SO06dMRV.elf	ReversingLabs: Detection: 42%
Source: 80SO06dMRV.elf	Virustotal: Detection: 48%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: 80SO06dMRV.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6230.1.00007f80b4400000.00007f80b4410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 80SO06dMRV.elf PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/4504/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/80SO06dMRV.elf (PID: 6234)	File opened: /proc/261/cmdline	Jump to behavior

Source: 80SO06dMRV.elf, 6230.1.00005649c3a29000.00005649c3ab2000.rw-.sdmp	Binary or memory string: IV5!/etc/qemu-binfmt/sh4
Source: 80SO06dMRV.elf, 6230.1.00007fff5fe44000.00007fff5fe65000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/80SO06dMRV.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/80SO06dMRV.elf
Source: 80SO06dMRV.elf, 6230.1.00007fff5fe44000.00007fff5fe65000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: 80SO06dMRV.elf, 6230.1.00005649c3a29000.00005649c3ab2000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
80SO06dMRV.elf	42%	ReversingLabs	Linux.Trojan.Mirai
80SO06dMRV.elf	48%	Virustotal		Browse

Source: 80SO06dMRV.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6230.1.00007f80b4400000.00007f80b4410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 80SO06dMRV.elf PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
109.202.202.202	2pcIneMurs.elf	Get hash	malicious	Unknown	Browse
	F7tyGvYaTl.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	skid.arm.elf	Get hash	malicious	Unknown	Browse
	dQV40zAvGT.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	YgpPblX7Ct.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	epLN92K8RM.elf	Get hash	malicious	Mirai	Browse
	LJTtnwewUQ.elf	Get hash	malicious	Mirai	Browse
	NvmCe2XrqN.elf	Get hash	malicious	Mirai	Browse
	FwLad7Fxwv.elf	Get hash	malicious	Mirai	Browse
91.189.91.43	2pcIneMurs.elf	Get hash	malicious	Unknown	Browse
	F7tyGvYaTl.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	skid.arm.elf	Get hash	malicious	Unknown	Browse
	YgpPblX7Ct.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	epLN92K8RM.elf	Get hash	malicious	Mirai	Browse
	LJTtnwewUQ.elf	Get hash	malicious	Mirai	Browse
	NvmCe2XrqN.elf	Get hash	malicious	Mirai	Browse
	FwLad7Fxwv.elf	Get hash	malicious	Mirai	Browse
	aNeRrtorRm.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	2pcIneMurs.elf	Get hash	malicious	Unknown	Browse
	F7tyGvYaTl.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	skid.arm.elf	Get hash	malicious	Unknown	Browse
	dQV40zAvGT.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	YgpPblX7Ct.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	epLN92K8RM.elf	Get hash	malicious	Mirai	Browse
	LJTtnwewUQ.elf	Get hash	malicious	Mirai	Browse
	NvmCe2XrqN.elf	Get hash	malicious	Mirai	Browse
	FwLad7Fxwv.elf	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	2pcIneMurs.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	jPa5GP7YWR.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	F7tyGvYaTl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	skid.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	dQV40zAvGT.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	YgpPblX7Ct.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	epLN92K8RM.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	LJTtnwewUQ.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	2pcIneMurs.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	jPa5GP7YWR.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	F7tyGvYaTl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	skid.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	dQV40zAvGT.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	YgpPblX7Ct.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	epLN92K8RM.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	LJTtnwewUQ.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	2pcIneMurs.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	F7tyGvYaTl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	skid.arm.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	dQV40zAvGT.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	YgpPblX7Ct.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	epLN92K8RM.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	LJTtnwewUQ.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	NvmCe2XrqN.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	FwLad7Fxwv.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

Process:	/tmp/80SO06dMRV.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:Tgdb5B2sDl:TgdVB2G
MD5:	A13E8FA789AD74F75114A22EC18586C8
SHA1:	5D1DAA8FC92524F123CAA812D1FC7929BDF0F2B2
SHA-256:	735F254273B2F06D6E19D19C8E0206FE12CB170E0DA5AFDC221283BA1560AD8E
SHA-512:	CFF11C25C7745E83486AC3A2CB81B38EBD62F158BF851E7713F880A4651800C26D24F06B452056C06C85F99019663E62AEB7D603031D5B6D1B94A1EE81DE8415
Malicious:	false
Reputation:	low
Preview:	/tmp/80SO06dMRV.elf.

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.611574525333077
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	80SO06dMRV.elf
File size:	66'468 bytes
MD5:	caa9cd99e5c8476af9df276a84d0d7c8
SHA1:	297ad9a1439c704422962e8258c05a5486978fe8
SHA256:	3b9a170902335984dfef5c60ba8ae09b0fd0944637ceb7999c5f409139cebd47
SHA512:	a5217b86a9ca7b7b3fa7f67a4d5fc09e1997a431e7fee1af9aa7868bb8301142d11b3002a6eced6ce3f1f2a17aa53e481875f716d29f9b078a647fce1b8c7064
SSDEEP:	768:hBENyYufhyHBJym3xGgB8uKDS5UH/usIFrLVOhBimh5f6FcNE1A0w/zSIEr:my+BR/8O5UH5tBiAJ2A1/zGr
TLSH:	C8537C31F4142CB0C85215B4B438DEB80B2368F552D92C725EADDA9518A3EEEF58DFD8
File Content Preview:	.ELF.....................@.4...........4. ...(...............@...@.,...,.....................A...A.................Q.td..............................././"O.n......#.@........#.*@,...&O.n.l..................................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0xc
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	66068
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x2e	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0xdd40	0x0	0x6	AX	32
.fini	PROGBITS	0x40de20	0xde20	0x22	0x0	0x6	AX	4
.rodata	PROGBITS	0x40de44	0xde44	0x1ae8	0x0	0x2	A	4
.ctors	PROGBITS	0x4100dc	0x100dc	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x4100e4	0x100e4	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x4100f0	0x100f0	0xe4	0x0	0x3	WA	4
.bss	NOBITS	0x4101d4	0x101d4	0x7e4	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x101d4	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xf92c	0xf92c	6.7471	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x100dc	0x4100dc	0x4100dc	0xf8	0x8dc	3.7667	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 07:55:53.603660107 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 18, 2024 07:55:59.234802008 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 18, 2024 07:56:00.002841949 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 18, 2024 07:56:13.568722010 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 18, 2024 07:56:25.855011940 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 18, 2024 07:56:29.950488091 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 18, 2024 07:56:54.522933960 CEST	43928	443	192.168.2.23	91.189.91.42

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 07:55:53.977890015 CEST	37608	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:55:54.164758921 CEST	53	37608	8.8.8.8	192.168.2.23
Apr 18, 2024 07:55:54.165095091 CEST	51265	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:55:54.348475933 CEST	53	51265	8.8.8.8	192.168.2.23
Apr 18, 2024 07:55:54.348645926 CEST	36314	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:55:54.545351028 CEST	53	36314	8.8.8.8	192.168.2.23
Apr 18, 2024 07:55:54.545521021 CEST	49869	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:55:54.771785975 CEST	53	49869	8.8.8.8	192.168.2.23
Apr 18, 2024 07:55:54.771944046 CEST	55983	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:55:54.969254971 CEST	53	55983	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:02.968794107 CEST	41089	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:03.194638014 CEST	53	41089	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:03.196619034 CEST	33258	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:03.379808903 CEST	53	33258	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:03.381042957 CEST	39155	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:03.565798044 CEST	53	39155	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:03.565938950 CEST	60814	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:03.780127048 CEST	53	60814	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:03.780247927 CEST	57871	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:04.001635075 CEST	53	57871	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:07.001482010 CEST	42383	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:07.184601068 CEST	53	42383	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:07.184721947 CEST	43547	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:07.380536079 CEST	53	43547	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:07.380656958 CEST	48133	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:07.564115047 CEST	53	48133	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:07.564254999 CEST	60694	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:07.777170897 CEST	53	60694	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:07.777295113 CEST	58735	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:07.973507881 CEST	53	58735	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:11.973211050 CEST	33527	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:12.156682968 CEST	53	33527	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:12.156812906 CEST	49092	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:12.352483034 CEST	53	49092	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:12.352616072 CEST	36992	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:12.551547050 CEST	53	36992	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:12.551707983 CEST	55959	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:12.735009909 CEST	53	55959	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:12.735138893 CEST	39668	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:12.931914091 CEST	53	39668	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:21.931106091 CEST	57687	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:22.114552975 CEST	53	57687	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:22.114734888 CEST	41603	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:22.298115969 CEST	53	41603	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:22.298379898 CEST	57992	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:22.481146097 CEST	53	57992	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:22.481410027 CEST	55700	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:22.687016010 CEST	53	55700	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:22.687175989 CEST	35579	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:22.870174885 CEST	53	35579	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:29.869745970 CEST	33980	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:30.052966118 CEST	53	33980	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:30.053432941 CEST	36311	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:30.236823082 CEST	53	36311	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:30.237035990 CEST	43734	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:30.481822968 CEST	53	43734	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:30.482023001 CEST	33572	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:30.667042971 CEST	53	33572	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:30.667274952 CEST	58971	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:30.882728100 CEST	53	58971	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:33.882587910 CEST	42586	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:34.065504074 CEST	53	42586	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:34.065644026 CEST	45547	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:34.248857975 CEST	53	45547	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:34.249027967 CEST	52217	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:34.445632935 CEST	53	52217	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:34.445801973 CEST	48264	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:34.642121077 CEST	53	48264	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:34.642282009 CEST	42839	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:34.826199055 CEST	53	42839	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:41.825483084 CEST	59260	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:42.012677908 CEST	53	59260	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:42.012835026 CEST	38656	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:42.197082996 CEST	53	38656	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:42.197252989 CEST	41591	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:42.381321907 CEST	53	41591	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:42.381455898 CEST	47049	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:42.565073967 CEST	53	47049	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:42.565201044 CEST	41856	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:42.762873888 CEST	53	41856	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:50.762168884 CEST	36777	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:50.946911097 CEST	53	36777	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:50.947128057 CEST	52161	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:51.130743027 CEST	53	52161	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:51.131002903 CEST	37730	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:51.339020967 CEST	53	37730	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:51.339170933 CEST	34535	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:51.522852898 CEST	53	34535	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:51.523035049 CEST	57497	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:51.720345974 CEST	53	57497	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:52.720649958 CEST	55139	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:52.937550068 CEST	53	55139	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:52.937762022 CEST	45664	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:53.121682882 CEST	53	45664	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:53.121839046 CEST	43070	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:53.305603981 CEST	53	43070	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:53.305798054 CEST	59974	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:53.508496046 CEST	53	59974	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:53.508670092 CEST	35577	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:53.692854881 CEST	53	35577	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:58.692496061 CEST	49484	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:58.877358913 CEST	53	49484	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:58.877686024 CEST	55693	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:59.061928988 CEST	53	55693	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:59.062203884 CEST	49234	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:59.259869099 CEST	53	49234	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:59.260139942 CEST	60047	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:59.456760883 CEST	53	60047	8.8.8.8	192.168.2.23
Apr 18, 2024 07:56:59.456979036 CEST	52256	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:56:59.654201984 CEST	53	52256	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:02.654345989 CEST	50793	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:02.840912104 CEST	53	50793	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:02.841110945 CEST	39176	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:03.025223970 CEST	53	39176	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:03.025418997 CEST	36763	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:03.554199934 CEST	53	36763	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:03.554367065 CEST	51042	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:03.738475084 CEST	53	51042	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:03.738677979 CEST	54188	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:03.927639961 CEST	53	54188	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:06.927562952 CEST	60859	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:07.111793995 CEST	53	60859	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:07.111957073 CEST	47975	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:07.512141943 CEST	53	47975	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:07.512343884 CEST	54923	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:07.696825981 CEST	53	54923	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:07.697074890 CEST	58823	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:07.880820990 CEST	53	58823	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:07.881014109 CEST	37237	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:08.066329956 CEST	53	37237	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:14.065886974 CEST	39998	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:14.263762951 CEST	53	39998	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:14.263958931 CEST	37392	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:14.448394060 CEST	53	37392	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:14.448657036 CEST	55613	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:14.633495092 CEST	53	55613	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:14.633634090 CEST	46873	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:14.847938061 CEST	53	46873	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:14.848069906 CEST	37439	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:15.034763098 CEST	53	37439	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:17.034933090 CEST	38557	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:17.218298912 CEST	53	38557	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:17.218496084 CEST	50133	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:17.402565002 CEST	53	50133	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:17.402785063 CEST	38633	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:17.586318016 CEST	53	38633	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:17.586492062 CEST	37070	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:17.789053917 CEST	53	37070	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:17.789361954 CEST	43278	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:17.973891973 CEST	53	43278	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:23.973431110 CEST	47279	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:24.182714939 CEST	53	47279	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:24.183063030 CEST	43721	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:24.398797989 CEST	53	43721	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:24.399005890 CEST	39376	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:24.583324909 CEST	53	39376	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:24.583487034 CEST	36891	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:24.780441999 CEST	53	36891	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:24.780597925 CEST	38504	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:24.965085983 CEST	53	38504	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:28.964860916 CEST	47839	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:29.149012089 CEST	53	47839	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:29.149174929 CEST	35941	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:29.352788925 CEST	53	35941	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:29.352958918 CEST	41126	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:29.536775112 CEST	53	41126	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:29.536891937 CEST	35530	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:29.720951080 CEST	53	35530	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:29.721084118 CEST	49675	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:29.917412996 CEST	53	49675	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:36.916750908 CEST	45486	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:37.113785028 CEST	53	45486	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:37.113943100 CEST	37727	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:37.311152935 CEST	53	37727	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:37.311316013 CEST	60618	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:37.494925022 CEST	53	60618	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:37.495101929 CEST	39432	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:37.679487944 CEST	53	39432	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:37.679676056 CEST	55370	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:37.864670992 CEST	53	55370	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:39.864789009 CEST	51954	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:40.048717022 CEST	53	51954	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:40.048981905 CEST	57539	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:40.233062983 CEST	53	57539	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:40.233258963 CEST	60328	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:40.417373896 CEST	53	60328	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:40.417556047 CEST	48637	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:40.644021988 CEST	53	48637	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:40.644196987 CEST	49253	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:40.870675087 CEST	53	49253	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:48.869935989 CEST	37720	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:49.072848082 CEST	53	37720	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:49.073149920 CEST	45157	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:49.256079912 CEST	53	45157	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:49.256290913 CEST	57167	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:49.440639019 CEST	53	57167	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:49.440778017 CEST	59942	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:49.638485909 CEST	53	59942	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:49.638626099 CEST	58567	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:49.822273016 CEST	53	58567	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:50.822463989 CEST	59057	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:51.024868011 CEST	53	59057	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:51.025073051 CEST	42630	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:51.208378077 CEST	53	42630	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:51.208882093 CEST	43228	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:51.392709017 CEST	53	43228	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:51.393028021 CEST	58131	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:51.576396942 CEST	53	58131	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:51.576525927 CEST	51765	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:51.760719061 CEST	53	51765	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:58.760123968 CEST	32793	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:58.944259882 CEST	53	32793	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:58.944494009 CEST	51957	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:59.141149998 CEST	53	51957	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:59.141367912 CEST	51794	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:59.343591928 CEST	53	51794	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:59.343827963 CEST	43542	53	192.168.2.23	8.8.8.8
Apr 18, 2024 07:57:59.527484894 CEST	53	43542	8.8.8.8	192.168.2.23
Apr 18, 2024 07:57:59.527719021 CEST	48140	53	192.168.2.23	8.8.8.8

Start time (UTC):	05:55:53
Start date (UTC):	18/04/2024
Path:	/tmp/80SO06dMRV.elf
Arguments:	/tmp/80SO06dMRV.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 80SO06dMRV.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.03Oiby (deleted)

/tmp/qemu-open.03hyTz (deleted)

/tmp/qemu-open.04favy (deleted)

/tmp/qemu-open.04uGFA (deleted)

/tmp/qemu-open.05M6aB (deleted)

/tmp/qemu-open.0Dlt0z (deleted)

/tmp/qemu-open.0ESEpB (deleted)

/tmp/qemu-open.0IHWsz (deleted)

/tmp/qemu-open.0M7iIy (deleted)

/tmp/qemu-open.0Oswqy (deleted)

/tmp/qemu-open.0Qa2EC (deleted)

/tmp/qemu-open.0U5Kmy (deleted)

/tmp/qemu-open.0VexUy (deleted)

/tmp/qemu-open.0bgVXA (deleted)

/tmp/qemu-open.0eRADy (deleted)

/tmp/qemu-open.0gvvdB (deleted)

/tmp/qemu-open.0k7pCC (deleted)

/tmp/qemu-open.0lj9uz (deleted)

/tmp/qemu-open.0luqRz (deleted)

/tmp/qemu-open.0nBVFB (deleted)

/tmp/qemu-open.0nICGB (deleted)

/tmp/qemu-open.0nfQLC (deleted)

/tmp/qemu-open.0sUKZA (deleted)

/tmp/qemu-open.0wquXA (deleted)

/tmp/qemu-open.0zZvrz (deleted)

/tmp/qemu-open.12IKwA (deleted)

/tmp/qemu-open.14bNyy (deleted)

/tmp/qemu-open.14s7Nz (deleted)

/tmp/qemu-open.1AZESB (deleted)

/tmp/qemu-open.1BRp9B (deleted)

/tmp/qemu-open.1CQr2B (deleted)

/tmp/qemu-open.1CihKy (deleted)

/tmp/qemu-open.1DhXBB (deleted)

Linux Analysis Report
80SO06dMRV.elf

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre