Edit tour

Linux Analysis Report
eHFldFkJF4.elf

Overview

General Information

Sample name:	eHFldFkJF4.elf renamed because original name is a hash value
Original sample name:	5cbbbd10f2d2de20267a3d2ffe430e20.elf
Analysis ID:	1428203
MD5:	5cbbbd10f2d2de20267a3d2ffe430e20
SHA1:	dc14de0dc7159bceb35b1d80a729009856218b7a
SHA256:	ed418388580faa10eb08a655f57edfad8798312405e4575915b0604c7f65803f
Tags:	32elfmirairenesas
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428203
Start date and time:	2024-04-18 16:39:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	eHFldFkJF4.elf renamed because original name is a hash value
Original Sample Name:	5cbbbd10f2d2de20267a3d2ffe430e20.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@19/0

Runtime Messages

Command:	/tmp/eHFldFkJF4.elf
PID:	5497
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

eHFldFkJF4.elf (PID: 5497, Parent: 5419, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/eHFldFkJF4.elf

eHFldFkJF4.elf New Fork (PID: 5499, Parent: 5497)

eHFldFkJF4.elf New Fork (PID: 5501, Parent: 5499)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
eHFldFkJF4.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
eHFldFkJF4.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
eHFldFkJF4.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x154a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1552c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1557c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1561c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5497.1.00007f7568400000.00007f7568418000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5497.1.00007f7568400000.00007f7568418000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5497.1.00007f7568400000.00007f7568418000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x154a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1552c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1557c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1561c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: eHFldFkJF4.elf PID: 5497	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: eHFldFkJF4.elf PID: 5497	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: eHFldFkJF4.elf PID: 5497	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x74f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x752c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x757c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x75a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x75b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x75cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x75e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x75f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x761c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7644:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7658:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x766c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7680:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 1 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:41:41.991671
SID:	2030490
Source Port:	49130
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:41:04.530524
SID:	2030490
Source Port:	49120
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:41:43.891136
SID:	2030490
Source Port:	49132
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:34.952322
SID:	2030490
Source Port:	49110
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:41:54.704364
SID:	2030490
Source Port:	49134
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:41:25.315392
SID:	2030490
Source Port:	49124
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:23.987281
SID:	2030490
Source Port:	49108
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:41:15.392021
SID:	2030490
Source Port:	49122
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:39.810582
SID:	2030490
Source Port:	49112
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:18.979453
SID:	2030490
Source Port:	49106
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:42:11.520784
SID:	2030490
Source Port:	49138
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:41:32.072944
SID:	2030490
Source Port:	49128
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:42:04.575429
SID:	2030490
Source Port:	49136
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:47.723148
SID:	2030490
Source Port:	49114
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:58.672508
SID:	2030490
Source Port:	49118
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:12.978587
SID:	2030490
Source Port:	49104
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:41:30.249249
SID:	2030490
Source Port:	49126
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.167.88.226

Timestamp:	04/18/24-16:40:56.768385
SID:	2030490
Source Port:	49116
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: eHFldFkJF4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: eHFldFkJF4.elf

ReversingLabs: Detection: 65%

Source: eHFldFkJF4.elf

String: HTTP/1.1 200 OKbot.armbot.arm5bot.arm6bot.arm7bot.mipsbot.mpslbot.x86_64bot.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49104 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49106 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49108 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49110 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49112 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49114 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49116 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49118 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49120 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49122 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49124 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49126 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49128 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49130 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49132 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49134 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49136 -> 103.167.88.226:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:49138 -> 103.167.88.226:43957

Source: eHFldFkJF4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5497.1.00007f7568400000.00007f7568418000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: eHFldFkJF4.elf PID: 5497, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKbot.armbot.arm5bot.arm6bot.arm7bot.mipsbot.mpslbot.x86_64bot.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/3762/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/3763/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/eHFldFkJF4.elf (PID: 5501)	File opened: /proc/262/cmdline	Jump to behavior

Source: eHFldFkJF4.elf, 5497.1.00007ffd285b2000.00007ffd285d3000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: eHFldFkJF4.elf, 5497.1.000055d1862fe000.000055d186361000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: eHFldFkJF4.elf, 5497.1.000055d1862fe000.000055d186361000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: eHFldFkJF4.elf, 5497.1.00007ffd285b2000.00007ffd285d3000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/eHFldFkJF4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/eHFldFkJF4.elf

Source: Yara match	File source: eHFldFkJF4.elf, type: SAMPLE
Source: Yara match	File source: 5497.1.00007f7568400000.00007f7568418000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: eHFldFkJF4.elf PID: 5497, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
eHFldFkJF4.elf	66%	ReversingLabs	Linux.Trojan.Mirai
eHFldFkJF4.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.167.88.226	Y83sPRpb9c.elf	Get hash	malicious	Mirai, Okiru	Browse
	AXMdzuyn1m.elf	Get hash	malicious	Mirai, Okiru	Browse
	c1N1s54Xz4.elf	Get hash	malicious	Mirai, Okiru	Browse
	sNUnKpshtR.elf	Get hash	malicious	Mirai, Okiru	Browse
	c3S6vyQXOw.elf	Get hash	malicious	Mirai, Okiru	Browse
	MQ9rEJYn2l.elf	Get hash	malicious	Mirai, Okiru	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bn.networkbn.click	Y83sPRpb9c.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	AXMdzuyn1m.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	c1N1s54Xz4.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	sNUnKpshtR.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	c3S6vyQXOw.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	MQ9rEJYn2l.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	n7h2Ze4ezf.elf	Get hash	malicious	Mirai	Browse	103.237.86.195
	bot.x86-20240414-2238.elf	Get hash	malicious	Mirai	Browse	103.237.86.195
	bot.x86_64-20240413-0230.elf	Get hash	malicious	Mirai	Browse	103.237.86.195
	bot.arm-20240413-0230.elf	Get hash	malicious	Mirai	Browse	103.237.86.195

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	Y83sPRpb9c.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	AXMdzuyn1m.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	c1N1s54Xz4.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	sNUnKpshtR.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	c3S6vyQXOw.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	MQ9rEJYn2l.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	E3kpuuuOfy.elf	Get hash	malicious	Mirai	Browse	130.56.210.55
	Yui1pUgieI.elf	Get hash	malicious	Mirai	Browse	203.1.230.101
	QXeoSsX87R.elf	Get hash	malicious	Gafgyt, Mirai	Browse	139.230.83.226
	https://site24x7.com	Get hash	malicious	Unknown	Browse	103.163.152.67

Process:	/tmp/eHFldFkJF4.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.7841837197791883
Encrypted:	false
SSDEEP:	3:TgIjqveNln:TgIevMn
MD5:	E1F76AB28836E02377998D6A33F6FCAE
SHA1:	684AA72857AD919E385955A816784A2B1D1EBAA3
SHA-256:	D4CF07FCA0ECAA1387A896F9C72B1D6EF938C243BC73205F6DEB37DCAC5A9B38
SHA-512:	4D7659B362DE4FA89CCD06CF6C3EC239511141AF279EEC1F4082A62DD3B2773E840CF302B9BD29619A2CBEAAC50CDD3B8773060E28C27744F4C4D9D3F5F6F5A3
Malicious:	false
Reputation:	low
Preview:	/tmp/eHFldFkJF4.elf.

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.219709464276905
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	eHFldFkJF4.elf
File size:	116'512 bytes
MD5:	5cbbbd10f2d2de20267a3d2ffe430e20
SHA1:	dc14de0dc7159bceb35b1d80a729009856218b7a
SHA256:	ed418388580faa10eb08a655f57edfad8798312405e4575915b0604c7f65803f
SHA512:	02d8568311abea9cc8518297fa0d986e1197beda9c0e8f0c26def2122b6285f820d588874466ef8b636b0eb5a90bc28c5cf375d76513afd4cc2b468a4b8611a6
SSDEEP:	1536:Ka97/a/qUAm/u4Y3mOCRYKtKBhLfdKaqXzURDWUdWN4DJ+LhHK:Kyan24amOMftsxKa2sDWSWN+UHK
TLSH:	FFB34A77CC2A6F98C159D5B0B0B09F792BA3A58182471FBA55B2C3B64083DCDF505BB8
File Content Preview:	.ELF.....................@.4...h.......4. ...(...............@...@..{...{...............{...{B..{B.PI..............Q.td............................././"O.n........#.@........#.*@.R...o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	116072
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x152c0	0x0	0x6	AX	32
.fini	PROGBITS	0x4153a0	0x153a0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x4153c4	0x153c4	0x280c	0x0	0x2	A	4
.ctors	PROGBITS	0x427bd4	0x17bd4	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x427be0	0x17be0	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x427c00	0x17c00	0x4910	0x0	0x3	WA	32
.got	PROGBITS	0x42c510	0x1c510	0x14	0x4	0x3	WA	4
.bss	NOBITS	0x42c524	0x1c524	0x46bc	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1c524	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x17bd0	0x17bd0	6.9041	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x17bd4	0x427bd4	0x427bd4	0x4950	0x900c	0.4097	0x6	RW	0x10000	.ctors .dtors .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 16:40:12.534394979 CEST	49104	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:12.977736950 CEST	43957	49104	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:12.977878094 CEST	49104	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:12.978586912 CEST	49104	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:13.423737049 CEST	43957	49104	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:13.424067974 CEST	43957	49104	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:13.424902916 CEST	49104	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:13.801676989 CEST	43957	49104	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:17.530220032 CEST	49106	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:18.541634083 CEST	49106	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:18.979268074 CEST	43957	49106	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:18.979367971 CEST	49106	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:18.979453087 CEST	49106	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:19.430685997 CEST	43957	49106	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:19.430870056 CEST	43957	49106	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:23.539247990 CEST	49108	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:23.985431910 CEST	43957	49108	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:23.987206936 CEST	49108	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:23.987281084 CEST	49108	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:24.437645912 CEST	43957	49108	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:24.437855959 CEST	43957	49108	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:34.544025898 CEST	49110	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:34.952135086 CEST	43957	49110	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:34.952217102 CEST	49110	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:34.952322006 CEST	49110	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:35.339963913 CEST	43957	49110	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:35.339998007 CEST	43957	49110	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:39.445969105 CEST	49112	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:39.810348988 CEST	43957	49112	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:39.810581923 CEST	49112	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:39.810581923 CEST	49112	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:40.166486979 CEST	43957	49112	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:40.166563034 CEST	43957	49112	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:47.272198915 CEST	49114	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:47.722978115 CEST	43957	49114	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:47.723089933 CEST	49114	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:47.723148108 CEST	49114	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:48.170629978 CEST	43957	49114	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:48.170658112 CEST	43957	49114	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:56.326621056 CEST	49116	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:56.768081903 CEST	43957	49116	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:56.768342972 CEST	49116	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:56.768384933 CEST	49116	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:57.212649107 CEST	43957	49116	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:57.212719917 CEST	43957	49116	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:57.212898970 CEST	49116	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:57.651261091 CEST	43957	49116	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:58.318464994 CEST	49118	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:58.672317982 CEST	43957	49118	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:58.672468901 CEST	49118	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:58.672508001 CEST	49118	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:40:59.028023958 CEST	43957	49118	103.167.88.226	192.168.2.14
Apr 18, 2024 16:40:59.028095961 CEST	43957	49118	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:04.133526087 CEST	49120	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:04.530154943 CEST	43957	49120	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:04.530436039 CEST	49120	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:04.530524015 CEST	49120	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:04.934600115 CEST	43957	49120	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:04.934638023 CEST	43957	49120	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:15.039860964 CEST	49122	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:15.391809940 CEST	43957	49122	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:15.391973019 CEST	49122	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:15.392020941 CEST	49122	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:15.744122028 CEST	43957	49122	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:15.744163036 CEST	43957	49122	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:24.868558884 CEST	49124	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:25.315063000 CEST	43957	49124	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:25.315264940 CEST	49124	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:25.315392017 CEST	49124	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:25.776534081 CEST	43957	49124	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:25.776599884 CEST	43957	49124	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:28.881853104 CEST	49126	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:29.898839951 CEST	49126	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:30.248991966 CEST	43957	49126	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:30.249157906 CEST	49126	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:30.249248981 CEST	49126	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:30.606839895 CEST	43957	49126	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:30.606910944 CEST	43957	49126	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:31.712392092 CEST	49128	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:32.072674990 CEST	43957	49128	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:32.072828054 CEST	49128	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:32.072943926 CEST	49128	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:32.438498974 CEST	43957	49128	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:32.438538074 CEST	43957	49128	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:41.548135042 CEST	49130	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:41.991349936 CEST	43957	49130	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:41.991514921 CEST	49130	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:41.991671085 CEST	49130	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:42.428272963 CEST	43957	49130	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:42.428309917 CEST	43957	49130	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:43.534029007 CEST	49132	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:43.890928984 CEST	43957	49132	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:43.891061068 CEST	49132	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:43.891135931 CEST	49132	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:44.247767925 CEST	43957	49132	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:44.247798920 CEST	43957	49132	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:54.353274107 CEST	49134	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:54.704179049 CEST	43957	49134	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:54.704329014 CEST	49134	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:54.704364061 CEST	49134	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:41:55.054522991 CEST	43957	49134	103.167.88.226	192.168.2.14
Apr 18, 2024 16:41:55.054558039 CEST	43957	49134	103.167.88.226	192.168.2.14
Apr 18, 2024 16:42:04.159495115 CEST	49136	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:42:04.575130939 CEST	43957	49136	103.167.88.226	192.168.2.14
Apr 18, 2024 16:42:04.575385094 CEST	49136	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:42:04.575428963 CEST	49136	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:42:04.979444027 CEST	43957	49136	103.167.88.226	192.168.2.14
Apr 18, 2024 16:42:04.979504108 CEST	43957	49136	103.167.88.226	192.168.2.14
Apr 18, 2024 16:42:11.084748030 CEST	49138	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:42:11.520576954 CEST	43957	49138	103.167.88.226	192.168.2.14
Apr 18, 2024 16:42:11.520726919 CEST	49138	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:42:11.520783901 CEST	49138	43957	192.168.2.14	103.167.88.226
Apr 18, 2024 16:42:11.960244894 CEST	43957	49138	103.167.88.226	192.168.2.14
Apr 18, 2024 16:42:11.960305929 CEST	43957	49138	103.167.88.226	192.168.2.14
Apr 18, 2024 16:42:17.065083981 CEST	49140	43957	192.168.2.14	103.167.88.226

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 18, 2024 16:40:12.421911955 CEST	51247	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:40:12.533442020 CEST	53	51247	8.8.8.8	192.168.2.14
Apr 18, 2024 16:40:17.424993038 CEST	56147	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:40:17.530044079 CEST	53	56147	8.8.8.8	192.168.2.14
Apr 18, 2024 16:40:23.431030035 CEST	39985	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:40:23.536151886 CEST	53	39985	8.8.8.8	192.168.2.14
Apr 18, 2024 16:40:34.437827110 CEST	33421	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:40:34.543561935 CEST	53	33421	8.8.8.8	192.168.2.14
Apr 18, 2024 16:40:39.340339899 CEST	53889	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:40:39.445768118 CEST	53	53889	8.8.8.8	192.168.2.14
Apr 18, 2024 16:40:47.166826010 CEST	57160	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:40:47.271888971 CEST	53	57160	8.8.8.8	192.168.2.14
Apr 18, 2024 16:40:56.170670033 CEST	36868	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:40:56.326397896 CEST	53	36868	8.8.8.8	192.168.2.14
Apr 18, 2024 16:40:58.213082075 CEST	57073	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:40:58.318276882 CEST	53	57073	8.8.8.8	192.168.2.14
Apr 18, 2024 16:41:04.028418064 CEST	60561	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:41:04.133344889 CEST	53	60561	8.8.8.8	192.168.2.14
Apr 18, 2024 16:41:14.934634924 CEST	49057	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:41:15.039627075 CEST	53	49057	8.8.8.8	192.168.2.14
Apr 18, 2024 16:41:24.744187117 CEST	52275	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:41:24.868335962 CEST	53	52275	8.8.8.8	192.168.2.14
Apr 18, 2024 16:41:28.776994944 CEST	35662	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:41:28.881639957 CEST	53	35662	8.8.8.8	192.168.2.14
Apr 18, 2024 16:41:31.607207060 CEST	56528	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:41:31.712182999 CEST	53	56528	8.8.8.8	192.168.2.14
Apr 18, 2024 16:41:41.438924074 CEST	46558	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:41:41.547838926 CEST	53	46558	8.8.8.8	192.168.2.14
Apr 18, 2024 16:41:43.428751945 CEST	57318	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:41:43.533797979 CEST	53	57318	8.8.8.8	192.168.2.14
Apr 18, 2024 16:41:54.247792006 CEST	43929	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:41:54.353049994 CEST	53	43929	8.8.8.8	192.168.2.14
Apr 18, 2024 16:42:04.054590940 CEST	41848	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:42:04.159290075 CEST	53	41848	8.8.8.8	192.168.2.14
Apr 18, 2024 16:42:10.979649067 CEST	60754	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:42:11.084379911 CEST	53	60754	8.8.8.8	192.168.2.14
Apr 18, 2024 16:42:16.960417032 CEST	43491	53	192.168.2.14	8.8.8.8
Apr 18, 2024 16:42:17.064871073 CEST	53	43491	8.8.8.8	192.168.2.14

Start time (UTC):	14:40:10
Start date (UTC):	18/04/2024
Path:	/tmp/eHFldFkJF4.elf
Arguments:	/tmp/eHFldFkJF4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report eHFldFkJF4.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.04GIRa (deleted)

/tmp/qemu-open.0AtuO7 (deleted)

/tmp/qemu-open.0HI3ub (deleted)

/tmp/qemu-open.0JGHY8 (deleted)

/tmp/qemu-open.0Jvzm9 (deleted)

/tmp/qemu-open.0LoE98 (deleted)

/tmp/qemu-open.0Y5brb (deleted)

/tmp/qemu-open.0eC0X9 (deleted)

/tmp/qemu-open.0hm5Ra (deleted)

/tmp/qemu-open.0nsWR7 (deleted)

/tmp/qemu-open.0pRbv8 (deleted)

/tmp/qemu-open.13W8Z8 (deleted)

/tmp/qemu-open.14oola (deleted)

/tmp/qemu-open.172pUa (deleted)

/tmp/qemu-open.1OyuRa (deleted)

/tmp/qemu-open.1Qwjj8 (deleted)

/tmp/qemu-open.1SdAyb (deleted)

/tmp/qemu-open.1TfXR9 (deleted)

/tmp/qemu-open.1UAq17 (deleted)

/tmp/qemu-open.1VcHbc (deleted)

/tmp/qemu-open.1YCK9a (deleted)

/tmp/qemu-open.1YVuPa (deleted)

/tmp/qemu-open.1cmDka (deleted)

/tmp/qemu-open.1homn9 (deleted)

/tmp/qemu-open.1mrL87 (deleted)

/tmp/qemu-open.25QvAa (deleted)

/tmp/qemu-open.26OB5b (deleted)

Linux Analysis Report
eHFldFkJF4.elf

Start time (UTC):	14:40:11
Start date (UTC):	18/04/2024
Path:	/tmp/eHFldFkJF4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre