Edit tour

Linux Analysis Report
vxYiJd3ok8.elf

Overview

General Information

Sample name:	vxYiJd3ok8.elf renamed because original name is a hash value
Original sample name:	ccd40e18f52d432f8fc29f92eecc5d57.elf
Analysis ID:	1428680
MD5:	ccd40e18f52d432f8fc29f92eecc5d57
SHA1:	5afe593677a05ba5da5562fbea897b2dc26e59ce
SHA256:	0dca8044f53332b2c7d17743bda27cf18c63094829adb637dd35a95b55e5e88a
Tags:	32elfmipsmirai
Infos:

Detection

Mirai, Moobot, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Moobot

Yara detected Okiru

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428680
Start date and time:	2024-04-19 11:46:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	vxYiJd3ok8.elf renamed because original name is a hash value
Original Sample Name:	ccd40e18f52d432f8fc29f92eecc5d57.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1026@21/0

Runtime Messages

Command:	/tmp/vxYiJd3ok8.elf
PID:	5489
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

vxYiJd3ok8.elf (PID: 5489, Parent: 5412, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/vxYiJd3ok8.elf

vxYiJd3ok8.elf New Fork (PID: 5491, Parent: 5489)

vxYiJd3ok8.elf New Fork (PID: 5493, Parent: 5491)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
vxYiJd3ok8.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
vxYiJd3ok8.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
vxYiJd3ok8.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
vxYiJd3ok8.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x24cbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24cd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24ce4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24cf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24dac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24dc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24dd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24de8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24dfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24e10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24e24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24e38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24e4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5489.1.00007f82d4400000.00007f82d4428000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5489.1.00007f82d4400000.00007f82d4428000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
5489.1.00007f82d4400000.00007f82d4428000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5489.1.00007f82d4400000.00007f82d4428000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x24cbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24cd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24ce4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24cf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24dac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24dc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24dd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24de8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24dfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24e10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24e24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24e38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24e4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: vxYiJd3ok8.elf PID: 5489	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: vxYiJd3ok8.elf PID: 5489	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: vxYiJd3ok8.elf PID: 5489	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: vxYiJd3ok8.elf PID: 5489	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x788d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x78a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x78b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x78c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x78dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x78f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7905:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7919:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x792d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7941:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7955:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7969:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x797d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7991:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x79f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a09:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a1d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:12.945349
SID:	2030490
Source Port:	33862
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:48:46.268029
SID:	2030490
Source Port:	33894
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:48:07.073402
SID:	2030490
Source Port:	33884
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:49:03.789062
SID:	2030490
Source Port:	33900
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:49:12.614510
SID:	2030490
Source Port:	33902
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:48:39.412186
SID:	2030490
Source Port:	33892
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:48:53.127152
SID:	2030490
Source Port:	33896
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:29.272719
SID:	2030490
Source Port:	33870
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:38.955697
SID:	2030490
Source Port:	33874
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:27.441835
SID:	2030490
Source Port:	33868
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:48:01.226654
SID:	2030490
Source Port:	33882
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:37.114521
SID:	2030490
Source Port:	33872
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:48.605072
SID:	2030490
Source Port:	33878
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:25.622969
SID:	2030490
Source Port:	33866
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:48:33.588668
SID:	2030490
Source Port:	33890
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:48:54.958086
SID:	2030490
Source Port:	33898
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:50.407336
SID:	2030490
Source Port:	33880
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:48:22.749644
SID:	2030490
Source Port:	33888
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:14.786828
SID:	2030490
Source Port:	33864
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:48:14.904421
SID:	2030490
Source Port:	33886
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.174.73.85

Timestamp:	04/19/24-11:47:43.786366
SID:	2030490
Source Port:	33876
Destination Port:	29989
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: HTTP/1.1 200 OKbulus.armbulus.arm5bulus.arm6bulus.arm7bulus.mipsbulus.mpslbulus.x86_64bulus.sh4abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/proc/%d/exe/tmp/%s%s%c/proc/self/cmdline/proc/%d/proc/self/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofia/var/Bulusshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/3f

Source: vxYiJd3ok8.elf	Virustotal: Detection: 53%			Perma Link
Source: vxYiJd3ok8.elf	ReversingLabs: Detection: 57%

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33862 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33864 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33866 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33868 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33870 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33872 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33874 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33876 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33878 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33880 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33882 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33884 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33886 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33888 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33890 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33892 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33894 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33896 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33898 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33900 -> 103.174.73.85:29989
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:33902 -> 103.174.73.85:29989

Source: vxYiJd3ok8.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5489.1.00007f82d4400000.00007f82d4428000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: vxYiJd3ok8.elf PID: 5489, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKbulus.armbulus.arm5bulus.arm6bulus.arm7bulus.mipsbulus.mpslbulus.x86_64bulus.sh4abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/proc/%d/exe/tmp/%s%s%c/proc/self/cmdline/proc/%d/proc/self/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofia/var/Bulusshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/3f

Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/3761/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/3762/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/3763/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/vxYiJd3ok8.elf (PID: 5493)	File opened: /proc/262/cmdline	Jump to behavior

Source: vxYiJd3ok8.elf, 5489.1.00005621c3f45000.00005621c3fcc000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: vxYiJd3ok8.elf, 5489.1.00005621c3f45000.00005621c3fcc000.rw-.sdmp	Binary or memory string: !V!/etc/qemu-binfmt/mips
Source: vxYiJd3ok8.elf, 5489.1.00007ffde7033000.00007ffde7054000.rw-.sdmp	Binary or memory string: _:x86_64/usr/bin/qemu-mips/tmp/vxYiJd3ok8.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/vxYiJd3ok8.elf
Source: vxYiJd3ok8.elf, 5489.1.00007ffde7033000.00007ffde7054000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips

Source: Yara match	File source: vxYiJd3ok8.elf, type: SAMPLE
Source: Yara match	File source: 5489.1.00007f82d4400000.00007f82d4428000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vxYiJd3ok8.elf PID: 5489, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
vxYiJd3ok8.elf	53%	Virustotal		Browse
vxYiJd3ok8.elf	58%	ReversingLabs	Linux.Trojan.Mirai
vxYiJd3ok8.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.174.73.85	qbmHR5ZIJL.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse
	qIEANK2huJ.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse
	evYVOXt11H.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse
	BxEMaAYhqP.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse
	9PYUxFx9pK.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse
	bulus.arm7.elf	Get hash	malicious	Mirai	Browse
	bulus.arm5.elf	Get hash	malicious	Mirai	Browse
	bulus.arm.elf	Get hash	malicious	Mirai	Browse
	bulus.x86.elf	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
proxy.heleh.vn	qbmHR5ZIJL.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85
	qIEANK2huJ.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85
	evYVOXt11H.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85
	BxEMaAYhqP.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85
	9PYUxFx9pK.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	qbmHR5ZIJL.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85
	qIEANK2huJ.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85
	evYVOXt11H.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85
	BxEMaAYhqP.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85
	9PYUxFx9pK.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.174.73.85
	BzmhHwFpCV.elf	Get hash	malicious	Mirai	Browse	103.189.218.40
	Gq7FlDf6cE.elf	Get hash	malicious	Mirai	Browse	103.183.144.21
	XY2I8rWLkM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	103.186.117.171
	2020.xls	Get hash	malicious	Remcos, DBatLoader	Browse	103.186.117.171

Process:	/tmp/vxYiJd3ok8.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:TgH1n:TgVn
MD5:	94D2BC67DC3E9F0F0BF7105A0D76B51C
SHA1:	B47F77064F07E9D70A9384CB5DFFE54B08250032
SHA-256:	2967F56B1FB326D1A2B160498E43F0A2BDB89410B1ED39DE951D35BB978B5A14
SHA-512:	32ECE84D7462EC9AF4AB53D91EF5A1046B25B7B3D8CA58C0365C7180DFC8A90BAA8D24FDF67A63B747E34874395D602642EEB90EFAA42A23F9B0274D96894896
Malicious:	false
Reputation:	low
Preview:	/tmp/vxYiJd3ok8.elf.

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.041454819972079
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	vxYiJd3ok8.elf
File size:	186'080 bytes
MD5:	ccd40e18f52d432f8fc29f92eecc5d57
SHA1:	5afe593677a05ba5da5562fbea897b2dc26e59ce
SHA256:	0dca8044f53332b2c7d17743bda27cf18c63094829adb637dd35a95b55e5e88a
SHA512:	599a282c93947f9eab62dab43a5ec06b74e9897d0198173c62f39a1f453c384fa3325f8c74b3c9e78997f58133bd888d96e4695d808238903b09d572811cc92a
SSDEEP:	3072:VdV4dgJHofvGX2U1VUa20Gu7W6i0cSV4zWQHpE5McLU:Vd6dgJHoHGX2U1VUa2K9azBp0MAU
TLSH:	FE04B71E6E228F7DF668873547B78E25976C33D627E1D680E1ACC1105E6038E641FFA8
File Content Preview:	.ELF.....................@.`...4.........4. ...(.............@...@....v`..v`.................F...F....TL............dt.Q............................<...'.I....!'.......................<...'.I....!... ....'9... ......................<...'.I....!........'9J

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	185520
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x249f0	0x0	0x6	AX	16
.fini	PROGBITS	0x424b10	0x24b10	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x424b70	0x24b70	0x2af0	0x0	0x2	A	16
.ctors	PROGBITS	0x468000	0x28000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x46800c	0x2800c	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x468018	0x28018	0xcc	0x0	0x3	WA	4
.data	PROGBITS	0x468100	0x28100	0x4998	0x0	0x3	WA	32
.got	PROGBITS	0x46caa0	0x2caa0	0x9ac	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x46d44c	0x2d44c	0x4c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x46d4a0	0x2d44c	0x4840	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x1290	0x2d44c	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x2d44c	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x27660	0x27660	5.4508	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x28000	0x468000	0x468000	0x544c	0x9ce0	1.1712	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:47:12.587871075 CEST	33862	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:12.944957018 CEST	29989	33862	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:12.945060015 CEST	33862	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:12.945348978 CEST	33862	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:13.302145958 CEST	29989	33862	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:13.302442074 CEST	33862	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:13.302716017 CEST	29989	33862	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:13.658977985 CEST	29989	33862	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:14.409455061 CEST	33864	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:14.786621094 CEST	29989	33864	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:14.786747932 CEST	33864	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:14.786828041 CEST	33864	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:15.165436983 CEST	29989	33864	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:15.165472031 CEST	29989	33864	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:15.165766954 CEST	33864	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:15.543715954 CEST	29989	33864	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:25.270689011 CEST	33866	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:25.622726917 CEST	29989	33866	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:25.622968912 CEST	33866	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:25.622968912 CEST	33866	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:25.975522995 CEST	29989	33866	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:25.975583076 CEST	29989	33866	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:25.975696087 CEST	33866	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:26.327419996 CEST	29989	33866	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:27.080904007 CEST	33868	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:27.441678047 CEST	29989	33868	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:27.441756010 CEST	33868	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:27.441834927 CEST	33868	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:27.804351091 CEST	29989	33868	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:27.804426908 CEST	29989	33868	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:27.804544926 CEST	33868	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:28.165443897 CEST	29989	33868	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:28.912947893 CEST	33870	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:29.272548914 CEST	29989	33870	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:29.272630930 CEST	33870	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:29.272718906 CEST	33870	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:29.632575035 CEST	29989	33870	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:29.632631063 CEST	29989	33870	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:29.632725954 CEST	33870	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:29.992685080 CEST	29989	33870	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:36.740760088 CEST	33872	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:37.114316940 CEST	29989	33872	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:37.114413023 CEST	33872	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:37.114521027 CEST	33872	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:37.484721899 CEST	29989	33872	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:37.484932899 CEST	29989	33872	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:37.485065937 CEST	33872	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:37.860411882 CEST	29989	33872	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:38.590646982 CEST	33874	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:38.955499887 CEST	29989	33874	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:38.955621004 CEST	33874	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:38.955697060 CEST	33874	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:39.321094036 CEST	29989	33874	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:39.321233988 CEST	33874	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:39.322293043 CEST	29989	33874	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:39.685906887 CEST	29989	33874	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:43.427090883 CEST	33876	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:43.786098957 CEST	29989	33876	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:43.786281109 CEST	33876	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:43.786365986 CEST	33876	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:44.144889116 CEST	29989	33876	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:44.144953012 CEST	29989	33876	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:44.145101070 CEST	33876	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:44.503251076 CEST	29989	33876	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:48.250557899 CEST	33878	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:48.604844093 CEST	29989	33878	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:48.604967117 CEST	33878	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:48.605072021 CEST	33878	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:48.958534956 CEST	29989	33878	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:48.958597898 CEST	29989	33878	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:48.958914042 CEST	33878	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:49.311954975 CEST	29989	33878	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:50.064424038 CEST	33880	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:50.407105923 CEST	29989	33880	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:50.407269955 CEST	33880	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:50.407335997 CEST	33880	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:50.749449968 CEST	29989	33880	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:50.749784946 CEST	29989	33880	103.174.73.85	192.168.2.14
Apr 19, 2024 11:47:50.749914885 CEST	33880	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:47:51.093101978 CEST	29989	33880	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:00.855086088 CEST	33882	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:01.226394892 CEST	29989	33882	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:01.226492882 CEST	33882	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:01.226654053 CEST	33882	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:01.602557898 CEST	29989	33882	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:01.602617025 CEST	29989	33882	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:01.602713108 CEST	33882	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:01.973589897 CEST	29989	33882	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:06.708733082 CEST	33884	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:07.073050976 CEST	29989	33884	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:07.073261023 CEST	33884	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:07.073401928 CEST	33884	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:07.437695980 CEST	29989	33884	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:07.437735081 CEST	29989	33884	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:07.437865973 CEST	33884	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:07.802727938 CEST	29989	33884	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:14.543910980 CEST	33886	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:14.904139996 CEST	29989	33886	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:14.904377937 CEST	33886	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:14.904421091 CEST	33886	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:15.264950991 CEST	29989	33886	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:15.265018940 CEST	29989	33886	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:15.265271902 CEST	33886	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:15.625602961 CEST	29989	33886	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:22.371778011 CEST	33888	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:22.749377966 CEST	29989	33888	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:22.749644041 CEST	33888	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:22.749644041 CEST	33888	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:23.126041889 CEST	29989	33888	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:23.126507998 CEST	29989	33888	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:23.126893997 CEST	33888	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:23.504306078 CEST	29989	33888	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:33.232404947 CEST	33890	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:33.588298082 CEST	29989	33890	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:33.588571072 CEST	33890	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:33.588668108 CEST	33890	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:33.943023920 CEST	29989	33890	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:33.943140984 CEST	29989	33890	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:33.943331003 CEST	33890	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:34.864044905 CEST	33890	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:35.217407942 CEST	29989	33890	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:39.048824072 CEST	33892	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:39.411876917 CEST	29989	33892	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:39.412131071 CEST	33892	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:39.412185907 CEST	33892	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:39.773152113 CEST	29989	33892	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:39.773219109 CEST	29989	33892	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:39.773360968 CEST	33892	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:40.134238958 CEST	29989	33892	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:45.878988981 CEST	33894	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:46.267828941 CEST	29989	33894	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:46.267972946 CEST	33894	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:46.268028975 CEST	33894	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:46.657957077 CEST	29989	33894	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:46.658020020 CEST	29989	33894	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:46.658123970 CEST	33894	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:47.046607971 CEST	29989	33894	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:52.763691902 CEST	33896	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:53.126951933 CEST	29989	33896	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:53.127151966 CEST	33896	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:53.127151966 CEST	33896	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:53.488569021 CEST	29989	33896	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:53.488637924 CEST	29989	33896	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:53.488840103 CEST	33896	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:53.855010033 CEST	29989	33896	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:54.595052958 CEST	33898	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:54.957863092 CEST	29989	33898	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:54.958003998 CEST	33898	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:54.958086014 CEST	33898	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:55.320060968 CEST	29989	33898	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:55.320148945 CEST	29989	33898	103.174.73.85	192.168.2.14
Apr 19, 2024 11:48:55.320411921 CEST	33898	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:48:55.682666063 CEST	29989	33898	103.174.73.85	192.168.2.14
Apr 19, 2024 11:49:03.426520109 CEST	33900	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:49:03.788655043 CEST	29989	33900	103.174.73.85	192.168.2.14
Apr 19, 2024 11:49:03.788966894 CEST	33900	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:49:03.789062023 CEST	33900	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:49:04.151165009 CEST	29989	33900	103.174.73.85	192.168.2.14
Apr 19, 2024 11:49:04.151262045 CEST	29989	33900	103.174.73.85	192.168.2.14
Apr 19, 2024 11:49:04.151448011 CEST	33900	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:49:04.514858961 CEST	29989	33900	103.174.73.85	192.168.2.14
Apr 19, 2024 11:49:12.257261038 CEST	33902	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:49:12.614306927 CEST	29989	33902	103.174.73.85	192.168.2.14
Apr 19, 2024 11:49:12.614468098 CEST	33902	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:49:12.614510059 CEST	33902	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:49:12.972214937 CEST	29989	33902	103.174.73.85	192.168.2.14
Apr 19, 2024 11:49:12.972275972 CEST	29989	33902	103.174.73.85	192.168.2.14
Apr 19, 2024 11:49:12.972387075 CEST	33902	29989	192.168.2.14	103.174.73.85
Apr 19, 2024 11:49:13.331880093 CEST	29989	33902	103.174.73.85	192.168.2.14

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:47:12.481693983 CEST	53495	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:47:12.587212086 CEST	53	53495	8.8.8.8	192.168.2.14
Apr 19, 2024 11:47:14.303009033 CEST	39923	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:47:14.408888102 CEST	53	39923	8.8.8.8	192.168.2.14
Apr 19, 2024 11:47:25.165400982 CEST	60386	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:47:25.270327091 CEST	53	60386	8.8.8.8	192.168.2.14
Apr 19, 2024 11:47:26.975965977 CEST	50117	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:47:27.080790043 CEST	53	50117	8.8.8.8	192.168.2.14
Apr 19, 2024 11:47:28.804728985 CEST	55981	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:47:28.912761927 CEST	53	55981	8.8.8.8	192.168.2.14
Apr 19, 2024 11:47:36.632685900 CEST	47024	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:47:36.740643024 CEST	53	47024	8.8.8.8	192.168.2.14
Apr 19, 2024 11:47:38.485393047 CEST	34075	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:47:38.590379000 CEST	53	34075	8.8.8.8	192.168.2.14
Apr 19, 2024 11:47:43.321358919 CEST	41430	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:47:43.426908970 CEST	53	41430	8.8.8.8	192.168.2.14
Apr 19, 2024 11:47:48.145307064 CEST	49630	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:47:48.250339985 CEST	53	49630	8.8.8.8	192.168.2.14
Apr 19, 2024 11:47:49.959007978 CEST	42314	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:47:50.064220905 CEST	53	42314	8.8.8.8	192.168.2.14
Apr 19, 2024 11:48:00.749857903 CEST	50143	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:48:00.854866028 CEST	53	50143	8.8.8.8	192.168.2.14
Apr 19, 2024 11:48:06.602909088 CEST	38619	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:48:06.708467007 CEST	53	38619	8.8.8.8	192.168.2.14
Apr 19, 2024 11:48:14.437846899 CEST	45277	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:48:14.543627024 CEST	53	45277	8.8.8.8	192.168.2.14
Apr 19, 2024 11:48:22.265163898 CEST	40741	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:48:22.371474981 CEST	53	40741	8.8.8.8	192.168.2.14
Apr 19, 2024 11:48:33.126734018 CEST	52086	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:48:33.232181072 CEST	53	52086	8.8.8.8	192.168.2.14
Apr 19, 2024 11:48:38.943373919 CEST	59976	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:48:39.048644066 CEST	53	59976	8.8.8.8	192.168.2.14
Apr 19, 2024 11:48:45.773371935 CEST	49688	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:48:45.878781080 CEST	53	49688	8.8.8.8	192.168.2.14
Apr 19, 2024 11:48:52.658102036 CEST	56354	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:48:52.763411999 CEST	53	56354	8.8.8.8	192.168.2.14
Apr 19, 2024 11:48:54.488908052 CEST	35122	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:48:54.594681025 CEST	53	35122	8.8.8.8	192.168.2.14
Apr 19, 2024 11:49:03.320188999 CEST	48398	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:49:03.426187038 CEST	53	48398	8.8.8.8	192.168.2.14
Apr 19, 2024 11:49:12.151333094 CEST	57845	53	192.168.2.14	8.8.8.8
Apr 19, 2024 11:49:12.257055998 CEST	53	57845	8.8.8.8	192.168.2.14

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report vxYiJd3ok8.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0DE2Ix (deleted)

/tmp/qemu-open.0HSGsy (deleted)

/tmp/qemu-open.0IJkiz (deleted)

/tmp/qemu-open.0TbUZw (deleted)

/tmp/qemu-open.0bKoZz (deleted)

/tmp/qemu-open.0cKHJy (deleted)

/tmp/qemu-open.0jkIfy (deleted)

/tmp/qemu-open.0kZLOy (deleted)

/tmp/qemu-open.0qO8xw (deleted)

/tmp/qemu-open.0snRRy (deleted)

/tmp/qemu-open.0u0HZx (deleted)

/tmp/qemu-open.0vbkpA (deleted)

/tmp/qemu-open.0x3B1z (deleted)

/tmp/qemu-open.0yxJRy (deleted)

/tmp/qemu-open.10pgPw (deleted)

/tmp/qemu-open.11hKyw (deleted)

/tmp/qemu-open.12hLMz (deleted)

/tmp/qemu-open.15WOHx (deleted)

/tmp/qemu-open.15vZLx (deleted)

/tmp/qemu-open.1AKrry (deleted)

/tmp/qemu-open.1L6Zxy (deleted)

/tmp/qemu-open.1PsMbw (deleted)

/tmp/qemu-open.1Q0K8z (deleted)

/tmp/qemu-open.1R32Sz (deleted)

/tmp/qemu-open.1ROr5w (deleted)

/tmp/qemu-open.1UZNKy (deleted)

/tmp/qemu-open.1VJzrw (deleted)

/tmp/qemu-open.1WiIGx (deleted)

/tmp/qemu-open.1X0oOz (deleted)

/tmp/qemu-open.1Y7OJA (deleted)

Linux Analysis Report
vxYiJd3ok8.elf

Start time (UTC):	09:47:11
Start date (UTC):	19/04/2024
Path:	/tmp/vxYiJd3ok8.elf
Arguments:	/tmp/vxYiJd3ok8.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre