Edit tour

Linux Analysis Report
t6t7sqwfzY.elf

Overview

General Information

Sample name:	t6t7sqwfzY.elf renamed because original name is a hash value
Original sample name:	4a7ca8c328cb568cef9f3e2ab48d30b1.elf
Analysis ID:	1427806
MD5:	4a7ca8c328cb568cef9f3e2ab48d30b1
SHA1:	39c215d038997c8cc7f0f1cf8eef1cea30beee9c
SHA256:	4164c7efaf18295255b8953b67a0cdb82a5add0134d1fc42e2fe3ebe14e16cf6
Tags:	32elfmiraipowerpc
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427806
Start date and time:	2024-04-18 07:55:42 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	t6t7sqwfzY.elf renamed because original name is a hash value
Original Sample Name:	4a7ca8c328cb568cef9f3e2ab48d30b1.elf
Detection:	MAL
Classification:	mal56.linELF@0/1025@105/0

Runtime Messages

Command:	/tmp/t6t7sqwfzY.elf
PID:	5433
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

t6t7sqwfzY.elf (PID: 5433, Parent: 5355, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/t6t7sqwfzY.elf

t6t7sqwfzY.elf New Fork (PID: 5435, Parent: 5433)

t6t7sqwfzY.elf New Fork (PID: 5437, Parent: 5435)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
t6t7sqwfzY.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x103c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1044c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1049c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10500:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10514:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10528:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1053c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10550:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5433.1.00007f6458001000.00007f6458013000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x103c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1044c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1049c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10500:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10514:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10528:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1053c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10550:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: t6t7sqwfzY.elf PID: 5433	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4c9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cfe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4db2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4dc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4dda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4dee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//var/Condi

Source: t6t7sqwfzY.elf	ReversingLabs: Detection: 42%
Source: t6t7sqwfzY.elf	Virustotal: Detection: 48%			Perma Link

Source: t6t7sqwfzY.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5433.1.00007f6458001000.00007f6458013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: t6t7sqwfzY.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//var/Condi

Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/4055/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/5379/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/5272/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/3646/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/t6t7sqwfzY.elf (PID: 5437)	File opened: /proc/936/cmdline	Jump to behavior

Source: t6t7sqwfzY.elf, 5433.1.00007ffe5b917000.00007ffe5b938000.rw-.sdmp	Binary or memory string: zx86_64/usr/bin/qemu-ppc/tmp/t6t7sqwfzY.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/t6t7sqwfzY.elf
Source: t6t7sqwfzY.elf, 5433.1.0000562293cdc000.0000562293d8c000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: t6t7sqwfzY.elf, 5433.1.0000562293cdc000.0000562293d8c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: t6t7sqwfzY.elf, 5433.1.00007ffe5b917000.00007ffe5b938000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Source	Detection	Scanner	Label	Link
t6t7sqwfzY.elf	42%	ReversingLabs	Linux.Trojan.Mirai
t6t7sqwfzY.elf	48%	Virustotal		Browse

Process:	/tmp/t6t7sqwfzY.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.8841837197791884
Encrypted:	false
SSDEEP:	3:Tg10cUw5:Tg2zC
MD5:	D7937F0AED2FCAABEA66E8BA2A922CF5
SHA1:	E39D38B1C8430A407C09F0DFBBFA961C02A0BB10
SHA-256:	122A2CD108FC571FEFFCA91E1A1BEF68232121B871F15C83C3BD91474E0AB949
SHA-512:	6E015FA834335022C20210D94C7EC8EDD9DD7655AECF747E63558D5CA950E58BE2511C72468467D6C3C637A6387F806E60A9F7308C82BF73753DA3044CEF184D
Malicious:	false
Reputation:	low
Preview:	/tmp/t6t7sqwfzY.elf.

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.267254624849859
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	t6t7sqwfzY.elf
File size:	74'644 bytes
MD5:	4a7ca8c328cb568cef9f3e2ab48d30b1
SHA1:	39c215d038997c8cc7f0f1cf8eef1cea30beee9c
SHA256:	4164c7efaf18295255b8953b67a0cdb82a5add0134d1fc42e2fe3ebe14e16cf6
SHA512:	18ec4e6b41a857c852e3aef2f8ac475c56eb7b832c16a994b52f8ffc1b280a788ef0b48e8b09552a4b25474a2a2be10ddaf14fe2cf062ecf6d9e15abdb5dde2d
SSDEEP:	1536:kvqIc6JbBfK84owQftDxCyukp5YmULHIrznrzq:tEi0wUvrzq
TLSH:	CC732801B7190A5BE0E31DB03B3F6FE197AA9EC221E47149395FBB819671E321446ECD
File Content Preview:	.ELF...........................4..!......4. ...(.......................................... p.. p.. p................dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.........!...../...@..`= ..;. ......+../...A..$8...}).....

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f8
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	74164
Section Header Size:	40
Number of Section Headers:	12
Header String Table Index:	11

Source: t6t7sqwfzY.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5433.1.00007f6458001000.00007f6458013000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: t6t7sqwfzY.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0xfe28	0x0	0x6	AX	4
.fini	PROGBITS	0x1000fee0	0xfee0	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1000ff00	0xff00	0x1be0	0x0	0x2	A	8
.ctors	PROGBITS	0x10022070	0x12070	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x10022078	0x12078	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x10022084	0x12084	0xd0	0x0	0x3	WA	4
.sdata	PROGBITS	0x10022154	0x12154	0x14	0x0	0x3	WA	4
.sbss	NOBITS	0x10022168	0x12168	0x48	0x0	0x3	WA	4
.bss	NOBITS	0x100221b0	0x12168	0x794	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x12168	0x4b	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x11ae0	0x11ae0	6.3601	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x12070	0x10022070	0x10022070	0xf8	0x8d4	4.0372	0x6	RW	0x10000	.ctors .dtors .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 07:56:25.250406027 CEST	59055	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:25.447434902 CEST	53	59055	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:25.447750092 CEST	40246	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:25.630511045 CEST	53	40246	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:25.630633116 CEST	38051	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:25.814080000 CEST	53	38051	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:25.814187050 CEST	43878	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:26.010956049 CEST	53	43878	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:26.011065006 CEST	46851	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:26.193804979 CEST	53	46851	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:29.194509983 CEST	50779	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:29.377635002 CEST	53	50779	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:29.381356955 CEST	37739	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:29.564776897 CEST	53	37739	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:29.564914942 CEST	57120	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:29.747876883 CEST	53	57120	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:29.747997999 CEST	53278	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:29.931153059 CEST	53	53278	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:29.931269884 CEST	56922	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:30.114352942 CEST	53	56922	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:32.114598036 CEST	38045	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:32.298527002 CEST	53	38045	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:32.298674107 CEST	49467	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:32.482332945 CEST	53	49467	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:32.482454062 CEST	55706	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:32.669482946 CEST	53	55706	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:32.669605017 CEST	49666	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:32.895258904 CEST	53	49666	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:32.895709038 CEST	43839	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:33.079247952 CEST	53	43839	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:37.079812050 CEST	34370	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:37.282450914 CEST	53	34370	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:37.282675028 CEST	44962	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:37.466238022 CEST	53	44962	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:37.466571093 CEST	60716	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:37.683012962 CEST	53	60716	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:37.683171988 CEST	52862	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:37.874075890 CEST	53	52862	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:37.874241114 CEST	43565	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:38.060611010 CEST	53	43565	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:46.060950994 CEST	44362	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:46.257582903 CEST	53	44362	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:46.257735014 CEST	55059	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:46.456335068 CEST	53	55059	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:46.456485033 CEST	57436	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:46.639974117 CEST	53	57436	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:46.640163898 CEST	36259	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:46.837361097 CEST	53	36259	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:46.837541103 CEST	57985	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:47.021190882 CEST	53	57985	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:53.021585941 CEST	35887	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:53.205130100 CEST	53	35887	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:53.205383062 CEST	60612	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:53.388947964 CEST	53	60612	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:53.389126062 CEST	48338	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:53.572969913 CEST	53	48338	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:53.573143005 CEST	55810	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:53.756755114 CEST	53	55810	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:53.756941080 CEST	33849	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:53.940743923 CEST	53	33849	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:56.941396952 CEST	35818	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:57.175813913 CEST	53	35818	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:57.176151037 CEST	52444	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:57.360189915 CEST	53	52444	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:57.360630035 CEST	36387	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:57.545058966 CEST	53	36387	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:57.545289993 CEST	51103	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:57.729687929 CEST	53	51103	8.8.8.8	192.168.2.13
Apr 18, 2024 07:56:57.730043888 CEST	33557	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:56:57.913309097 CEST	53	33557	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:03.913811922 CEST	41219	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:04.192212105 CEST	53	41219	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:04.192893028 CEST	53449	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:04.420348883 CEST	53	53449	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:04.420587063 CEST	49166	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:04.623428106 CEST	53	49166	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:04.623661995 CEST	42246	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:05.079822063 CEST	53	42246	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:05.080127001 CEST	56551	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:05.614497900 CEST	53	56551	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:14.615087986 CEST	50997	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:14.799536943 CEST	53	50997	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:14.799854040 CEST	52831	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:14.983760118 CEST	53	52831	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:14.983959913 CEST	42438	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:15.229223967 CEST	53	42438	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:15.229542971 CEST	55369	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:15.426862001 CEST	53	55369	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:15.427165031 CEST	35959	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:15.625771999 CEST	53	35959	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:19.626348972 CEST	43459	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:19.828723907 CEST	53	43459	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:19.829030037 CEST	50343	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:20.012659073 CEST	53	50343	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:20.013042927 CEST	41577	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:20.209872007 CEST	53	41577	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:20.210192919 CEST	57560	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:20.394468069 CEST	53	57560	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:20.394958019 CEST	43904	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:20.609671116 CEST	53	43904	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:28.610121965 CEST	55563	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:28.813450098 CEST	53	55563	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:28.813838005 CEST	36230	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:29.010292053 CEST	53	36230	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:29.010710001 CEST	40267	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:29.237740993 CEST	53	40267	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:29.238109112 CEST	53293	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:29.435615063 CEST	53	53293	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:29.435986996 CEST	40650	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:29.638312101 CEST	53	40650	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:39.639127016 CEST	56839	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:39.823096991 CEST	53	56839	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:39.823488951 CEST	42005	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:40.037235975 CEST	53	42005	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:40.037647963 CEST	35897	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:40.233933926 CEST	53	35897	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:40.234376907 CEST	60958	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:40.418138981 CEST	53	60958	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:40.418519020 CEST	46723	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:40.645806074 CEST	53	46723	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:41.646528959 CEST	48087	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:41.830344915 CEST	53	48087	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:41.830749989 CEST	34907	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:42.027453899 CEST	53	34907	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:42.028019905 CEST	45711	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:42.225117922 CEST	53	45711	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:42.225507021 CEST	58313	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:42.439730883 CEST	53	58313	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:42.440136909 CEST	45151	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:42.624222994 CEST	53	45151	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:47.624878883 CEST	40986	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:47.821105003 CEST	53	40986	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:47.821290970 CEST	51663	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:48.048329115 CEST	53	51663	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:48.048562050 CEST	53277	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:48.262363911 CEST	53	53277	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:48.262583017 CEST	54494	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:48.446420908 CEST	53	54494	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:48.446615934 CEST	33264	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:48.630038977 CEST	53	33264	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:50.630542994 CEST	55043	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:50.816061020 CEST	53	55043	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:50.816346884 CEST	45571	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:51.031439066 CEST	53	45571	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:51.031680107 CEST	54834	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:51.214936972 CEST	53	54834	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:51.215136051 CEST	50374	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:51.399148941 CEST	53	50374	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:51.399457932 CEST	35009	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:51.582860947 CEST	53	35009	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:52.583249092 CEST	47088	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:52.767532110 CEST	53	47088	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:52.767968893 CEST	46926	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:52.951987982 CEST	53	46926	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:52.952342987 CEST	42467	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:53.136493921 CEST	53	42467	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:53.136950016 CEST	47446	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:53.321746111 CEST	53	47446	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:53.322124004 CEST	42699	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:53.519159079 CEST	53	42699	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:57.519802094 CEST	35654	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:57.703344107 CEST	53	35654	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:57.703556061 CEST	41553	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:57.887362957 CEST	53	41553	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:57.887526035 CEST	37080	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:58.070319891 CEST	53	37080	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:58.070614100 CEST	50963	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:58.285552025 CEST	53	50963	8.8.8.8	192.168.2.13
Apr 18, 2024 07:57:58.285828114 CEST	47391	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:57:58.482836962 CEST	53	47391	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:06.483541012 CEST	58939	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:06.674344063 CEST	53	58939	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:06.674738884 CEST	35790	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:06.871339083 CEST	53	35790	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:06.871706009 CEST	43077	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:07.068675995 CEST	53	43077	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:07.068912983 CEST	36419	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:07.265440941 CEST	53	36419	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:07.265752077 CEST	34571	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:07.449177027 CEST	53	34571	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:11.449815989 CEST	56945	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:11.634093046 CEST	53	56945	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:11.634268045 CEST	49706	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:11.837126970 CEST	53	49706	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:11.837300062 CEST	49264	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:12.020296097 CEST	53	49264	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:12.020561934 CEST	60042	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:12.204190969 CEST	53	60042	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:12.204459906 CEST	57919	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:12.387594938 CEST	53	57919	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:21.388169050 CEST	58396	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:21.571336031 CEST	53	58396	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:21.571646929 CEST	56087	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:21.768348932 CEST	53	56087	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:21.768589020 CEST	58400	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:21.972220898 CEST	53	58400	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:21.972764969 CEST	49595	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:22.170798063 CEST	53	49595	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:22.171257019 CEST	58419	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:22.362328053 CEST	53	58419	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:23.362998962 CEST	41091	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:23.546624899 CEST	53	41091	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:23.547014952 CEST	37131	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:23.763144016 CEST	53	37131	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:23.763756990 CEST	48022	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:23.947978973 CEST	53	48022	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:23.948367119 CEST	43627	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:25.166219950 CEST	53	43627	8.8.8.8	192.168.2.13
Apr 18, 2024 07:58:25.166526079 CEST	55743	53	192.168.2.13	8.8.8.8
Apr 18, 2024 07:58:25.370663881 CEST	53	55743	8.8.8.8	192.168.2.13

Start time (UTC):	05:56:23
Start date (UTC):	18/04/2024
Path:	/tmp/t6t7sqwfzY.elf
Arguments:	/tmp/t6t7sqwfzY.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	05:56:24
Start date (UTC):	18/04/2024
Path:	/tmp/t6t7sqwfzY.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report t6t7sqwfzY.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00fhml (deleted)

/tmp/qemu-open.08lnLi (deleted)

/tmp/qemu-open.0ABnlj (deleted)

/tmp/qemu-open.0EWeGl (deleted)

/tmp/qemu-open.0Ha29l (deleted)

/tmp/qemu-open.0KrWdi (deleted)

/tmp/qemu-open.0XFz9j (deleted)

/tmp/qemu-open.0YpSEj (deleted)

/tmp/qemu-open.0gYiqk (deleted)

/tmp/qemu-open.0lY5zi (deleted)

/tmp/qemu-open.0lfNol (deleted)

/tmp/qemu-open.0mlYDk (deleted)

/tmp/qemu-open.0paNKl (deleted)

/tmp/qemu-open.0sBbLl (deleted)

/tmp/qemu-open.0x0qhm (deleted)

/tmp/qemu-open.13zg9i (deleted)

/tmp/qemu-open.17E3Ll (deleted)

/tmp/qemu-open.1AG91k (deleted)

/tmp/qemu-open.1ComPk (deleted)

/tmp/qemu-open.1F1rDj (deleted)

/tmp/qemu-open.1FFbyj (deleted)

/tmp/qemu-open.1GiFqk (deleted)

/tmp/qemu-open.1MMcGh (deleted)

/tmp/qemu-open.1Rf7wl (deleted)

/tmp/qemu-open.1RySRj (deleted)

/tmp/qemu-open.1UH07k (deleted)

/tmp/qemu-open.1Vseqi (deleted)

/tmp/qemu-open.1WzUpl (deleted)

/tmp/qemu-open.1de1Mj (deleted)

/tmp/qemu-open.1ea6ti (deleted)

/tmp/qemu-open.1fGFNj (deleted)

/tmp/qemu-open.1hCp1k (deleted)

/tmp/qemu-open.1sJ0tj (deleted)

/tmp/qemu-open.1v9dPl (deleted)

Linux Analysis Report
t6t7sqwfzY.elf