Edit tour

Linux Analysis Report
Y83sPRpb9c.elf

Overview

General Information

Sample name:	Y83sPRpb9c.elf renamed because original name is a hash value
Original sample name:	4060d4b7321a31242757a9e10a5ca477.elf
Analysis ID:	1428201
MD5:	4060d4b7321a31242757a9e10a5ca477
SHA1:	a7c6b9af470151804da1f84b3ac4fc401928e03c
SHA256:	136415a68341ba2706982ecd53af6531d5fe2bead73f5f6c42cd66f08a28327a
Tags:	32elfmipsmirai
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428201
Start date and time:	2024-04-18 16:38:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Y83sPRpb9c.elf renamed because original name is a hash value
Original Sample Name:	4060d4b7321a31242757a9e10a5ca477.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@21/0

Runtime Messages

Command:	/tmp/Y83sPRpb9c.elf
PID:	5558
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

Y83sPRpb9c.elf (PID: 5558, Parent: 5479, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/Y83sPRpb9c.elf

Y83sPRpb9c.elf New Fork (PID: 5560, Parent: 5558)

Y83sPRpb9c.elf New Fork (PID: 5562, Parent: 5560)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Y83sPRpb9c.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Y83sPRpb9c.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Y83sPRpb9c.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x22e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5558.1.00007f3628400000.00007f3628426000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5558.1.00007f3628400000.00007f3628426000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5558.1.00007f3628400000.00007f3628426000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x22e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Y83sPRpb9c.elf PID: 5558	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: Y83sPRpb9c.elf PID: 5558	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: Y83sPRpb9c.elf PID: 5558	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x43a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x44e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x462:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x476:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x48a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x502:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x516:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x52a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x53e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x552:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x566:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x57a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x58e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 1 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:15.791734
SID:	2030490
Source Port:	47708
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:39:23.695746
SID:	2030490
Source Port:	47690
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:39:31.685678
SID:	2030490
Source Port:	47692
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:39:44.388948
SID:	2030490
Source Port:	47698
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:39:17.787161
SID:	2030490
Source Port:	47688
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:41:06.869550
SID:	2030490
Source Port:	47724
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:00.122084
SID:	2030490
Source Port:	47702
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:39:36.611148
SID:	2030490
Source Port:	47694
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:39:40.511299
SID:	2030490
Source Port:	47696
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:33.575922
SID:	2030490
Source Port:	47712
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:38.421506
SID:	2030490
Source Port:	47714
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:39:49.208318
SID:	2030490
Source Port:	47700
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:03.053729
SID:	2030490
Source Port:	47704
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:59.910362
SID:	2030490
Source Port:	47722
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:41:11.824463
SID:	2030490
Source Port:	47726
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:53.979609
SID:	2030490
Source Port:	47720
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:04.872120
SID:	2030490
Source Port:	47706
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:22.718827
SID:	2030490
Source Port:	47710
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:44.296646
SID:	2030490
Source Port:	47716
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:50.117037
SID:	2030490
Source Port:	47718
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:41:21.833675
SID:	2030490
Source Port:	47728
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Y83sPRpb9c.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Y83sPRpb9c.elf

ReversingLabs: Detection: 65%

Source: Y83sPRpb9c.elf

String: HTTP/1.1 200 OKbot.armbot.arm5bot.arm6bot.arm7bot.mipsbot.mpslbot.x86_64bot.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47688 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47690 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47692 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47694 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47696 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47698 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47700 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47702 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47704 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47706 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47708 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47710 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47712 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47714 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47716 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47718 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47720 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47722 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47724 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47726 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:47728 -> 103.167.88.226:43957

Source: Y83sPRpb9c.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5558.1.00007f3628400000.00007f3628426000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Y83sPRpb9c.elf PID: 5558, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKbot.armbot.arm5bot.arm6bot.arm7bot.mipsbot.mpslbot.x86_64bot.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/5392/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/3767/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/Y83sPRpb9c.elf (PID: 5562)	File opened: /proc/816/cmdline	Jump to behavior

Source: Y83sPRpb9c.elf, 5558.1.000055d6b140a000.000055d6b1491000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: Y83sPRpb9c.elf, 5558.1.00007fff99c32000.00007fff99c53000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/Y83sPRpb9c.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Y83sPRpb9c.elf
Source: Y83sPRpb9c.elf, 5558.1.000055d6b140a000.000055d6b1491000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: Y83sPRpb9c.elf, 5558.1.00007fff99c32000.00007fff99c53000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Source: Yara match	File source: Y83sPRpb9c.elf, type: SAMPLE
Source: Yara match	File source: 5558.1.00007f3628400000.00007f3628426000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Y83sPRpb9c.elf PID: 5558, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
Y83sPRpb9c.elf	66%	ReversingLabs	Linux.Trojan.Mirai
Y83sPRpb9c.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.167.88.226	AXMdzuyn1m.elf	Get hash	malicious	Mirai, Okiru	Browse
	c1N1s54Xz4.elf	Get hash	malicious	Mirai, Okiru	Browse
	sNUnKpshtR.elf	Get hash	malicious	Mirai, Okiru	Browse
	c3S6vyQXOw.elf	Get hash	malicious	Mirai, Okiru	Browse
	MQ9rEJYn2l.elf	Get hash	malicious	Mirai, Okiru	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bn.networkbn.click	AXMdzuyn1m.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	c1N1s54Xz4.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	sNUnKpshtR.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	c3S6vyQXOw.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	MQ9rEJYn2l.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	n7h2Ze4ezf.elf	Get hash	malicious	Mirai	Browse	103.237.86.195
	bot.x86-20240414-2238.elf	Get hash	malicious	Mirai	Browse	103.237.86.195
	bot.x86_64-20240413-0230.elf	Get hash	malicious	Mirai	Browse	103.237.86.195
	bot.arm-20240413-0230.elf	Get hash	malicious	Mirai	Browse	103.237.86.195
	bot.x86-20240413-0230.elf	Get hash	malicious	Mirai	Browse	103.237.86.195

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	AXMdzuyn1m.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	c1N1s54Xz4.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	sNUnKpshtR.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	c3S6vyQXOw.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	MQ9rEJYn2l.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	E3kpuuuOfy.elf	Get hash	malicious	Mirai	Browse	130.56.210.55
	Yui1pUgieI.elf	Get hash	malicious	Mirai	Browse	203.1.230.101
	QXeoSsX87R.elf	Get hash	malicious	Gafgyt, Mirai	Browse	139.230.83.226
	https://site24x7.com	Get hash	malicious	Unknown	Browse	103.163.152.67
	QFR4Qsnm6y.elf	Get hash	malicious	Mirai	Browse	150.203.66.12

Process:	/tmp/Y83sPRpb9c.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:TgyLsDl:TgYil
MD5:	B6AD690E6125FE700E8655D4950C4F71
SHA1:	872F119DDA770770387634CFC430FE98CFCBB546
SHA-256:	43F45660E188371C89FF64BC7C3A10DCF178989AAF0A812503F508B8A7D3CDDC
SHA-512:	15A8CAE0C0CA12F1325045D2F4C83393246C2116C99A0448FFD0B088D9FAD8282F93F200038D786E6F3C69D8FF4C9CAD37970910D6EDC53372F15E29201E1009
Malicious:	false
Reputation:	low
Preview:	/tmp/Y83sPRpb9c.elf.

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.0182599854582
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Y83sPRpb9c.elf
File size:	177'860 bytes
MD5:	4060d4b7321a31242757a9e10a5ca477
SHA1:	a7c6b9af470151804da1f84b3ac4fc401928e03c
SHA256:	136415a68341ba2706982ecd53af6531d5fe2bead73f5f6c42cd66f08a28327a
SHA512:	5f4787a244638300042891f6c10c958ce92a279991ba501bf5eba6dc6a8978d2ec2898f8a2c8edf37b4d69427725fbab9417342245bc69ddc2e7fe176dc13f2f
SSDEEP:	3072:OeEksFM+wXnVaVB8H3NaMsTD+4pBU9k+r9KH/T:OeEnO+wXgVGdaMKDFpSi+8f
TLSH:	8D04E81AAB550FBBDCAFDD3706E90B1139CC954B22A83B363674D528F50E50B49E3C68
File Content Preview:	.ELF....................`.@.4...........4. ...(...............@...@.0W..0W...............`...`F..`F.0T..............Q.td...............................<.).'!......'.......................<.).'!...$.........9'.. ........................<.).'!... ........,9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	177300
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x22be0	0x0	0x6	AX	16
.fini	PROGBITS	0x422d00	0x22d00	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x422d60	0x22d60	0x29d0	0x0	0x2	A	16
.ctors	PROGBITS	0x466000	0x26000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x46600c	0x2600c	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x466018	0x26018	0xcc	0x0	0x3	WA	4
.data	PROGBITS	0x466100	0x26100	0x4998	0x0	0x3	WA	32
.got	PROGBITS	0x46aaa0	0x2aaa0	0x990	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x46b430	0x2b430	0x4c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x46b480	0x2b430	0x4840	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x126c	0x2b430	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x2b430	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x25730	0x25730	5.4452	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x26000	0x466000	0x466000	0x5430	0x9cc0	1.1553	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 16:39:17.430505991 CEST	47688	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:17.786827087 CEST	43957	47688	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:17.787159920 CEST	47688	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:17.787161112 CEST	47688	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:18.144687891 CEST	43957	47688	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:18.144748926 CEST	43957	47688	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:23.250564098 CEST	47690	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:23.695430040 CEST	43957	47690	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:23.695643902 CEST	47690	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:23.695745945 CEST	47690	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:24.134470940 CEST	43957	47690	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:24.134556055 CEST	43957	47690	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:31.239862919 CEST	47692	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:31.685482979 CEST	43957	47692	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:31.685574055 CEST	47692	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:31.685678005 CEST	47692	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:32.134295940 CEST	43957	47692	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:32.135243893 CEST	43957	47692	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:35.240664959 CEST	47694	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:36.253331900 CEST	47694	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:36.610989094 CEST	43957	47694	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:36.611077070 CEST	47694	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:36.611148119 CEST	47694	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:36.974971056 CEST	43957	47694	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:36.975059032 CEST	43957	47694	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:40.080508947 CEST	47696	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:40.511153936 CEST	43957	47696	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:40.511228085 CEST	47696	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:40.511298895 CEST	47696	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:40.925432920 CEST	43957	47696	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:40.925507069 CEST	43957	47696	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:44.030320883 CEST	47698	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:44.388771057 CEST	43957	47698	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:44.388901949 CEST	47698	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:44.388947964 CEST	47698	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:44.746376038 CEST	43957	47698	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:44.746402979 CEST	43957	47698	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:48.851737976 CEST	47700	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:49.208050966 CEST	43957	47700	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:49.208197117 CEST	47700	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:49.208317995 CEST	47700	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:39:49.571257114 CEST	43957	47700	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:49.571293116 CEST	43957	47700	103.167.88.226	192.168.2.13
Apr 18, 2024 16:39:59.677357912 CEST	47702	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:00.121877909 CEST	43957	47702	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:00.122005939 CEST	47702	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:00.122083902 CEST	47702	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:00.559227943 CEST	43957	47702	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:00.559256077 CEST	43957	47702	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:02.699990988 CEST	47704	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:03.053440094 CEST	43957	47704	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:03.053729057 CEST	47704	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:03.053729057 CEST	47704	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:03.408387899 CEST	43957	47704	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:03.408421993 CEST	43957	47704	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:04.513829947 CEST	47706	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:04.870721102 CEST	43957	47706	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:04.871064901 CEST	47706	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:04.872119904 CEST	47706	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:05.230602026 CEST	43957	47706	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:05.230658054 CEST	43957	47706	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:15.341907978 CEST	47708	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:15.791493893 CEST	43957	47708	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:15.791646957 CEST	47708	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:15.791733980 CEST	47708	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:16.235209942 CEST	43957	47708	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:16.235245943 CEST	43957	47708	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:19.341100931 CEST	47710	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:20.349432945 CEST	47710	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:22.365578890 CEST	47710	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:22.718575001 CEST	43957	47710	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:22.718827009 CEST	47710	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:22.718827009 CEST	47710	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:23.074851990 CEST	43957	47710	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:23.074913979 CEST	43957	47710	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:33.180433035 CEST	47712	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:33.575695038 CEST	43957	47712	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:33.575860023 CEST	47712	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:33.575922012 CEST	47712	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:33.959960938 CEST	43957	47712	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:33.960022926 CEST	43957	47712	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:38.065857887 CEST	47714	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:38.421304941 CEST	43957	47714	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:38.421442986 CEST	47714	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:38.421505928 CEST	47714	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:38.781423092 CEST	43957	47714	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:38.781452894 CEST	43957	47714	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:43.887548923 CEST	47716	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:44.296375990 CEST	43957	47716	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:44.296521902 CEST	47716	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:44.296646118 CEST	47716	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:44.658309937 CEST	43957	47716	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:44.658345938 CEST	43957	47716	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:49.763659954 CEST	47718	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:50.116691113 CEST	43957	47718	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:50.116877079 CEST	47718	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:50.117037058 CEST	47718	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:50.471920967 CEST	43957	47718	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:50.471957922 CEST	43957	47718	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:53.576883078 CEST	47720	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:53.979406118 CEST	43957	47720	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:53.979533911 CEST	47720	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:53.979609013 CEST	47720	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:54.363480091 CEST	43957	47720	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:54.363507986 CEST	43957	47720	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:59.468947887 CEST	47722	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:59.910149097 CEST	43957	47722	103.167.88.226	192.168.2.13
Apr 18, 2024 16:40:59.910326004 CEST	47722	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:40:59.910362005 CEST	47722	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:41:00.352396965 CEST	43957	47722	103.167.88.226	192.168.2.13
Apr 18, 2024 16:41:00.352473974 CEST	43957	47722	103.167.88.226	192.168.2.13
Apr 18, 2024 16:41:06.457719088 CEST	47724	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:41:06.869358063 CEST	43957	47724	103.167.88.226	192.168.2.13
Apr 18, 2024 16:41:06.869493008 CEST	47724	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:41:06.869549990 CEST	47724	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:41:07.230370045 CEST	43957	47724	103.167.88.226	192.168.2.13
Apr 18, 2024 16:41:07.230413914 CEST	43957	47724	103.167.88.226	192.168.2.13
Apr 18, 2024 16:41:11.371455908 CEST	47726	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:41:11.824254990 CEST	43957	47726	103.167.88.226	192.168.2.13
Apr 18, 2024 16:41:11.824429035 CEST	47726	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:41:11.824462891 CEST	47726	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:41:12.278085947 CEST	43957	47726	103.167.88.226	192.168.2.13
Apr 18, 2024 16:41:12.278304100 CEST	43957	47726	103.167.88.226	192.168.2.13
Apr 18, 2024 16:41:21.384119987 CEST	47728	43957	192.168.2.13	103.167.88.226
Apr 18, 2024 16:41:21.833317995 CEST	43957	47728	103.167.88.226	192.168.2.13
Apr 18, 2024 16:41:21.833674908 CEST	47728	43957	192.168.2.13	103.167.88.226

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 16:39:17.324843884 CEST	54353	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:39:17.429668903 CEST	53	54353	8.8.8.8	192.168.2.13
Apr 18, 2024 16:39:23.145602942 CEST	50234	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:39:23.250437021 CEST	53	50234	8.8.8.8	192.168.2.13
Apr 18, 2024 16:39:31.134829044 CEST	35098	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:39:31.239733934 CEST	53	35098	8.8.8.8	192.168.2.13
Apr 18, 2024 16:39:35.135508060 CEST	33996	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:39:35.240474939 CEST	53	33996	8.8.8.8	192.168.2.13
Apr 18, 2024 16:39:39.975344896 CEST	37285	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:39:40.080274105 CEST	53	37285	8.8.8.8	192.168.2.13
Apr 18, 2024 16:39:43.925812960 CEST	59188	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:39:44.030164003 CEST	53	59188	8.8.8.8	192.168.2.13
Apr 18, 2024 16:39:48.746678114 CEST	52052	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:39:48.851583958 CEST	53	52052	8.8.8.8	192.168.2.13
Apr 18, 2024 16:39:59.571603060 CEST	46397	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:39:59.677169085 CEST	53	46397	8.8.8.8	192.168.2.13
Apr 18, 2024 16:40:02.559659004 CEST	48038	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:40:02.699702024 CEST	53	48038	8.8.8.8	192.168.2.13
Apr 18, 2024 16:40:04.408863068 CEST	36111	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:40:04.513554096 CEST	53	36111	8.8.8.8	192.168.2.13
Apr 18, 2024 16:40:15.231051922 CEST	43747	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:40:15.341696978 CEST	53	43747	8.8.8.8	192.168.2.13
Apr 18, 2024 16:40:19.235862970 CEST	60718	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:40:19.340857029 CEST	53	60718	8.8.8.8	192.168.2.13
Apr 18, 2024 16:40:33.075203896 CEST	60848	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:40:33.180241108 CEST	53	60848	8.8.8.8	192.168.2.13
Apr 18, 2024 16:40:37.960557938 CEST	42886	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:40:38.065601110 CEST	53	42886	8.8.8.8	192.168.2.13
Apr 18, 2024 16:40:43.781817913 CEST	45444	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:40:43.887280941 CEST	53	45444	8.8.8.8	192.168.2.13
Apr 18, 2024 16:40:49.658684969 CEST	43067	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:40:49.763432026 CEST	53	43067	8.8.8.8	192.168.2.13
Apr 18, 2024 16:40:53.472332001 CEST	54917	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:40:53.576729059 CEST	53	54917	8.8.8.8	192.168.2.13
Apr 18, 2024 16:40:59.364006996 CEST	46343	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:40:59.468713999 CEST	53	46343	8.8.8.8	192.168.2.13
Apr 18, 2024 16:41:06.352787971 CEST	52508	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:41:06.457544088 CEST	53	52508	8.8.8.8	192.168.2.13
Apr 18, 2024 16:41:11.230897903 CEST	48581	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:41:11.371299028 CEST	53	48581	8.8.8.8	192.168.2.13
Apr 18, 2024 16:41:21.278733969 CEST	51214	53	192.168.2.13	8.8.8.8
Apr 18, 2024 16:41:21.383863926 CEST	53	51214	8.8.8.8	192.168.2.13

Start time (UTC):	14:39:15
Start date (UTC):	18/04/2024
Path:	/tmp/Y83sPRpb9c.elf
Arguments:	/tmp/Y83sPRpb9c.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Y83sPRpb9c.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00fdrM (deleted)

/tmp/qemu-open.06YdsM (deleted)

/tmp/qemu-open.08e4RJ (deleted)

/tmp/qemu-open.0DgDnK (deleted)

/tmp/qemu-open.0KRNhO (deleted)

/tmp/qemu-open.0KbybN (deleted)

/tmp/qemu-open.0Rh2UM (deleted)

/tmp/qemu-open.0RxXxM (deleted)

/tmp/qemu-open.0a2M3K (deleted)

/tmp/qemu-open.0cbM5L (deleted)

/tmp/qemu-open.0dLuDK (deleted)

/tmp/qemu-open.0iY9qK (deleted)

/tmp/qemu-open.0oxuMN (deleted)

/tmp/qemu-open.0r6A1L (deleted)

/tmp/qemu-open.0rXrdN (deleted)

/tmp/qemu-open.0uLC6M (deleted)

/tmp/qemu-open.0zR40L (deleted)

/tmp/qemu-open.11QyvK (deleted)

/tmp/qemu-open.11yMFJ (deleted)

/tmp/qemu-open.12Lh9L (deleted)

/tmp/qemu-open.13tTyM (deleted)

/tmp/qemu-open.14ZptK (deleted)

/tmp/qemu-open.18gDhL (deleted)

/tmp/qemu-open.1DLniN (deleted)

/tmp/qemu-open.1EsTZL (deleted)

/tmp/qemu-open.1GP8XJ (deleted)

/tmp/qemu-open.1MfvOL (deleted)

/tmp/qemu-open.1T9QQL (deleted)

/tmp/qemu-open.1WRLaN (deleted)

Linux Analysis Report
Y83sPRpb9c.elf

Start time (UTC):	14:39:16
Start date (UTC):	18/04/2024
Path:	/tmp/Y83sPRpb9c.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre