Edit tour

Linux Analysis Report
evYVOXt11H.elf

Overview

General Information

Sample name:	evYVOXt11H.elf renamed because original name is a hash value
Original sample name:	b46fb6bd9878b366ff4e2c38c4e90fdd.elf
Analysis ID:	1428670
MD5:	b46fb6bd9878b366ff4e2c38c4e90fdd
SHA1:	78d0ff7fe412313e32130e6b51ab34ae0cd8061a
SHA256:	a73c944d0b1b5e6a1740ef4d8da44753f4094859112fa27a51108aa098e59126
Tags:	32elfmirairenesas
Infos:

Detection

Mirai, Moobot, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Moobot

Yara detected Okiru

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428670
Start date and time:	2024-04-19 11:38:42 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	evYVOXt11H.elf renamed because original name is a hash value
Original Sample Name:	b46fb6bd9878b366ff4e2c38c4e90fdd.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1026@22/0

Runtime Messages

Command:	/tmp/evYVOXt11H.elf
PID:	5581
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

evYVOXt11H.elf (PID: 5581, Parent: 5500, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/evYVOXt11H.elf

evYVOXt11H.elf New Fork (PID: 5583, Parent: 5581)

evYVOXt11H.elf New Fork (PID: 5585, Parent: 5583)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
evYVOXt11H.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
evYVOXt11H.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
evYVOXt11H.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
evYVOXt11H.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1701c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1706c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1710c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5581.1.00007f5f80400000.00007f5f8041a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5581.1.00007f5f80400000.00007f5f8041a000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
5581.1.00007f5f80400000.00007f5f8041a000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5581.1.00007f5f80400000.00007f5f8041a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1701c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1706c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17094:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1710c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: evYVOXt11H.elf PID: 5581	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: evYVOXt11H.elf PID: 5581	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: evYVOXt11H.elf PID: 5581	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x8b0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8bab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8bbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8bd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8be7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8bfb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c9b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 2 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:40:04.499371
SID:	2030490
Source Port:	36506
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:41:37.861696
SID:	2030490
Source Port:	36538
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:39:43.165478
SID:	2030490
Source Port:	36498
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:40:37.654711
SID:	2030490
Source Port:	36516
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:40:40.481827
SID:	2030490
Source Port:	36518
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:40:01.674601
SID:	2030490
Source Port:	36504
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:40:13.342608
SID:	2030490
Source Port:	36508
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:41:35.010420
SID:	2030490
Source Port:	36536
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:39:35.331022
SID:	2030490
Source Port:	36496
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:41:00.782499
SID:	2030490
Source Port:	36526
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:39:55.822942
SID:	2030490
Source Port:	36502
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:41:32.156248
SID:	2030490
Source Port:	36534
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:40:26.002750
SID:	2030490
Source Port:	36512
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:40:32.824217
SID:	2030490
Source Port:	36514
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:40:58.949071
SID:	2030490
Source Port:	36524
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:41:16.428096
SID:	2030490
Source Port:	36530
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:40:18.190192
SID:	2030490
Source Port:	36510
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:39:49.981131
SID:	2030490
Source Port:	36500
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:41:26.285987
SID:	2030490
Source Port:	36532
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:40:55.118948
SID:	2030490
Source Port:	36522
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:41:09.602714
SID:	2030490
Source Port:	36528
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:40:45.304162
SID:	2030490
Source Port:	36520
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: HTTP/1.1 200 OKbulus.armbulus.arm5bulus.arm6bulus.arm7bulus.mipsbulus.mpslbulus.x86_64bulus.sh4abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/proc/%d/exe/tmp/%s%s%c/proc/self/cmdline/proc/%d/proc/self/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofia/var/Bulusshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Source: evYVOXt11H.elf	Virustotal: Detection: 40%			Perma Link
Source: evYVOXt11H.elf	ReversingLabs: Detection: 52%

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36496 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36498 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36500 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36502 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36504 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36506 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36508 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36510 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36512 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36514 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36516 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36518 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36520 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36522 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36524 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36526 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36528 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36530 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36532 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36534 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36536 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36538 -> 103.174.73.85:29989

Source: evYVOXt11H.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5581.1.00007f5f80400000.00007f5f8041a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: evYVOXt11H.elf PID: 5581, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKbulus.armbulus.arm5bulus.arm6bulus.arm7bulus.mipsbulus.mpslbulus.x86_64bulus.sh4abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/proc/%d/exe/tmp/%s%s%c/proc/self/cmdline/proc/%d/proc/self/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofia/var/Bulusshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/3680/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/evYVOXt11H.elf (PID: 5585)	File opened: /proc/270/cmdline	Jump to behavior

Source: evYVOXt11H.elf, 5581.1.00007ffcc0c83000.00007ffcc0ca4000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: evYVOXt11H.elf, 5581.1.000055db4b1c1000.000055db4b224000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: evYVOXt11H.elf, 5581.1.000055db4b1c1000.000055db4b224000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: evYVOXt11H.elf, 5581.1.00007ffcc0c83000.00007ffcc0ca4000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/evYVOXt11H.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/evYVOXt11H.elf

Source: Yara match	File source: evYVOXt11H.elf, type: SAMPLE
Source: Yara match	File source: 5581.1.00007f5f80400000.00007f5f8041a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: evYVOXt11H.elf PID: 5581, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
evYVOXt11H.elf	40%	Virustotal		Browse
evYVOXt11H.elf	53%	ReversingLabs	Linux.Trojan.Mirai
evYVOXt11H.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.174.73.85	BxEMaAYhqP.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse
	9PYUxFx9pK.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse
	bulus.arm7.elf	Get hash	malicious	Mirai	Browse
	bulus.arm5.elf	Get hash	malicious	Mirai	Browse
	bulus.arm.elf	Get hash	malicious	Mirai	Browse
	bulus.x86.elf	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
proxy.heleh.vn	BxEMaAYhqP.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85
proxy.heleh.vn	9PYUxFx9pK.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	BxEMaAYhqP.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85
	9PYUxFx9pK.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85
	BzmhHwFpCV.elf	Get hash	malicious	Mirai	Browse	103.189.218.40
	Gq7FlDf6cE.elf	Get hash	malicious	Mirai	Browse	103.183.144.21
	XY2I8rWLkM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	103.186.117.171
	2020.xls	Get hash	malicious	Remcos, DBatLoader	Browse	103.186.117.171
	Ja84Oghm6q.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	eHFldFkJF4.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226
	Y83sPRpb9c.elf	Get hash	malicious	Mirai, Okiru	Browse	103.167.88.226

Process:	/tmp/evYVOXt11H.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.921928094887362
Encrypted:	false
SSDEEP:	3:TgXQLANln:Tguiln
MD5:	4A4F5D95B6300210B7EC86FAEDA4AC7C
SHA1:	984F09D9D67B5A229DF55DC01140EB5D47D78CC0
SHA-256:	B01E56437222CD3FE6AD97CA1A4916CCB428C59A62D5B9C6D529873D58D533DC
SHA-512:	3E1585C4924B8026AACF57EBF28C598B44C5F70336105B31295F59B5682D45332248CAA6FA658BA3B3B6FFACC7C6E4D815D3CEE3507D4EC093B0F44CC3694A6B
Malicious:	false
Reputation:	low
Preview:	/tmp/evYVOXt11H.elf.

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.274297268365395
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	evYVOXt11H.elf
File size:	123'584 bytes
MD5:	b46fb6bd9878b366ff4e2c38c4e90fdd
SHA1:	78d0ff7fe412313e32130e6b51ab34ae0cd8061a
SHA256:	a73c944d0b1b5e6a1740ef4d8da44753f4094859112fa27a51108aa098e59126
SHA512:	1d167a5550c9f2428c2ad81289a737df75cb6563a5fd0e2832fc956838df5ff84e3f8a6cc58a77df3e6f2a4b616009942198c9ec3d29a2b9e375074f3a08b9a8
SSDEEP:	1536:caWQdSLnIcekLGZbRovOhmlwCoKlOAXnYsp6nj/G9UUWzXTp9pj+ca2:cOSxLGsUmlwClr7p6nkUUWTTpD+ca
TLSH:	E4C37C73D8696FA8D165D0B0B0758F782F53A58082871FBE19B6C2B94483D8DFA057F8
File Content Preview:	.ELF.....................@.4...........4. ...(...............@...@.p...p...............t...t.B.t.B.PI..............Q.td............................././"O.n........#.@........#.*@,m...o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	123144
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x16d40	0x0	0x6	AX	32
.fini	PROGBITS	0x416e20	0x16e20	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x416e44	0x16e44	0x292c	0x0	0x2	A	4
.ctors	PROGBITS	0x429774	0x19774	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x429780	0x19780	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x4297a0	0x197a0	0x4910	0x0	0x3	WA	32
.got	PROGBITS	0x42e0b0	0x1e0b0	0x14	0x4	0x3	WA	4
.bss	NOBITS	0x42e0c4	0x1e0c4	0x46bc	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1e0c4	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x19770	0x19770	6.9146	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x19774	0x429774	0x429774	0x4950	0x900c	0.4174	0x6	RW	0x10000	.ctors .dtors .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:39:34.977132082 CEST	36496	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:35.330699921 CEST	29989	36496	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:35.330807924 CEST	36496	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:35.331022024 CEST	36496	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:35.683772087 CEST	29989	36496	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:35.683860064 CEST	29989	36496	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:35.684379101 CEST	36496	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:36.038204908 CEST	29989	36496	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:42.800729036 CEST	36498	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:43.165348053 CEST	29989	36498	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:43.165477991 CEST	36498	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:43.165477991 CEST	36498	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:43.530303955 CEST	29989	36498	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:43.530381918 CEST	29989	36498	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:43.530503035 CEST	36498	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:43.895399094 CEST	29989	36498	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:49.635622025 CEST	36500	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:49.980947971 CEST	29989	36500	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:49.981043100 CEST	36500	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:49.981131077 CEST	36500	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:50.326992035 CEST	29989	36500	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:50.327068090 CEST	29989	36500	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:50.327313900 CEST	36500	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:50.675369024 CEST	29989	36500	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:55.434983015 CEST	36502	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:55.822772980 CEST	29989	36502	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:55.822854042 CEST	36502	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:55.822942019 CEST	36502	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:56.211277008 CEST	29989	36502	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:56.211489916 CEST	29989	36502	103.174.73.85	192.168.2.15
Apr 19, 2024 11:39:56.211586952 CEST	36502	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:39:56.599946976 CEST	29989	36502	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:01.316817999 CEST	36504	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:01.674371004 CEST	29989	36504	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:01.674601078 CEST	36504	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:01.674601078 CEST	36504	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:02.032825947 CEST	29989	36504	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:02.032860041 CEST	29989	36504	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:02.033158064 CEST	36504	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:02.390345097 CEST	29989	36504	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:04.141510010 CEST	36506	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:04.499187946 CEST	29989	36506	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:04.499326944 CEST	36506	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:04.499371052 CEST	36506	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:04.856596947 CEST	29989	36506	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:04.856743097 CEST	29989	36506	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:04.856853962 CEST	36506	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:05.213704109 CEST	29989	36506	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:12.963816881 CEST	36508	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:13.342401981 CEST	29989	36508	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:13.342535019 CEST	36508	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:13.342607975 CEST	36508	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:13.720417023 CEST	29989	36508	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:13.720447063 CEST	29989	36508	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:13.720580101 CEST	36508	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:14.098098993 CEST	29989	36508	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:17.830640078 CEST	36510	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:18.189969063 CEST	29989	36510	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:18.190105915 CEST	36510	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:18.190191984 CEST	36510	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:18.549365044 CEST	29989	36510	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:18.549417019 CEST	29989	36510	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:18.549581051 CEST	36510	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:18.909709930 CEST	29989	36510	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:25.655112982 CEST	36512	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:26.002531052 CEST	29989	36512	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:26.002665043 CEST	36512	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:26.002749920 CEST	36512	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:26.348967075 CEST	29989	36512	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:26.349483967 CEST	29989	36512	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:26.349517107 CEST	29989	36512	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:32.455394983 CEST	36514	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:32.823889017 CEST	29989	36514	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:32.824217081 CEST	36514	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:32.824217081 CEST	36514	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:33.194268942 CEST	29989	36514	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:33.194320917 CEST	29989	36514	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:33.194483995 CEST	36514	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:33.563757896 CEST	29989	36514	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:37.300071955 CEST	36516	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:37.654433012 CEST	29989	36516	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:37.654711008 CEST	36516	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:37.654711008 CEST	36516	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:38.009673119 CEST	29989	36516	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:38.009748936 CEST	29989	36516	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:38.009975910 CEST	36516	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:38.364675999 CEST	29989	36516	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:40.115499020 CEST	36518	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:40.481642008 CEST	29989	36518	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:40.481781960 CEST	36518	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:40.481827021 CEST	36518	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:40.848666906 CEST	29989	36518	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:40.848715067 CEST	29989	36518	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:40.848952055 CEST	36518	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:41.217315912 CEST	29989	36518	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:44.954499006 CEST	36520	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:45.303883076 CEST	29989	36520	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:45.304121017 CEST	36520	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:45.304162025 CEST	36520	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:45.653520107 CEST	29989	36520	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:45.653546095 CEST	29989	36520	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:45.653673887 CEST	36520	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:46.002454996 CEST	29989	36520	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:54.762706041 CEST	36522	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:55.118659973 CEST	29989	36522	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:55.118947983 CEST	36522	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:55.118947983 CEST	36522	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:55.475610971 CEST	29989	36522	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:55.475649118 CEST	29989	36522	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:55.475815058 CEST	36522	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:55.831448078 CEST	29989	36522	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:58.581796885 CEST	36524	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:58.948800087 CEST	29989	36524	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:58.948971033 CEST	36524	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:58.949070930 CEST	36524	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:40:59.313299894 CEST	29989	36524	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:59.313370943 CEST	29989	36524	103.174.73.85	192.168.2.15
Apr 19, 2024 11:40:59.313565969 CEST	36524	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:00.267898083 CEST	36524	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:00.419116020 CEST	36526	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:00.631175995 CEST	29989	36524	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:00.782280922 CEST	29989	36526	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:00.782411098 CEST	36526	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:00.782499075 CEST	36526	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:01.146544933 CEST	29989	36526	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:01.146580935 CEST	29989	36526	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:01.146795988 CEST	36526	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:01.512794018 CEST	29989	36526	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:09.252140999 CEST	36528	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:09.602473021 CEST	29989	36528	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:09.602597952 CEST	36528	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:09.602714062 CEST	36528	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:09.952903032 CEST	29989	36528	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:09.953025103 CEST	29989	36528	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:09.953227043 CEST	36528	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:10.304025888 CEST	29989	36528	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:16.058940887 CEST	36530	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:16.427855015 CEST	29989	36530	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:16.427988052 CEST	36530	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:16.428096056 CEST	36530	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:16.796814919 CEST	29989	36530	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:16.797027111 CEST	29989	36530	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:16.797224045 CEST	36530	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:17.166558981 CEST	29989	36530	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:25.902487993 CEST	36532	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:26.285763979 CEST	29989	36532	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:26.285898924 CEST	36532	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:26.285986900 CEST	36532	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:26.668986082 CEST	29989	36532	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:26.669111967 CEST	29989	36532	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:26.669215918 CEST	36532	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:27.052079916 CEST	29989	36532	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:31.774508953 CEST	36534	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:32.155980110 CEST	29989	36534	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:32.156137943 CEST	36534	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:32.156248093 CEST	36534	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:32.537138939 CEST	29989	36534	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:32.537189960 CEST	29989	36534	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:32.537532091 CEST	36534	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:32.918529987 CEST	29989	36534	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:34.642905951 CEST	36536	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:35.010027885 CEST	29989	36536	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:35.010164022 CEST	36536	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:35.010420084 CEST	36536	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:35.378712893 CEST	29989	36536	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:35.378957033 CEST	36536	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:35.379190922 CEST	29989	36536	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:35.746009111 CEST	29989	36536	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:37.484534979 CEST	36538	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:37.861511946 CEST	29989	36538	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:37.861625910 CEST	36538	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:37.861696005 CEST	36538	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:38.238440990 CEST	29989	36538	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:38.238476038 CEST	29989	36538	103.174.73.85	192.168.2.15
Apr 19, 2024 11:41:38.238663912 CEST	36538	29989	192.168.2.15	103.174.73.85
Apr 19, 2024 11:41:38.616086006 CEST	29989	36538	103.174.73.85	192.168.2.15

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:39:34.868920088 CEST	33769	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:39:34.976656914 CEST	53	33769	8.8.8.8	192.168.2.15
Apr 19, 2024 11:39:42.684504032 CEST	34191	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:39:42.800610065 CEST	53	34191	8.8.8.8	192.168.2.15
Apr 19, 2024 11:39:49.530530930 CEST	45577	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:39:49.635472059 CEST	53	45577	8.8.8.8	192.168.2.15
Apr 19, 2024 11:39:55.327204943 CEST	57466	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:39:55.434855938 CEST	53	57466	8.8.8.8	192.168.2.15
Apr 19, 2024 11:40:01.211653948 CEST	34033	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:40:01.316639900 CEST	53	34033	8.8.8.8	192.168.2.15
Apr 19, 2024 11:40:04.033235073 CEST	45272	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:40:04.141330004 CEST	53	45272	8.8.8.8	192.168.2.15
Apr 19, 2024 11:40:12.856898069 CEST	46120	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:40:12.963628054 CEST	53	46120	8.8.8.8	192.168.2.15
Apr 19, 2024 11:40:17.720766068 CEST	34258	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:40:17.830418110 CEST	53	34258	8.8.8.8	192.168.2.15
Apr 19, 2024 11:40:25.549583912 CEST	46262	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:40:25.654961109 CEST	53	46262	8.8.8.8	192.168.2.15
Apr 19, 2024 11:40:32.349780083 CEST	35387	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:40:32.455113888 CEST	53	35387	8.8.8.8	192.168.2.15
Apr 19, 2024 11:40:37.194539070 CEST	51884	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:40:37.299793005 CEST	53	51884	8.8.8.8	192.168.2.15
Apr 19, 2024 11:40:40.010157108 CEST	60763	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:40:40.115165949 CEST	53	60763	8.8.8.8	192.168.2.15
Apr 19, 2024 11:40:44.849203110 CEST	33389	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:40:44.954231024 CEST	53	33389	8.8.8.8	192.168.2.15
Apr 19, 2024 11:40:54.653733969 CEST	48125	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:40:54.762525082 CEST	53	48125	8.8.8.8	192.168.2.15
Apr 19, 2024 11:40:58.475985050 CEST	44084	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:40:58.581528902 CEST	53	44084	8.8.8.8	192.168.2.15
Apr 19, 2024 11:41:00.313836098 CEST	58471	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:41:00.418873072 CEST	53	58471	8.8.8.8	192.168.2.15
Apr 19, 2024 11:41:09.146893978 CEST	37812	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:41:09.251951933 CEST	53	37812	8.8.8.8	192.168.2.15
Apr 19, 2024 11:41:15.953466892 CEST	57559	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:41:16.058656931 CEST	53	57559	8.8.8.8	192.168.2.15
Apr 19, 2024 11:41:25.797363997 CEST	45959	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:41:25.902198076 CEST	53	45959	8.8.8.8	192.168.2.15
Apr 19, 2024 11:41:31.669316053 CEST	42213	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:41:31.774235010 CEST	53	42213	8.8.8.8	192.168.2.15
Apr 19, 2024 11:41:34.537878990 CEST	35218	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:41:34.642613888 CEST	53	35218	8.8.8.8	192.168.2.15
Apr 19, 2024 11:41:37.379209042 CEST	47462	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:41:37.484328032 CEST	53	47462	8.8.8.8	192.168.2.15

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report evYVOXt11H.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00Tqow (deleted)

/tmp/qemu-open.03eP2x (deleted)

/tmp/qemu-open.06HxPw (deleted)

/tmp/qemu-open.06NLxv (deleted)

/tmp/qemu-open.09J2cw (deleted)

/tmp/qemu-open.0BlEIt (deleted)

/tmp/qemu-open.0FR4Sw (deleted)

/tmp/qemu-open.0GRcWx (deleted)

/tmp/qemu-open.0QLZVt (deleted)

/tmp/qemu-open.0TtVsx (deleted)

/tmp/qemu-open.0ZXdow (deleted)

/tmp/qemu-open.0be7Iw (deleted)

/tmp/qemu-open.0ceOQt (deleted)

/tmp/qemu-open.0npgAu (deleted)

/tmp/qemu-open.0rTbeu (deleted)

/tmp/qemu-open.0rl5Cx (deleted)

/tmp/qemu-open.0uBDcx (deleted)

/tmp/qemu-open.10IWAw (deleted)

/tmp/qemu-open.1BBbSt (deleted)

/tmp/qemu-open.1Ey05v (deleted)

/tmp/qemu-open.1GQt4w (deleted)

/tmp/qemu-open.1UMIau (deleted)

/tmp/qemu-open.1Vu4eu (deleted)

/tmp/qemu-open.1XSIwv (deleted)

/tmp/qemu-open.1Xomeu (deleted)

/tmp/qemu-open.1ZezJw (deleted)

/tmp/qemu-open.1aUdNv (deleted)

/tmp/qemu-open.1jKGBx (deleted)

/tmp/qemu-open.1lfdkx (deleted)

/tmp/qemu-open.1mMs4w (deleted)

Linux Analysis Report
evYVOXt11H.elf

Start time (UTC):	09:39:33
Start date (UTC):	19/04/2024
Path:	/tmp/evYVOXt11H.elf
Arguments:	/tmp/evYVOXt11H.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	09:39:34
Start date (UTC):	19/04/2024
Path:	/tmp/evYVOXt11H.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre