Edit tour

Linux Analysis Report
qbmHR5ZIJL.elf

Overview

General Information

Sample name:	qbmHR5ZIJL.elf renamed because original name is a hash value
Original sample name:	da798e31e01373372df2e0276f9a9725.elf
Analysis ID:	1428678
MD5:	da798e31e01373372df2e0276f9a9725
SHA1:	2c4e927dd235c6e78fc8ff4bbd5317fc5f77a716
SHA256:	7c7b46bfae0430c15d7ad1e68cb87428d0f54e12fade168836a9c92956c1a57a
Tags:	32elfmiraimotorola
Infos:

Detection

Mirai, Moobot, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Moobot

Yara detected Okiru

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428678
Start date and time:	2024-04-19 11:45:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	qbmHR5ZIJL.elf renamed because original name is a hash value
Original Sample Name:	da798e31e01373372df2e0276f9a9725.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1026@23/0

Runtime Messages

Command:	/tmp/qbmHR5ZIJL.elf
PID:	6259
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

qbmHR5ZIJL.elf (PID: 6259, Parent: 6183, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/qbmHR5ZIJL.elf

qbmHR5ZIJL.elf New Fork (PID: 6261, Parent: 6259)

qbmHR5ZIJL.elf New Fork (PID: 6263, Parent: 6261)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
qbmHR5ZIJL.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
qbmHR5ZIJL.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
qbmHR5ZIJL.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
qbmHR5ZIJL.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1f46a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f47e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f492:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f4a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f4ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f4ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f4e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f4f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f50a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f51e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f532:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f546:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f55a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f56e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f582:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f596:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f5aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f5be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f5d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f5e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f5fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6259.1.00007fc9cc001000.00007fc9cc023000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6259.1.00007fc9cc001000.00007fc9cc023000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6259.1.00007fc9cc001000.00007fc9cc023000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6259.1.00007fc9cc001000.00007fc9cc023000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1f46a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f47e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f492:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f4a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f4ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f4ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f4e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f4f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f50a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f51e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f532:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f546:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f55a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f56e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f582:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f596:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f5aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f5be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f5d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f5e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f5fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: qbmHR5ZIJL.elf PID: 6259	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: qbmHR5ZIJL.elf PID: 6259	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: qbmHR5ZIJL.elf PID: 6259	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: qbmHR5ZIJL.elf PID: 6259	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x161c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1644:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1658:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x166c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1680:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1694:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:46:28.658140
SID:	2030490
Source Port:	35114
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:54.170000
SID:	2030490
Source Port:	35146
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:46:57.945521
SID:	2030490
Source Port:	35124
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:46:19.764752
SID:	2030490
Source Port:	35112
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:46:35.548373
SID:	2030490
Source Port:	35116
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:24.104529
SID:	2030490
Source Port:	35134
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:34.769246
SID:	2030490
Source Port:	35138
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:48:19.352592
SID:	2030490
Source Port:	35156
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:41.609312
SID:	2030490
Source Port:	35140
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:58.035055
SID:	2030490
Source Port:	35148
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:04.771039
SID:	2030490
Source Port:	35126
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:32.928026
SID:	2030490
Source Port:	35136
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:48:03.895076
SID:	2030490
Source Port:	35150
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:14.443836
SID:	2030490
Source Port:	35130
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:48:05.715385
SID:	2030490
Source Port:	35152
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:46:41.386303
SID:	2030490
Source Port:	35118
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:46.457982
SID:	2030490
Source Port:	35142
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:46:46.250836
SID:	2030490
Source Port:	35120
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:08.626211
SID:	2030490
Source Port:	35128
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:22.264796
SID:	2030490
Source Port:	35132
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:52.317507
SID:	2030490
Source Port:	35144
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:46:56.110032
SID:	2030490
Source Port:	35122
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:48:12.520230
SID:	2030490
Source Port:	35154
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: HTTP/1.1 200 OKbulus.armbulus.arm5bulus.arm6bulus.arm7bulus.mipsbulus.mpslbulus.x86_64bulus.sh4abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/proc/%d/exe/tmp/%s%s%c/proc/self/cmdline/proc/%d/proc/self/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofia/var/Bulusshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/3f

Source: qbmHR5ZIJL.elf	ReversingLabs: Detection: 57%
Source: qbmHR5ZIJL.elf	Virustotal: Detection: 53%			Perma Link

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35112 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35114 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35116 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35118 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35120 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35122 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35124 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35126 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35128 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35130 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35132 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35134 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35136 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35138 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35140 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35142 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35144 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35146 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35148 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35150 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35152 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35154 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:35156 -> 103.174.73.85:29989

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: qbmHR5ZIJL.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6259.1.00007fc9cc001000.00007fc9cc023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: qbmHR5ZIJL.elf PID: 6259, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKbulus.armbulus.arm5bulus.arm6bulus.arm7bulus.mipsbulus.mpslbulus.x86_64bulus.sh4abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/proc/%d/exe/tmp/%s%s%c/proc/self/cmdline/proc/%d/proc/self/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-servershellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofia/var/Bulusshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/3f

Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/5948/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/4500/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/4502/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/qbmHR5ZIJL.elf (PID: 6263)	File opened: /proc/35/cmdline	Jump to behavior

Source: qbmHR5ZIJL.elf, 6259.1.00007ffdd175b000.00007ffdd177c000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/qbmHR5ZIJL.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/qbmHR5ZIJL.elf
Source: qbmHR5ZIJL.elf, 6259.1.00007ffdd175b000.00007ffdd177c000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: qbmHR5ZIJL.elf, 6259.1.0000560685b69000.0000560685bee000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: qbmHR5ZIJL.elf, 6259.1.0000560685b69000.0000560685bee000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/m68k

Source: Yara match	File source: qbmHR5ZIJL.elf, type: SAMPLE
Source: Yara match	File source: 6259.1.00007fc9cc001000.00007fc9cc023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qbmHR5ZIJL.elf PID: 6259, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
qbmHR5ZIJL.elf	58%	ReversingLabs	Linux.Trojan.Mirai
qbmHR5ZIJL.elf	53%	Virustotal		Browse
qbmHR5ZIJL.elf	100%	Avira	EXP/ELF.Mirai.Z.A

IP	Domain	Country	ASN	ASN Name	Malicious
103.174.73.85	proxy.heleh.vn	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.174.73.85	qIEANK2huJ.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse
	evYVOXt11H.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse
	BxEMaAYhqP.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse
	9PYUxFx9pK.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse
	bulus.arm7.elf	Get hash	malicious	Mirai	Browse
	bulus.arm5.elf	Get hash	malicious	Mirai	Browse
	bulus.arm.elf	Get hash	malicious	Mirai	Browse
	bulus.x86.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	FZqYclxRiu.elf	Get hash	malicious	Mirai, Okiru	Browse
	qlt52dfogC.elf	Get hash	malicious	Mirai, Okiru	Browse
	46t2vW6nO9.elf	Get hash	malicious	Mirai, Okiru	Browse
	l1uxT537eS.elf	Get hash	malicious	Unknown	Browse
	4wngRroxli.elf	Get hash	malicious	Mirai	Browse
	XioVUcbE3G.elf	Get hash	malicious	Unknown	Browse
	85x5rW00VC.elf	Get hash	malicious	Gafgyt	Browse
	BLrwZkQmAq.elf	Get hash	malicious	Mirai	Browse
	P6VjwulCEv.elf	Get hash	malicious	Gafgyt	Browse
	S7AqbuIfHT.elf	Get hash	malicious	Gafgyt	Browse
91.189.91.43	qlt52dfogC.elf	Get hash	malicious	Mirai, Okiru	Browse
	46t2vW6nO9.elf	Get hash	malicious	Mirai, Okiru	Browse
	l1uxT537eS.elf	Get hash	malicious	Unknown	Browse
	4wngRroxli.elf	Get hash	malicious	Mirai	Browse
	XioVUcbE3G.elf	Get hash	malicious	Unknown	Browse
	85x5rW00VC.elf	Get hash	malicious	Gafgyt	Browse
	P6VjwulCEv.elf	Get hash	malicious	Gafgyt	Browse
	S7AqbuIfHT.elf	Get hash	malicious	Gafgyt	Browse
	vlxx.mpsl-20240418-1854.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.x86-20240418-1853.elf	Get hash	malicious	Mirai, Okiru	Browse
91.189.91.42	FZqYclxRiu.elf	Get hash	malicious	Mirai, Okiru	Browse
	qlt52dfogC.elf	Get hash	malicious	Mirai, Okiru	Browse
	46t2vW6nO9.elf	Get hash	malicious	Mirai, Okiru	Browse
	l1uxT537eS.elf	Get hash	malicious	Unknown	Browse
	4wngRroxli.elf	Get hash	malicious	Mirai	Browse
	XioVUcbE3G.elf	Get hash	malicious	Unknown	Browse
	85x5rW00VC.elf	Get hash	malicious	Gafgyt	Browse
	BLrwZkQmAq.elf	Get hash	malicious	Mirai	Browse
	P6VjwulCEv.elf	Get hash	malicious	Gafgyt	Browse
	S7AqbuIfHT.elf	Get hash	malicious	Gafgyt	Browse

Process:	/tmp/qbmHR5ZIJL.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:Tg6/s4:Tg6/h
MD5:	2A8231AA81E6CCCF8F182C8701ACBC88
SHA1:	4FBBE9E9A7193DB713284203148F473B620CCEC8
SHA-256:	9A3951B1513EE92E4DCDAC1945A7004AB27AF53ACBE5F3CA2D536B500378B64F
SHA-512:	A1C7100904964F4ADC70CEAC588505940C0E274BD8223DFDCAED4CBC93D39A0B4910F993C02A0C6A9985F45C9E9276DAAC83696679C20714E254C880558D018A
Malicious:	false
Reputation:	low
Preview:	/tmp/qbmHR5ZIJL.elf.

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.729478143764802
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	qbmHR5ZIJL.elf
File size:	157'376 bytes
MD5:	da798e31e01373372df2e0276f9a9725
SHA1:	2c4e927dd235c6e78fc8ff4bbd5317fc5f77a716
SHA256:	7c7b46bfae0430c15d7ad1e68cb87428d0f54e12fade168836a9c92956c1a57a
SHA512:	041d72905ace5093d6a2554853a1deb091b77871e04590e0d0b9ddd2bc777c134290463170b6d8c3d37d053047dcd61208b1fed9f816821167e39f713cb07b8c
SSDEEP:	3072:/OpmdUFBbqEcCnIWGYDsdrI9aPr2PVrjbi9L9GaN6yOG8CU:GpmiqZAspIAr2gL9G3yOHCU
TLSH:	FEF33BC7F800DEFAF80AE33648530909B130B7D215925B373257797BED3A1991967E86
File Content Preview:	.ELF.......................D...4..e0.....4. ...(.................................. ...........;...;...I(.......... .dt.Q............................NV..a....da....LN^NuNV..J9....f>"y..;. QJ.g.X.#...;.N."y..;. QJ.f.A.....J.g.Hy....N.X.........N^NuNV..N^NuN

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	156976
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x1f276	0x0	0x6	AX	4
.fini	PROGBITS	0x8001f31e	0x1f31e	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x8001f32c	0x1f32c	0x2896	0x0	0x2	A	2
.ctors	PROGBITS	0x80023bc8	0x21bc8	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x80023bd4	0x21bd4	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80023be0	0x21be0	0x4910	0x0	0x3	WA	32
.bss	NOBITS	0x800284f0	0x264f0	0x4660	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x264f0	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x21bc2	0x21bc2	6.1464	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x21bc8	0x80023bc8	0x80023bc8	0x4928	0x8f88	0.4512	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report qbmHR5ZIJL.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00WnoM (deleted)

/tmp/qemu-open.02klPM (deleted)

/tmp/qemu-open.0LNKfK (deleted)

/tmp/qemu-open.0OKYrN (deleted)

/tmp/qemu-open.0PGCrO (deleted)

/tmp/qemu-open.0PnHGO (deleted)

/tmp/qemu-open.0Q2uTK (deleted)

/tmp/qemu-open.0V8FXM (deleted)

/tmp/qemu-open.0VovtK (deleted)

/tmp/qemu-open.0Vtc0M (deleted)

/tmp/qemu-open.0XsPlM (deleted)

/tmp/qemu-open.0YYZTL (deleted)

/tmp/qemu-open.0iB9sN (deleted)

/tmp/qemu-open.0jcY9J (deleted)

/tmp/qemu-open.0kno9N (deleted)

/tmp/qemu-open.0ngLKN (deleted)

/tmp/qemu-open.0qQ0KL (deleted)

/tmp/qemu-open.0wVFhO (deleted)

/tmp/qemu-open.0wvIoL (deleted)

/tmp/qemu-open.0zzxUM (deleted)

/tmp/qemu-open.11FUVM (deleted)

/tmp/qemu-open.12Ea7L (deleted)

/tmp/qemu-open.162DtL (deleted)

/tmp/qemu-open.1AKKUL (deleted)

/tmp/qemu-open.1BYSsM (deleted)

/tmp/qemu-open.1EUPkM (deleted)

/tmp/qemu-open.1QKbxL (deleted)

/tmp/qemu-open.1SZJxK (deleted)

/tmp/qemu-open.1THWyL (deleted)

/tmp/qemu-open.1UAgkL (deleted)

Linux Analysis Report
qbmHR5ZIJL.elf

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:46:19.368419886 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 19, 2024 11:46:19.388123035 CEST	35112	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:19.764450073 CEST	29989	35112	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:19.764563084 CEST	35112	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:19.764751911 CEST	35112	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:20.142278910 CEST	29989	35112	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:20.142339945 CEST	29989	35112	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:20.142924070 CEST	35112	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:20.519335032 CEST	29989	35112	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:24.743680000 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 19, 2024 11:46:25.511570930 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 19, 2024 11:46:28.249310017 CEST	35114	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:28.656217098 CEST	29989	35114	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:28.658139944 CEST	35114	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:28.658139944 CEST	35114	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:29.067353010 CEST	29989	35114	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:30.090802908 CEST	29989	35114	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:30.090931892 CEST	35114	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:30.496738911 CEST	29989	35114	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:35.195597887 CEST	35116	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:35.548233986 CEST	29989	35116	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:35.548299074 CEST	35116	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:35.548372984 CEST	35116	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:35.900429964 CEST	29989	35116	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:35.900456905 CEST	29989	35116	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:35.900546074 CEST	35116	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:36.253026962 CEST	29989	35116	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:40.005126953 CEST	35118	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:40.101573944 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 19, 2024 11:46:41.029454947 CEST	35118	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:41.386157990 CEST	29989	35118	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:41.386224031 CEST	35118	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:41.386302948 CEST	35118	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:41.404192924 CEST	29989	35118	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:41.404236078 CEST	35118	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:41.760762930 CEST	29989	35118	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:41.760782003 CEST	29989	35118	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:41.760885000 CEST	35118	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:42.134819031 CEST	29989	35118	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:45.868671894 CEST	35120	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:46.250595093 CEST	29989	35120	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:46.250835896 CEST	35120	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:46.250835896 CEST	35120	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:46.631033897 CEST	29989	35120	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:46.631053925 CEST	29989	35120	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:46.631304026 CEST	35120	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:47.012378931 CEST	29989	35120	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:50.340296984 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 19, 2024 11:46:55.734946012 CEST	35122	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:56.109639883 CEST	29989	35122	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:56.109780073 CEST	35122	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:56.110032082 CEST	35122	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:56.482147932 CEST	29989	35122	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:56.482455015 CEST	35122	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:56.482650995 CEST	29989	35122	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:56.483330011 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 19, 2024 11:46:56.854479074 CEST	29989	35122	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:57.587762117 CEST	35124	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:57.945242882 CEST	29989	35124	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:57.945521116 CEST	35124	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:57.945521116 CEST	35124	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:58.303242922 CEST	29989	35124	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:58.303307056 CEST	29989	35124	103.174.73.85	192.168.2.23
Apr 19, 2024 11:46:58.303489923 CEST	35124	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:46:58.661326885 CEST	29989	35124	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:04.409280062 CEST	35126	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:04.770872116 CEST	29989	35126	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:04.771039009 CEST	35126	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:04.771039009 CEST	35126	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:05.136240959 CEST	29989	35126	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:05.136600971 CEST	29989	35126	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:05.136740923 CEST	35126	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:05.498322010 CEST	29989	35126	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:08.244801998 CEST	35128	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:08.626012087 CEST	29989	35128	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:08.626210928 CEST	35128	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:08.626210928 CEST	35128	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:09.002126932 CEST	29989	35128	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:09.002186060 CEST	29989	35128	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:09.002449036 CEST	35128	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:09.378752947 CEST	29989	35128	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:14.107140064 CEST	35130	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:14.443625927 CEST	29989	35130	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:14.443835974 CEST	35130	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:14.443835974 CEST	35130	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:14.780569077 CEST	29989	35130	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:14.780606031 CEST	29989	35130	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:14.780770063 CEST	35130	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:15.117785931 CEST	29989	35130	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:21.056149960 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 19, 2024 11:47:21.885391951 CEST	35132	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:22.264609098 CEST	29989	35132	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:22.264796019 CEST	35132	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:22.264796019 CEST	35132	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:22.644499063 CEST	29989	35132	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:22.644531965 CEST	29989	35132	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:22.644752979 CEST	35132	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:23.024408102 CEST	29989	35132	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:23.750348091 CEST	35134	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:24.104356050 CEST	29989	35134	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:24.104482889 CEST	35134	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:24.104528904 CEST	35134	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:24.458421946 CEST	29989	35134	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:24.458486080 CEST	29989	35134	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:24.458697081 CEST	35134	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:24.811836958 CEST	29989	35134	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:32.563304901 CEST	35136	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:32.927809954 CEST	29989	35136	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:32.928025007 CEST	35136	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:32.928025961 CEST	35136	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:33.292407990 CEST	29989	35136	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:33.292462111 CEST	29989	35136	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:33.292701960 CEST	35136	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:33.657063961 CEST	29989	35136	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:34.398042917 CEST	35138	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:34.769005060 CEST	29989	35138	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:34.769246101 CEST	35138	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:34.769246101 CEST	35138	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:35.141566038 CEST	29989	35138	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:35.141624928 CEST	29989	35138	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:35.141885996 CEST	35138	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:35.513623953 CEST	29989	35138	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:41.246304989 CEST	35140	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:41.533260107 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 19, 2024 11:47:41.609148026 CEST	29989	35140	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:41.609250069 CEST	35140	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:41.609312057 CEST	35140	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:41.972184896 CEST	29989	35140	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:41.972220898 CEST	29989	35140	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:41.972377062 CEST	35140	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:42.337148905 CEST	29989	35140	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:46.077377081 CEST	35142	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:46.457643032 CEST	29989	35142	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:46.457982063 CEST	35142	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:46.457982063 CEST	35142	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:46.837337017 CEST	29989	35142	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:46.837784052 CEST	29989	35142	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:46.837910891 CEST	35142	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:47.217020035 CEST	29989	35142	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:51.943263054 CEST	35144	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:52.316968918 CEST	29989	35144	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:52.317507029 CEST	35144	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:52.317507029 CEST	35144	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:52.688744068 CEST	29989	35144	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:52.689241886 CEST	29989	35144	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:52.689723015 CEST	35144	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:53.060787916 CEST	29989	35144	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:53.794627905 CEST	35146	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:54.169728041 CEST	29989	35146	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:54.170000076 CEST	35146	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:54.170000076 CEST	35146	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:54.544476986 CEST	29989	35146	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:54.544635057 CEST	29989	35146	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:54.544874907 CEST	35146	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:54.919533014 CEST	29989	35146	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:57.649804115 CEST	35148	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:58.034660101 CEST	29989	35148	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:58.035007954 CEST	35148	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:58.035054922 CEST	35148	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:58.418672085 CEST	29989	35148	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:58.418740988 CEST	29989	35148	103.174.73.85	192.168.2.23
Apr 19, 2024 11:47:58.418914080 CEST	35148	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:58.418914080 CEST	35148	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:47:58.801786900 CEST	29989	35148	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:03.523987055 CEST	35150	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:03.894785881 CEST	29989	35150	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:03.894963980 CEST	35150	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:03.895076036 CEST	35150	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:04.267872095 CEST	29989	35150	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:04.268055916 CEST	29989	35150	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:04.268198013 CEST	35150	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:04.639085054 CEST	29989	35150	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:05.373858929 CEST	35152	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:05.715183973 CEST	29989	35152	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:05.715339899 CEST	35152	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:05.715384960 CEST	35152	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:06.056233883 CEST	29989	35152	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:06.056679964 CEST	29989	35152	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:06.056850910 CEST	35152	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:06.397850037 CEST	29989	35152	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:12.161858082 CEST	35154	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:12.519911051 CEST	29989	35154	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:12.520167112 CEST	35154	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:12.520230055 CEST	35154	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:12.884342909 CEST	29989	35154	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:12.884408951 CEST	29989	35154	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:12.884658098 CEST	35154	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:13.244285107 CEST	29989	35154	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:18.988980055 CEST	35156	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:19.352274895 CEST	29989	35156	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:19.352591991 CEST	35156	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:19.352591991 CEST	35156	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:19.715864897 CEST	29989	35156	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:20.652420044 CEST	29989	35156	103.174.73.85	192.168.2.23
Apr 19, 2024 11:48:20.652879000 CEST	35156	29989	192.168.2.23	103.174.73.85
Apr 19, 2024 11:48:21.016408920 CEST	29989	35156	103.174.73.85	192.168.2.23

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:46:19.282406092 CEST	53282	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:46:19.387676954 CEST	53	53282	8.8.8.8	192.168.2.23
Apr 19, 2024 11:46:28.142127037 CEST	59760	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:46:28.247420073 CEST	53	59760	8.8.8.8	192.168.2.23
Apr 19, 2024 11:46:35.090476990 CEST	34843	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:46:35.195501089 CEST	53	34843	8.8.8.8	192.168.2.23
Apr 19, 2024 11:46:39.900175095 CEST	59435	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:46:40.005013943 CEST	53	59435	8.8.8.8	192.168.2.23
Apr 19, 2024 11:46:45.760659933 CEST	38604	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:46:45.868391037 CEST	53	38604	8.8.8.8	192.168.2.23
Apr 19, 2024 11:46:55.630218029 CEST	44851	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:46:55.734751940 CEST	53	44851	8.8.8.8	192.168.2.23
Apr 19, 2024 11:46:57.482408047 CEST	37726	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:46:57.587480068 CEST	53	37726	8.8.8.8	192.168.2.23
Apr 19, 2024 11:47:04.302871943 CEST	44827	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:47:04.408421993 CEST	53	44827	8.8.8.8	192.168.2.23
Apr 19, 2024 11:47:08.136662960 CEST	54141	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:47:08.244466066 CEST	53	54141	8.8.8.8	192.168.2.23
Apr 19, 2024 11:47:14.001898050 CEST	58330	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:47:14.106942892 CEST	53	58330	8.8.8.8	192.168.2.23
Apr 19, 2024 11:47:21.780096054 CEST	35446	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:47:21.885241985 CEST	53	35446	8.8.8.8	192.168.2.23
Apr 19, 2024 11:47:23.644915104 CEST	57943	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:47:23.750155926 CEST	53	57943	8.8.8.8	192.168.2.23
Apr 19, 2024 11:47:32.457900047 CEST	40841	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:47:32.563016891 CEST	53	40841	8.8.8.8	192.168.2.23
Apr 19, 2024 11:47:34.292742014 CEST	54576	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:47:34.397388935 CEST	53	54576	8.8.8.8	192.168.2.23
Apr 19, 2024 11:47:41.141146898 CEST	39834	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:47:41.246133089 CEST	53	39834	8.8.8.8	192.168.2.23
Apr 19, 2024 11:47:45.972111940 CEST	46934	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:47:46.077110052 CEST	53	46934	8.8.8.8	192.168.2.23
Apr 19, 2024 11:47:51.837536097 CEST	38035	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:47:51.942903042 CEST	53	38035	8.8.8.8	192.168.2.23
Apr 19, 2024 11:47:53.689685106 CEST	60561	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:47:53.794404984 CEST	53	60561	8.8.8.8	192.168.2.23
Apr 19, 2024 11:47:57.544579983 CEST	32779	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:47:57.649548054 CEST	53	32779	8.8.8.8	192.168.2.23
Apr 19, 2024 11:48:03.418499947 CEST	41475	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:48:03.523722887 CEST	53	41475	8.8.8.8	192.168.2.23
Apr 19, 2024 11:48:05.268237114 CEST	49624	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:48:05.373689890 CEST	53	49624	8.8.8.8	192.168.2.23
Apr 19, 2024 11:48:12.056190014 CEST	32901	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:48:12.161468983 CEST	53	32901	8.8.8.8	192.168.2.23
Apr 19, 2024 11:48:18.884013891 CEST	35159	53	192.168.2.23	8.8.8.8
Apr 19, 2024 11:48:18.988790035 CEST	53	35159	8.8.8.8	192.168.2.23

Start time (UTC):	09:46:18
Start date (UTC):	19/04/2024
Path:	/tmp/qbmHR5ZIJL.elf
Arguments:	/tmp/qbmHR5ZIJL.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre