Edit tour

Linux Analysis Report
AXMdzuyn1m.elf

Overview

General Information

Sample name:	AXMdzuyn1m.elf renamed because original name is a hash value
Original sample name:	d16b61e028d33909019b5b7871e3e291.elf
Analysis ID:	1428200
MD5:	d16b61e028d33909019b5b7871e3e291
SHA1:	c0934180daae4b77ecac7704154c44b11ebaa196
SHA256:	cf9259b6a78642be0495d041bde41bec828b4429e09d316861e74e295deb670d
Tags:	32elfintelmirai
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for sample

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428200
Start date and time:	2024-04-18 16:35:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	AXMdzuyn1m.elf renamed because original name is a hash value
Original Sample Name:	d16b61e028d33909019b5b7871e3e291.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/0@18/0

Runtime Messages

Command:	/tmp/AXMdzuyn1m.elf
PID:	5525
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

AXMdzuyn1m.elf (PID: 5525, Parent: 5450, MD5: d16b61e028d33909019b5b7871e3e291) Arguments: /tmp/AXMdzuyn1m.elf

AXMdzuyn1m.elf New Fork (PID: 5526, Parent: 5525)

AXMdzuyn1m.elf New Fork (PID: 5527, Parent: 5526)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
AXMdzuyn1m.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
AXMdzuyn1m.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
AXMdzuyn1m.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf6b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf71c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf76c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf80c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
AXMdzuyn1m.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x32f0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
AXMdzuyn1m.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x8655:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
AXMdzuyn1m.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x4f62:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
AXMdzuyn1m.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xb628:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
AXMdzuyn1m.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x9ec9:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
AXMdzuyn1m.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x4f32:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5525.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5525.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5525.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf6b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf708:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf71c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf730:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf744:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf758:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf76c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf780:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf794:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf80c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf820:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf834:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf848:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5525.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x32f0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5525.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x8655:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
5525.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x4f62:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5525.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xb628:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5525.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x9ec9:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5525.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x4f32:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: AXMdzuyn1m.elf PID: 5525	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: AXMdzuyn1m.elf PID: 5525	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: AXMdzuyn1m.elf PID: 5525	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x90c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x95c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 7 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:37:39.484173
SID:	2030490
Source Port:	33562
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:37:01.721748
SID:	2030490
Source Port:	33550
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:37:05.711312
SID:	2030490
Source Port:	33552
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:35:48.607861
SID:	2030490
Source Port:	33530
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:37:31.486623
SID:	2030490
Source Port:	33560
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:37:49.511329
SID:	2030490
Source Port:	33564
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:36:27.126335
SID:	2030490
Source Port:	33542
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:36:24.137046
SID:	2030490
Source Port:	33540
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:36:54.744288
SID:	2030490
Source Port:	33548
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:37:27.579114
SID:	2030490
Source Port:	33558
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:36:11.201178
SID:	2030490
Source Port:	33536
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:36:19.109664
SID:	2030490
Source Port:	33538
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:36:45.852107
SID:	2030490
Source Port:	33546
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:37:09.688897
SID:	2030490
Source Port:	33554
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:37:16.718851
SID:	2030490
Source Port:	33556
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:35:53.526573
SID:	2030490
Source Port:	33532
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:36:02.347604
SID:	2030490
Source Port:	33534
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:36:39.027420
SID:	2030490
Source Port:	33544
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: AXMdzuyn1m.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: AXMdzuyn1m.elf

ReversingLabs: Detection: 65%

Machine Learning detection for sample

Source: AXMdzuyn1m.elf

Joe Sandbox ML: detected

Source: AXMdzuyn1m.elf

String: HTTP/1.1 200 OKbot.armbot.arm5bot.arm6bot.arm7bot.mipsbot.mpslbot.x86_64bot.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33530 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33532 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33534 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33536 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33538 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33540 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33542 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33544 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33546 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33548 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33550 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33552 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33554 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33556 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33558 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33560 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33562 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:33564 -> 103.167.88.226:43957

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 103.167.88.226 ports 43957,3,4,5,7,9

Source: global traffic

TCP traffic: 192.168.2.15:33530 -> 103.167.88.226:43957

Source: unknown

DNS traffic detected: queries for: bn.networkbn.click

System Summary

Malicious sample detected (through community Yara rule)

Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: AXMdzuyn1m.elf PID: 5525, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKbot.armbot.arm5bot.arm6bot.arm7bot.mipsbot.mpslbot.x86_64bot.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: ELF static info symbol of initial sample

.symtab present: no

Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: AXMdzuyn1m.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: AXMdzuyn1m.elf PID: 5525, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/0@18/0

Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/3682/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/AXMdzuyn1m.elf (PID: 5527)	File opened: /proc/270/cmdline	Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: AXMdzuyn1m.elf, type: SAMPLE
Source: Yara match	File source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AXMdzuyn1m.elf PID: 5525, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: AXMdzuyn1m.elf, type: SAMPLE
Source: Yara match	File source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AXMdzuyn1m.elf PID: 5525, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Yara detected Mirai

Source: Yara match	File source: AXMdzuyn1m.elf, type: SAMPLE
Source: Yara match	File source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AXMdzuyn1m.elf PID: 5525, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: AXMdzuyn1m.elf, type: SAMPLE
Source: Yara match	File source: 5525.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AXMdzuyn1m.elf PID: 5525, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label
AXMdzuyn1m.elf	66%	ReversingLabs	Linux.Trojan.Mirai
AXMdzuyn1m.elf	100%	Avira	EXP/ELF.Mirai.Z.A
AXMdzuyn1m.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bn.networkbn.click	103.167.88.226	true	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.167.88.226	bn.networkbn.click	unknown		7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.167.88.226	c1N1s54Xz4.elf	Get hash	malicious	Mirai, Okiru	Browse
	sNUnKpshtR.elf	Get hash	malicious	Mirai, Okiru	Browse
	c3S6vyQXOw.elf	Get hash	malicious	Mirai, Okiru	Browse
	MQ9rEJYn2l.elf	Get hash	malicious	Mirai, Okiru	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bn.networkbn.click	c1N1s54Xz4.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	sNUnKpshtR.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	c3S6vyQXOw.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	MQ9rEJYn2l.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	n7h2Ze4ezf.elf	Get hash	malicious	Mirai	Browse	103.237.86.195
	bot.x86-20240414-2238.elf	Get hash	malicious	Mirai	Browse	103.237.86.195
	bot.x86_64-20240413-0230.elf	Get hash	malicious	Mirai	Browse	103.237.86.195
	bot.arm-20240413-0230.elf	Get hash	malicious	Mirai	Browse	103.237.86.195
	bot.x86-20240413-0230.elf	Get hash	malicious	Mirai	Browse	103.237.86.195
	bot.arm7-20240413-0230.elf	Get hash	malicious	Mirai	Browse	103.237.86.195

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	c1N1s54Xz4.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	sNUnKpshtR.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	c3S6vyQXOw.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	MQ9rEJYn2l.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	E3kpuuuOfy.elf	Get hash	malicious	Mirai	Browse	130.56.210.55
	Yui1pUgieI.elf	Get hash	malicious	Mirai	Browse	203.1.230.101
	QXeoSsX87R.elf	Get hash	malicious	Gafgyt, Mirai	Browse	139.230.83.226
	https://site24x7.com	Get hash	malicious	Unknown	Browse	103.163.152.67
	QFR4Qsnm6y.elf	Get hash	malicious	Mirai	Browse	150.203.66.12
	0Ox8zezLAz.elf	Get hash	malicious	Mirai	Browse	103.190.121.35

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.71210358456968
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	AXMdzuyn1m.elf
File size:	89'544 bytes
MD5:	d16b61e028d33909019b5b7871e3e291
SHA1:	c0934180daae4b77ecac7704154c44b11ebaa196
SHA256:	cf9259b6a78642be0495d041bde41bec828b4429e09d316861e74e295deb670d
SHA512:	47844ed2033a82cf95d31fcd88ec3e3f43b0f6b545e0a67bf68d221b56094f38bc967864a92ac960b20a6c94878c706f4fa1a034d702cd437b9f42d3c8452d2d
SSDEEP:	1536:0pG2cWAcCghsZcecJmR8TbDCFms8CasdPIYWdgtaEoSGtA6u0xZ:0pG3WrCEjecCIbDC0ls9ZWCt718u0x
TLSH:	01937DD1F743D4F5E89705B1513AAB335B33F0B92019EA43C7795A32EC92510DA1ABAC
File Content Preview:	.ELF....................d...4...8\......4. ...(.....................p...p...............t...t...t....G..8...........Q.td............................U..S........#...h........[]...$.............U......=.....t..5...................u........t....hp...........

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	89144
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xf136	0x0	0x6	AX	16
.fini	PROGBITS	0x80571e6	0xf1e6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8057200	0xf200	0x2270	0x0	0x2	A	32
.ctors	PROGBITS	0x805a474	0x11474	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x805a480	0x11480	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805a4a0	0x114a0	0x4758	0x0	0x3	WA	32
.bss	NOBITS	0x805ec00	0x15bf8	0x49ac	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x15bf8	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x11470	0x11470	6.5863	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x11474	0x805a474	0x805a474	0x4784	0x9138	0.3652	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/18/24-16:37:39.484173	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33562	43957	192.168.2.15	103.167.88.226
04/18/24-16:37:01.721748	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33550	43957	192.168.2.15	103.167.88.226
04/18/24-16:37:05.711312	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33552	43957	192.168.2.15	103.167.88.226
04/18/24-16:35:48.607861	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33530	43957	192.168.2.15	103.167.88.226
04/18/24-16:37:31.486623	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33560	43957	192.168.2.15	103.167.88.226
04/18/24-16:37:49.511329	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33564	43957	192.168.2.15	103.167.88.226
04/18/24-16:36:27.126335	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33542	43957	192.168.2.15	103.167.88.226
04/18/24-16:36:24.137046	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33540	43957	192.168.2.15	103.167.88.226
04/18/24-16:36:54.744288	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33548	43957	192.168.2.15	103.167.88.226
04/18/24-16:37:27.579114	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33558	43957	192.168.2.15	103.167.88.226
04/18/24-16:36:11.201178	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33536	43957	192.168.2.15	103.167.88.226
04/18/24-16:36:19.109664	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33538	43957	192.168.2.15	103.167.88.226
04/18/24-16:36:45.852107	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33546	43957	192.168.2.15	103.167.88.226
04/18/24-16:37:09.688897	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33554	43957	192.168.2.15	103.167.88.226
04/18/24-16:37:16.718851	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33556	43957	192.168.2.15	103.167.88.226
04/18/24-16:35:53.526573	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33532	43957	192.168.2.15	103.167.88.226
04/18/24-16:36:02.347604	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33534	43957	192.168.2.15	103.167.88.226
04/18/24-16:36:39.027420	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	33544	43957	192.168.2.15	103.167.88.226

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 16:35:48.182207108 CEST	33530	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:35:48.607693911 CEST	43957	33530	103.167.88.226	192.168.2.15
Apr 18, 2024 16:35:48.607774019 CEST	33530	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:35:48.607861042 CEST	33530	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:35:49.042494059 CEST	43957	33530	103.167.88.226	192.168.2.15
Apr 18, 2024 16:35:49.042522907 CEST	43957	33530	103.167.88.226	192.168.2.15
Apr 18, 2024 16:35:53.147567034 CEST	33532	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:35:53.526393890 CEST	43957	33532	103.167.88.226	192.168.2.15
Apr 18, 2024 16:35:53.526509047 CEST	33532	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:35:53.526572943 CEST	33532	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:35:53.889705896 CEST	43957	33532	103.167.88.226	192.168.2.15
Apr 18, 2024 16:35:53.889777899 CEST	43957	33532	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:01.994879007 CEST	33534	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:02.347373009 CEST	43957	33534	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:02.347604036 CEST	33534	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:02.347604036 CEST	33534	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:02.717062950 CEST	43957	33534	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:02.717118025 CEST	43957	33534	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:10.828335047 CEST	33536	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:11.200988054 CEST	43957	33536	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:11.201131105 CEST	33536	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:11.201178074 CEST	33536	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:11.579168081 CEST	43957	33536	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:11.579288006 CEST	43957	33536	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:18.684935093 CEST	33538	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:19.109513044 CEST	43957	33538	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:19.109632015 CEST	33538	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:19.109663963 CEST	33538	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:20.174789906 CEST	33538	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:20.604146957 CEST	43957	33538	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:23.709425926 CEST	33540	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:24.136907101 CEST	43957	33540	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:24.137046099 CEST	33540	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:24.137046099 CEST	33540	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:24.560703993 CEST	43957	33540	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:24.560750008 CEST	43957	33540	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:26.665925026 CEST	33542	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:27.126137972 CEST	43957	33542	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:27.126334906 CEST	33542	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:27.126334906 CEST	33542	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:27.564471006 CEST	43957	33542	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:27.564538002 CEST	43957	33542	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:37.669565916 CEST	33544	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:38.670332909 CEST	33544	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:39.027101994 CEST	43957	33544	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:39.027271986 CEST	33544	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:39.027420044 CEST	33544	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:39.385977030 CEST	43957	33544	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:39.386039019 CEST	43957	33544	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:45.491728067 CEST	33546	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:45.851913929 CEST	43957	33546	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:45.852066040 CEST	33546	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:45.852107048 CEST	33546	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:46.213869095 CEST	43957	33546	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:46.213907957 CEST	43957	33546	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:54.319211960 CEST	33548	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:54.744052887 CEST	43957	33548	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:54.744246960 CEST	33548	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:54.744287968 CEST	33548	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:36:55.187484026 CEST	43957	33548	103.167.88.226	192.168.2.15
Apr 18, 2024 16:36:55.187517881 CEST	43957	33548	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:01.292934895 CEST	33550	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:01.721579075 CEST	43957	33550	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:01.721723080 CEST	33550	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:01.721748114 CEST	33550	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:02.156703949 CEST	43957	33550	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:02.156742096 CEST	43957	33550	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:05.266779900 CEST	33552	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:05.711009979 CEST	43957	33552	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:05.711208105 CEST	33552	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:05.711312056 CEST	33552	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:06.150456905 CEST	43957	33552	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:06.150515079 CEST	43957	33552	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:09.255791903 CEST	33554	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:09.688724041 CEST	43957	33554	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:09.688896894 CEST	33554	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:09.688896894 CEST	33554	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:10.765486002 CEST	33554	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:11.061028957 CEST	43957	33554	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:11.061176062 CEST	33554	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:11.213140965 CEST	43957	33554	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:11.213269949 CEST	43957	33554	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:11.503696918 CEST	43957	33554	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:16.318433046 CEST	33556	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:16.718693972 CEST	43957	33556	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:16.718851089 CEST	33556	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:16.718851089 CEST	33556	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:17.111248016 CEST	43957	33556	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:17.111685038 CEST	43957	33556	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:27.217567921 CEST	33558	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:27.578875065 CEST	43957	33558	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:27.579113960 CEST	33558	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:27.579113960 CEST	33558	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:27.943237066 CEST	43957	33558	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:27.943274975 CEST	43957	33558	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:31.048315048 CEST	33560	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:31.486430883 CEST	43957	33560	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:31.486622095 CEST	33560	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:31.486623049 CEST	33560	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:31.925765038 CEST	43957	33560	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:31.925813913 CEST	43957	33560	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:39.031058073 CEST	33562	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:39.483891964 CEST	43957	33562	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:39.484172106 CEST	33562	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:39.484173059 CEST	33562	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:39.943006039 CEST	43957	33562	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:39.943041086 CEST	43957	33562	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:39.943191051 CEST	33562	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:40.347959995 CEST	43957	33562	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:49.051767111 CEST	33564	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:49.511073112 CEST	43957	33564	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:49.511291981 CEST	33564	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:49.511328936 CEST	33564	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:49.972042084 CEST	43957	33564	103.167.88.226	192.168.2.15
Apr 18, 2024 16:37:49.972302914 CEST	33564	43957	192.168.2.15	103.167.88.226
Apr 18, 2024 16:37:50.424722910 CEST	43957	33564	103.167.88.226	192.168.2.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 16:35:48.077099085 CEST	44487	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:35:48.181955099 CEST	53	44487	8.8.8.8	192.168.2.15
Apr 18, 2024 16:35:53.042655945 CEST	60307	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:35:53.147423029 CEST	53	60307	8.8.8.8	192.168.2.15
Apr 18, 2024 16:36:01.889796019 CEST	48786	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:36:01.994743109 CEST	53	48786	8.8.8.8	192.168.2.15
Apr 18, 2024 16:36:10.717256069 CEST	54933	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:36:10.828149080 CEST	53	54933	8.8.8.8	192.168.2.15
Apr 18, 2024 16:36:18.579579115 CEST	57171	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:36:18.684766054 CEST	53	57171	8.8.8.8	192.168.2.15
Apr 18, 2024 16:36:23.604475021 CEST	38134	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:36:23.709283113 CEST	53	38134	8.8.8.8	192.168.2.15
Apr 18, 2024 16:36:26.560929060 CEST	49229	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:36:26.665787935 CEST	53	49229	8.8.8.8	192.168.2.15
Apr 18, 2024 16:36:37.564544916 CEST	48818	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:36:37.669404030 CEST	53	48818	8.8.8.8	192.168.2.15
Apr 18, 2024 16:36:45.386246920 CEST	45801	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:36:45.491558075 CEST	53	45801	8.8.8.8	192.168.2.15
Apr 18, 2024 16:36:54.213977098 CEST	41962	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:36:54.319050074 CEST	53	41962	8.8.8.8	192.168.2.15
Apr 18, 2024 16:37:01.187628984 CEST	59222	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:37:01.292706013 CEST	53	59222	8.8.8.8	192.168.2.15
Apr 18, 2024 16:37:05.156951904 CEST	51031	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:37:05.266602039 CEST	53	51031	8.8.8.8	192.168.2.15
Apr 18, 2024 16:37:09.150681019 CEST	53122	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:37:09.255547047 CEST	53	53122	8.8.8.8	192.168.2.15
Apr 18, 2024 16:37:16.213510036 CEST	35863	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:37:16.318264961 CEST	53	35863	8.8.8.8	192.168.2.15
Apr 18, 2024 16:37:27.111752987 CEST	37312	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:37:27.217215061 CEST	53	37312	8.8.8.8	192.168.2.15
Apr 18, 2024 16:37:30.943542004 CEST	46872	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:37:31.048120975 CEST	53	46872	8.8.8.8	192.168.2.15
Apr 18, 2024 16:37:38.926023006 CEST	42011	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:37:39.030611992 CEST	53	42011	8.8.8.8	192.168.2.15
Apr 18, 2024 16:37:48.943224907 CEST	46973	53	192.168.2.15	8.8.8.8
Apr 18, 2024 16:37:49.051467896 CEST	53	46973	8.8.8.8	192.168.2.15

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 18, 2024 16:35:48.077099085 CEST	192.168.2.15	8.8.8.8	0x52cf	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:35:53.042655945 CEST	192.168.2.15	8.8.8.8	0xf4dc	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:01.889796019 CEST	192.168.2.15	8.8.8.8	0x47ec	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:10.717256069 CEST	192.168.2.15	8.8.8.8	0x8a34	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:18.579579115 CEST	192.168.2.15	8.8.8.8	0xaa79	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:23.604475021 CEST	192.168.2.15	8.8.8.8	0xef0d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:26.560929060 CEST	192.168.2.15	8.8.8.8	0x2b53	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:37.564544916 CEST	192.168.2.15	8.8.8.8	0x6f3f	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:45.386246920 CEST	192.168.2.15	8.8.8.8	0xc42	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:54.213977098 CEST	192.168.2.15	8.8.8.8	0x83a7	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:01.187628984 CEST	192.168.2.15	8.8.8.8	0x231c	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:05.156951904 CEST	192.168.2.15	8.8.8.8	0x796a	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:09.150681019 CEST	192.168.2.15	8.8.8.8	0x3c2	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:16.213510036 CEST	192.168.2.15	8.8.8.8	0xa9f0	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:27.111752987 CEST	192.168.2.15	8.8.8.8	0xb791	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:30.943542004 CEST	192.168.2.15	8.8.8.8	0xd8f2	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:38.926023006 CEST	192.168.2.15	8.8.8.8	0xd28	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:48.943224907 CEST	192.168.2.15	8.8.8.8	0x4928	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 18, 2024 16:35:48.181955099 CEST	8.8.8.8	192.168.2.15	0x52cf	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:35:53.147423029 CEST	8.8.8.8	192.168.2.15	0xf4dc	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:01.994743109 CEST	8.8.8.8	192.168.2.15	0x47ec	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:10.828149080 CEST	8.8.8.8	192.168.2.15	0x8a34	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:18.684766054 CEST	8.8.8.8	192.168.2.15	0xaa79	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:23.709283113 CEST	8.8.8.8	192.168.2.15	0xef0d	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:26.665787935 CEST	8.8.8.8	192.168.2.15	0x2b53	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:37.669404030 CEST	8.8.8.8	192.168.2.15	0x6f3f	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:45.491558075 CEST	8.8.8.8	192.168.2.15	0xc42	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:36:54.319050074 CEST	8.8.8.8	192.168.2.15	0x83a7	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:01.292706013 CEST	8.8.8.8	192.168.2.15	0x231c	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:05.266602039 CEST	8.8.8.8	192.168.2.15	0x796a	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:09.255547047 CEST	8.8.8.8	192.168.2.15	0x3c2	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:16.318264961 CEST	8.8.8.8	192.168.2.15	0xa9f0	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:27.217215061 CEST	8.8.8.8	192.168.2.15	0xb791	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:31.048120975 CEST	8.8.8.8	192.168.2.15	0xd8f2	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:39.030611992 CEST	8.8.8.8	192.168.2.15	0xd28	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false
Apr 18, 2024 16:37:49.051467896 CEST	8.8.8.8	192.168.2.15	0x4928	No error (0)	bn.networkbn.click	103.167.88.226	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: AXMdzuyn1m.elf PID: 5525, Parent PID: 5450

General

Start time (UTC):	14:35:46
Start date (UTC):	18/04/2024
Path:	/tmp/AXMdzuyn1m.elf
Arguments:	/tmp/AXMdzuyn1m.elf
File size:	89544 bytes
MD5 hash:	d16b61e028d33909019b5b7871e3e291

Start time (UTC):	14:35:46
Start date (UTC):	18/04/2024
Path:	/tmp/AXMdzuyn1m.elf
Arguments:	-
File size:	89544 bytes
MD5 hash:	d16b61e028d33909019b5b7871e3e291

Start time (UTC):	14:35:46
Start date (UTC):	18/04/2024
Path:	/tmp/AXMdzuyn1m.elf
Arguments:	-
File size:	89544 bytes
MD5 hash:	d16b61e028d33909019b5b7871e3e291

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report AXMdzuyn1m.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: AXMdzuyn1m.elf PID: 5525, Parent PID: 5450

General

Chronological Activities

Analysis Process: AXMdzuyn1m.elf PID: 5526, Parent PID: 5525

General

Chronological Activities

Analysis Process: AXMdzuyn1m.elf PID: 5527, Parent PID: 5526

General

Chronological Activities

Linux Analysis Report
AXMdzuyn1m.elf