Edit tour

Linux Analysis Report
7n8OwAD6b9.elf

Overview

General Information

Sample name:	7n8OwAD6b9.elf renamed because original name is a hash value
Original sample name:	ad718a5b8f961137491eb40c879e7371.elf
Analysis ID:	1427805
MD5:	ad718a5b8f961137491eb40c879e7371
SHA1:	01f0c1cb98e1ebb8e0cc84c528b78eb01dc4fe2b
SHA256:	d1621315b91c23f25e341c24f99696a988844ac2a1a38c0b37fe1da2b37b89ae
Tags:	32elfmipsmirai
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427805
Start date and time:	2024-04-18 07:55:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	7n8OwAD6b9.elf renamed because original name is a hash value
Original Sample Name:	ad718a5b8f961137491eb40c879e7371.elf
Detection:	MAL
Classification:	mal56.linELF@0/1025@100/0

Runtime Messages

Command:	/tmp/7n8OwAD6b9.elf
PID:	5534
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

7n8OwAD6b9.elf (PID: 5534, Parent: 5450, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/7n8OwAD6b9.elf

7n8OwAD6b9.elf New Fork (PID: 5536, Parent: 5534)

7n8OwAD6b9.elf New Fork (PID: 5538, Parent: 5536)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
7n8OwAD6b9.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2109c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2113c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2118c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x211a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x211b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x211c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x211dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x211f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21204:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21218:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2122c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5534.1.00007fdfec400000.00007fdfec423000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x2109c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2113c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2118c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x211a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x211b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x211c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x211dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x211f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21204:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21218:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2122c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 7n8OwAD6b9.elf PID: 5534	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3243:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3257:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x326b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x327f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3293:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x330b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x331f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3333:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3347:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x335b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x336f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3383:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3397:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: 7n8OwAD6b9.elf	ReversingLabs: Detection: 55%
Source: 7n8OwAD6b9.elf	Virustotal: Detection: 52%			Perma Link

Source: 7n8OwAD6b9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5534.1.00007fdfec400000.00007fdfec423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 7n8OwAD6b9.elf PID: 5534, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/3884/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/3681/cmdline	Jump to behavior
Source: /tmp/7n8OwAD6b9.elf (PID: 5538)	File opened: /proc/3440/cmdline	Jump to behavior

Source: 7n8OwAD6b9.elf, 5534.1.000055a7a8f92000.000055a7a9019000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: 7n8OwAD6b9.elf, 5534.1.00007ffe43507000.00007ffe43528000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/7n8OwAD6b9.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/7n8OwAD6b9.elf
Source: 7n8OwAD6b9.elf, 5534.1.000055a7a8f92000.000055a7a9019000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: 7n8OwAD6b9.elf, 5534.1.00007ffe43507000.00007ffe43528000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Source	Detection	Scanner	Label	Link
7n8OwAD6b9.elf	55%	ReversingLabs	Linux.Trojan.Mirai
7n8OwAD6b9.elf	52%	Virustotal		Browse

Process:	/tmp/7n8OwAD6b9.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:TgSESOHBl:TgaOz
MD5:	2A599B4C1BC23C7BE142F09B58401BF7
SHA1:	5DCC3988C2D0A77AD778F36F7BBDAA3DD87C614F
SHA-256:	30D43E9313B1E056CCEBE1E2F5369DE352CBFC8F8D31318B91429B7CE7D13C16
SHA-512:	923FC94291DB248B9717A668D974FB2A93F41B67A5215DFD2F9DF0C3C43FD83110A0348572C5750830C4ACE95881DAB26739277F476FAEBF5453F03D45FFDB8E
Malicious:	false
Reputation:	low
Preview:	/tmp/7n8OwAD6b9.elf.

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	4.82917905184969
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	7n8OwAD6b9.elf
File size:	145'560 bytes
MD5:	ad718a5b8f961137491eb40c879e7371
SHA1:	01f0c1cb98e1ebb8e0cc84c528b78eb01dc4fe2b
SHA256:	d1621315b91c23f25e341c24f99696a988844ac2a1a38c0b37fe1da2b37b89ae
SHA512:	62e7b33585a466bcd2630c17792bc4fee701a0ad7197eb906eae68aad59f0ef6a1bb9a19de3a2bbb8c4cfebddf9a27bf3a7637c6af8a8f0c1aa032735f5c0c3d
SSDEEP:	1536:6V2Ut39z3lvqL3bkxbOYbDrL6EkuLxx8VDxqMElj+/zsrQ1:6AwdlK3b8bLxxobbEg
TLSH:	0CE34F86BFA13FBFD81ECD320295DA06129C4A495399BF7B2B74D014F68B14A59D3C8C
File Content Preview:	.ELF....................`.@.4...h6......4. ...(...............@...@.p,..p,..............<0..<0C.<0C.................Q.td...............................'...................<...'!.............9'.. ........................<...'!... .........9'.. ............

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	145000
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Source: 7n8OwAD6b9.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5534.1.00007fdfec400000.00007fdfec423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 7n8OwAD6b9.elf PID: 5534, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x7c	0x0	0x6	AX	4
.text	PROGBITS	0x400110	0x110	0x20e60	0x0	0x6	AX	16
.fini	PROGBITS	0x420f70	0x20f70	0x4c	0x0	0x6	AX	4
.rodata	PROGBITS	0x420fc0	0x20fc0	0x1cb0	0x0	0x2	A	16
.ctors	PROGBITS	0x43303c	0x2303c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x433044	0x23044	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x433050	0x23050	0x6c	0x0	0x3	WA	4
.data	PROGBITS	0x4330bc	0x230bc	0xe0	0x0	0x3	WA	4
.got	PROGBITS	0x4331a0	0x231a0	0x464	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x433604	0x23604	0x1c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x433620	0x23604	0x824	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x288	0x23604	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x23604	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x22c70	0x22c70	4.8441	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x2303c	0x43303c	0x43303c	0x5c8	0xe08	4.7215	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 07:55:57.546696901 CEST	32827	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:55:57.731245995 CEST	53	32827	8.8.8.8	192.168.2.15
Apr 18, 2024 07:55:57.731579065 CEST	33003	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:55:57.947432041 CEST	53	33003	8.8.8.8	192.168.2.15
Apr 18, 2024 07:55:57.947623014 CEST	51046	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:55:58.144578934 CEST	53	51046	8.8.8.8	192.168.2.15
Apr 18, 2024 07:55:58.144757986 CEST	52196	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:55:58.347099066 CEST	53	52196	8.8.8.8	192.168.2.15
Apr 18, 2024 07:55:58.347261906 CEST	39452	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:55:58.544449091 CEST	53	39452	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:06.545301914 CEST	58795	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:06.742264986 CEST	53	58795	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:06.742423058 CEST	39381	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:06.964126110 CEST	53	39381	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:06.964284897 CEST	51315	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:07.177449942 CEST	53	51315	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:07.177634001 CEST	49225	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:07.362545013 CEST	53	49225	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:07.362723112 CEST	39218	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:07.546183109 CEST	53	39218	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:08.546540022 CEST	39415	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:08.729521036 CEST	53	39415	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:08.729662895 CEST	58081	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:08.942783117 CEST	53	58081	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:08.942907095 CEST	32856	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:09.126271963 CEST	53	32856	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:09.128739119 CEST	60972	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:09.354023933 CEST	53	60972	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:09.355809927 CEST	34082	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:09.552674055 CEST	53	34082	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:15.552907944 CEST	36208	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:15.736167908 CEST	53	36208	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:15.736326933 CEST	50407	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:15.932833910 CEST	53	50407	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:15.932971001 CEST	40539	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:16.115802050 CEST	53	40539	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:16.115926981 CEST	54803	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:16.299741983 CEST	53	54803	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:16.299865007 CEST	46868	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:16.496524096 CEST	53	46868	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:23.496639013 CEST	50338	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:23.679646969 CEST	53	50338	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:23.679804087 CEST	49803	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:23.881417990 CEST	53	49803	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:23.881587982 CEST	37259	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:24.110059977 CEST	53	37259	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:24.110232115 CEST	56728	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:24.293294907 CEST	53	56728	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:24.293437958 CEST	41289	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:24.489765882 CEST	53	41289	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:28.490246058 CEST	37953	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:28.712301970 CEST	53	37953	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:28.712563992 CEST	42005	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:28.938371897 CEST	53	42005	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:28.938637972 CEST	34433	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:29.135534048 CEST	53	34433	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:29.135713100 CEST	52039	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:29.332364082 CEST	53	52039	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:29.332542896 CEST	57216	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:29.515976906 CEST	53	57216	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:32.516346931 CEST	50041	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:32.717931986 CEST	53	50041	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:32.718127966 CEST	39363	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:32.943980932 CEST	53	39363	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:32.944268942 CEST	42193	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:33.127783060 CEST	53	42193	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:33.127942085 CEST	36488	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:33.311943054 CEST	53	36488	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:33.312144041 CEST	43947	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:33.509135962 CEST	53	43947	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:39.509454966 CEST	35627	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:39.694147110 CEST	53	35627	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:39.694433928 CEST	37457	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:39.878107071 CEST	53	37457	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:39.878524065 CEST	47007	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:40.074700117 CEST	53	47007	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:40.074964046 CEST	33100	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:40.258426905 CEST	53	33100	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:40.258698940 CEST	56487	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:40.442369938 CEST	53	56487	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:45.442670107 CEST	58696	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:45.626408100 CEST	53	58696	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:45.626605034 CEST	44664	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:45.859431982 CEST	53	44664	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:45.859623909 CEST	38624	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:46.043143034 CEST	53	38624	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:46.043322086 CEST	36830	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:46.257728100 CEST	53	36830	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:46.257872105 CEST	44681	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:46.476329088 CEST	53	44681	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:48.476597071 CEST	47469	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:48.679187059 CEST	53	47469	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:48.679457903 CEST	58178	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:48.882622957 CEST	53	58178	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:48.882796049 CEST	56888	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:49.079653025 CEST	53	56888	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:49.079850912 CEST	45568	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:49.265381098 CEST	53	45568	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:49.265563011 CEST	50420	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:49.449001074 CEST	53	50420	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:53.449495077 CEST	51209	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:53.683092117 CEST	53	51209	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:53.683417082 CEST	52170	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:53.867873907 CEST	53	52170	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:53.868096113 CEST	37401	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:54.089376926 CEST	53	37401	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:54.089608908 CEST	58458	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:54.273186922 CEST	53	58458	8.8.8.8	192.168.2.15
Apr 18, 2024 07:56:54.273559093 CEST	56685	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:56:54.470614910 CEST	53	56685	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:01.471102953 CEST	38105	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:02.384891033 CEST	53	38105	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:02.385087013 CEST	38780	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:02.592195034 CEST	53	38780	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:02.592506886 CEST	49292	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:02.789793015 CEST	53	49292	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:02.790178061 CEST	52457	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:02.982717991 CEST	53	52457	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:02.983006954 CEST	41431	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:03.387562037 CEST	53	41431	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:12.387900114 CEST	49540	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:12.571707964 CEST	53	49540	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:12.571943998 CEST	39539	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:12.756324053 CEST	53	39539	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:12.756700039 CEST	50314	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:12.940500021 CEST	53	50314	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:12.940713882 CEST	41304	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:13.125927925 CEST	53	41304	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:13.126245975 CEST	53151	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:13.310601950 CEST	53	53151	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:22.310730934 CEST	56788	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:22.523650885 CEST	53	56788	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:22.523925066 CEST	45627	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:22.720525026 CEST	53	45627	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:22.720767975 CEST	33568	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:22.904859066 CEST	53	33568	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:22.905045033 CEST	33648	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:23.101949930 CEST	53	33648	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:23.102118969 CEST	41032	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:23.304584980 CEST	53	41032	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:29.304872990 CEST	38686	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:29.525765896 CEST	53	38686	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:29.525944948 CEST	33674	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:29.709758997 CEST	53	33674	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:29.709898949 CEST	40296	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:29.912576914 CEST	53	40296	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:29.912934065 CEST	54139	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:30.097103119 CEST	53	54139	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:30.097361088 CEST	33093	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:30.281409025 CEST	53	33093	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:38.281702995 CEST	52211	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:38.465045929 CEST	53	52211	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:38.465400934 CEST	54389	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:38.649926901 CEST	53	54389	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:38.650170088 CEST	38198	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:38.834692001 CEST	53	38198	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:38.834878922 CEST	51078	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:39.018656969 CEST	53	51078	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:39.018846035 CEST	57026	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:39.204570055 CEST	53	57026	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:41.204972029 CEST	55366	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:41.389266014 CEST	53	55366	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:41.389452934 CEST	35516	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:41.576380968 CEST	53	35516	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:41.576567888 CEST	38119	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:41.760677099 CEST	53	38119	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:41.760864019 CEST	53062	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:41.951090097 CEST	53	53062	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:41.951304913 CEST	43338	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:42.134803057 CEST	53	43338	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:46.135135889 CEST	45944	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:46.347861052 CEST	53	45944	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:46.348164082 CEST	41989	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:46.563776016 CEST	53	41989	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:46.564160109 CEST	43084	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:46.748202085 CEST	53	43084	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:46.748449087 CEST	60392	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:46.944741964 CEST	53	60392	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:46.945027113 CEST	40463	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:47.146733046 CEST	53	40463	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:48.147144079 CEST	52677	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:48.330449104 CEST	53	52677	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:48.330693007 CEST	34358	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:48.514571905 CEST	53	34358	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:48.514863014 CEST	54020	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:48.698045969 CEST	53	54020	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:48.698302984 CEST	57072	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:48.881246090 CEST	53	57072	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:48.881609917 CEST	43585	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:49.065911055 CEST	53	43585	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:59.066219091 CEST	46099	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:59.250108957 CEST	53	46099	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:59.250420094 CEST	58767	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:59.445938110 CEST	53	58767	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:59.446194887 CEST	55025	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:59.648941994 CEST	53	55025	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:59.649317980 CEST	39195	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:57:59.851763010 CEST	53	39195	8.8.8.8	192.168.2.15
Apr 18, 2024 07:57:59.852051020 CEST	34861	53	192.168.2.15	8.8.8.8
Apr 18, 2024 07:58:00.035515070 CEST	53	34861	8.8.8.8	192.168.2.15

Start time (UTC):	05:55:56
Start date (UTC):	18/04/2024
Path:	/tmp/7n8OwAD6b9.elf
Arguments:	/tmp/7n8OwAD6b9.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 7n8OwAD6b9.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00YHhZ (deleted)

/tmp/qemu-open.00e0jY (deleted)

/tmp/qemu-open.07MLoW (deleted)

/tmp/qemu-open.08NpZW (deleted)

/tmp/qemu-open.09kzAZ (deleted)

/tmp/qemu-open.0LCr5W (deleted)

/tmp/qemu-open.0MtvuW (deleted)

/tmp/qemu-open.0N4DsW (deleted)

/tmp/qemu-open.0Ql9DZ (deleted)

/tmp/qemu-open.0Sr9zX (deleted)

/tmp/qemu-open.0fZ6mW (deleted)

/tmp/qemu-open.0fdlRY (deleted)

/tmp/qemu-open.0gZGPY (deleted)

/tmp/qemu-open.0hHewY (deleted)

/tmp/qemu-open.0iGNAX (deleted)

/tmp/qemu-open.0ioD0Y (deleted)

/tmp/qemu-open.0jt0AV (deleted)

/tmp/qemu-open.0l7vSY (deleted)

/tmp/qemu-open.0tQuhW (deleted)

/tmp/qemu-open.0xAglV (deleted)

/tmp/qemu-open.163CDY (deleted)

/tmp/qemu-open.1Ij9GW (deleted)

/tmp/qemu-open.1JmJ0Y (deleted)

/tmp/qemu-open.1KuduW (deleted)

/tmp/qemu-open.1LT2iZ (deleted)

/tmp/qemu-open.1Rv9FV (deleted)

/tmp/qemu-open.1S9P8U (deleted)

/tmp/qemu-open.1UbkBV (deleted)

/tmp/qemu-open.1V07DV (deleted)

/tmp/qemu-open.1XA6OY (deleted)

/tmp/qemu-open.1b8x4W (deleted)

/tmp/qemu-open.1bXlUV (deleted)

Linux Analysis Report
7n8OwAD6b9.elf