Edit tour

Linux Analysis Report
Uma8LJRS7P.elf

Overview

General Information

Sample name:	Uma8LJRS7P.elf renamed because original name is a hash value
Original sample name:	3931dca88631b21e1d7eefd3313b8a64.elf
Analysis ID:	1428688
MD5:	3931dca88631b21e1d7eefd3313b8a64
SHA1:	df202f863dcc1def5f975451829787f6adb17e0f
SHA256:	40b0c4a08e16c5768fccd5f63b06603246c1dcb7b8e6610709ffa44d2a7585ce
Tags:	32elfgafgytpowerpc
Infos:

Detection

Mirai, Okiru

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Okiru

Contains symbols with names commonly found in malware

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428688
Start date and time:	2024-04-19 11:54:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Uma8LJRS7P.elf renamed because original name is a hash value
Original Sample Name:	3931dca88631b21e1d7eefd3313b8a64.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/1025@105/0

Runtime Messages

Command:	/tmp/Uma8LJRS7P.elf
PID:	5589
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

Uma8LJRS7P.elf (PID: 5589, Parent: 5514, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/Uma8LJRS7P.elf

Uma8LJRS7P.elf New Fork (PID: 5591, Parent: 5589)

Uma8LJRS7P.elf New Fork (PID: 5593, Parent: 5591)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Uma8LJRS7P.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Uma8LJRS7P.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Uma8LJRS7P.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Uma8LJRS7P.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aabc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aad0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aae4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Uma8LJRS7P.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a83c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5589.1.00007f9204001000.00007f920401e000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5589.1.00007f9204001000.00007f920401e000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5589.1.00007f9204001000.00007f920401e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5589.1.00007f9204001000.00007f920401e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a97c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aabc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aad0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aae4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aaf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5589.1.00007f9204001000.00007f920401e000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a83c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: Uma8LJRS7P.elf PID: 5589	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: Uma8LJRS7P.elf PID: 5589	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: Uma8LJRS7P.elf PID: 5589	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x8a65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8aa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ab5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ac9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8add:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8af1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b2d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b41:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b55:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b69:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b7d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b91:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ba5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8bb9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8bcd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8be1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8bf5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Uma8LJRS7P.elf PID: 5589	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x894b:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 4 entries

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//var/Condi

Source: Uma8LJRS7P.elf	Virustotal: Detection: 59%			Perma Link
Source: Uma8LJRS7P.elf	ReversingLabs: Detection: 52%

Source: Uma8LJRS7P.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Uma8LJRS7P.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5589.1.00007f9204001000.00007f920401e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5589.1.00007f9204001000.00007f920401e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: Uma8LJRS7P.elf PID: 5589, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Uma8LJRS7P.elf PID: 5589, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_ongoing
Source: ELF static info symbol of initial sample	Name: attack_parse

Source: Uma8LJRS7P.elf	ELF static info symbol of initial sample: execute_cfa_program
Source: Uma8LJRS7P.elf	ELF static info symbol of initial sample: execute_stack_op

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt//var/Condi

Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/3887/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/Uma8LJRS7P.elf (PID: 5593)	File opened: /proc/270/cmdline	Jump to behavior

Source: Uma8LJRS7P.elf, 5589.1.0000559416cac000.0000559416d5c000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: Uma8LJRS7P.elf, 5589.1.0000559416cac000.0000559416d5c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: Uma8LJRS7P.elf, 5589.1.00007ffd01a12000.00007ffd01a33000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: Uma8LJRS7P.elf, 5589.1.00007ffd01a12000.00007ffd01a33000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/Uma8LJRS7P.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Uma8LJRS7P.elf

Source: Yara match	File source: Uma8LJRS7P.elf, type: SAMPLE
Source: Yara match	File source: 5589.1.00007f9204001000.00007f920401e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Uma8LJRS7P.elf PID: 5589, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Source	Detection	Scanner	Label	Link
Uma8LJRS7P.elf	60%	Virustotal		Browse
Uma8LJRS7P.elf	53%	ReversingLabs	Linux.Trojan.Mirai
Uma8LJRS7P.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Source: Uma8LJRS7P.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Uma8LJRS7P.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5589.1.00007f9204001000.00007f920401e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5589.1.00007f9204001000.00007f920401e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: Uma8LJRS7P.elf PID: 5589, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Uma8LJRS7P.elf PID: 5589, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Process:	/tmp/Uma8LJRS7P.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:Tgm0Dl:TgBl
MD5:	5D42E1EB8CD8BB0A50480B09F961BF8E
SHA1:	1FEE5AF2BF74C51D3759ADD61D719C4B9804F86D
SHA-256:	AA9AE1D8BA1ACD1ECF2CF15E43B5CB81CF89B61EB166FD33D688580689A2A8A4
SHA-512:	0DAA024CC76B03666C40FD4D6E01A8675D353B0CD4BDD554463E7496C441F1017DEFF65C6B31208260DC3971D63E85CF1AD40AD6265263FB4CC048C7EE83170B
Malicious:	false
Reputation:	low
Preview:	/tmp/Uma8LJRS7P.elf.

Process:	/tmp/Uma8LJRS7P.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:Tgm0Dl:TgBl
MD5:	5D42E1EB8CD8BB0A50480B09F961BF8E
SHA1:	1FEE5AF2BF74C51D3759ADD61D719C4B9804F86D
SHA-256:	AA9AE1D8BA1ACD1ECF2CF15E43B5CB81CF89B61EB166FD33D688580689A2A8A4
SHA-512:	0DAA024CC76B03666C40FD4D6E01A8675D353B0CD4BDD554463E7496C441F1017DEFF65C6B31208260DC3971D63E85CF1AD40AD6265263FB4CC048C7EE83170B
Malicious:	false
Reputation:	low
Preview:	/tmp/Uma8LJRS7P.elf.

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.13612055520149
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Uma8LJRS7P.elf
File size:	224'557 bytes
MD5:	3931dca88631b21e1d7eefd3313b8a64
SHA1:	df202f863dcc1def5f975451829787f6adb17e0f
SHA256:	40b0c4a08e16c5768fccd5f63b06603246c1dcb7b8e6610709ffa44d2a7585ce
SHA512:	78cd8ee2288a19927b8fb74890f45bcd457746c7384af19ec74a8236153802aa58733371adc9f284fd14ad83d94cbd86709f77e5a9c441b197feadaf2952d521
SSDEEP:	3072:I+/xso+KewXe68YhRNW1M876Qvpr58uOvrhax8GJqcvuyb:IkuJCT8Y3KRvpr58zfBcvuyb
TLSH:	5C249E05B3194A57D0972EB026EF07F0A7BB9CC115A0A20A966EFFD55773AF05802F87
File Content Preview:	.ELF...........................4...@.....4. ...(.......................~...~...........................(..`................ ... ... ................dt.Q.............................!..\|......$H...H..a...$8!. \|...N.. .!..\|.......?..........X..../...@..`= .

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x10000218
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	192064
Section Header Size:	40
Number of Section Headers:	31
Header String Table Index:	28

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x100000b4	0xb4	0x24	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100000d8	0xd8	0x1a0b8	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x1001a190	0x1a190	0x20	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1001a1b0	0x1a1b0	0x2cc0	0x0	0x2	A	0	0	8
.gcc_except_table	PROGBITS	0x1001ce70	0x1ce70	0xe	0x0	0x2	A	0	0	1
.eh_frame	PROGBITS	0x1002ce80	0x1ce80	0x8a0	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x1002d720	0x1d720	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x1002d724	0x1d724	0x8	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x1002d724	0x1d724	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x1002d72c	0x1d72c	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x1002d734	0x1d734	0x4	0x0	0x3	WA	0	0	4
.got2	PROGBITS	0x1002d738	0x1d738	0x44	0x0	0x3	WA	0	0	1
.got	PROGBITS	0x1002d77c	0x1d77c	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x1002d788	0x1d788	0x2a8	0x0	0x3	WA	0	0	8
.sdata	PROGBITS	0x1002da30	0x1da30	0x78	0x0	0x3	WA	0	0	4
.sbss	NOBITS	0x1002daa8	0x1daa8	0xb0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x1002db58	0x1daa8	0x53dc	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x1daa8	0xea0	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1e948	0x60	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x1e9a8	0x31e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1ecc6	0x50c3	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x23d89	0xbe2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x2496b	0x1612	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x25f80	0xe7c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x26dfc	0x1e15	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x28c11	0x503a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x2dc4b	0x10e0	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x2ed2b	0x113	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x2f318	0x40c0	0x10	0x0		30	394	4
.strtab	STRTAB	0x0	0x333d8	0x3955	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x1ce7e	0x1ce7e	6.3478	0x5	R E	0x10000	.init .text .fini .rodata .gcc_except_table
LOAD	0x1ce80	0x1002ce80	0x1002ce80	0xc28	0x60b4	5.0588	0x6	RW	0x10000	.eh_frame .tdata .tbss .ctors .dtors .jcr .got2 .got .data .sdata .sbss .bss
TLS	0x1d720	0x1002d720	0x1002d720	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 11:55:47.184422970 CEST	35476	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:55:47.289606094 CEST	53	35476	8.8.8.8	192.168.2.15
Apr 19, 2024 11:55:47.289973974 CEST	51387	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:55:47.396076918 CEST	53	51387	8.8.8.8	192.168.2.15
Apr 19, 2024 11:55:47.396197081 CEST	39605	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:55:47.501167059 CEST	53	39605	8.8.8.8	192.168.2.15
Apr 19, 2024 11:55:47.501250982 CEST	51143	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:55:47.608361006 CEST	53	51143	8.8.8.8	192.168.2.15
Apr 19, 2024 11:55:47.608479023 CEST	46678	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:55:47.714364052 CEST	53	46678	8.8.8.8	192.168.2.15
Apr 19, 2024 11:55:56.715059042 CEST	55363	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:55:56.820008993 CEST	53	55363	8.8.8.8	192.168.2.15
Apr 19, 2024 11:55:56.820153952 CEST	33081	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:55:56.924841881 CEST	53	33081	8.8.8.8	192.168.2.15
Apr 19, 2024 11:55:56.924978018 CEST	42157	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:55:57.030508041 CEST	53	42157	8.8.8.8	192.168.2.15
Apr 19, 2024 11:55:57.031447887 CEST	34847	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:55:57.136445999 CEST	53	34847	8.8.8.8	192.168.2.15
Apr 19, 2024 11:55:57.137579918 CEST	56058	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:55:57.242657900 CEST	53	56058	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:02.243499994 CEST	39843	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:02.348294973 CEST	53	39843	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:02.348442078 CEST	42482	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:02.453789949 CEST	53	42482	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:02.453927040 CEST	33500	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:02.558470964 CEST	53	33500	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:02.558603048 CEST	44523	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:02.663551092 CEST	53	44523	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:02.663669109 CEST	58130	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:02.768923044 CEST	53	58130	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:07.769064903 CEST	37792	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:07.873646021 CEST	53	37792	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:07.873771906 CEST	57281	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:07.978034019 CEST	53	57281	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:07.978189945 CEST	47696	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:08.082778931 CEST	53	47696	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:08.082894087 CEST	42975	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:08.187460899 CEST	53	42975	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:08.187578917 CEST	60046	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:08.292886972 CEST	53	60046	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:18.293046951 CEST	36333	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:18.398516893 CEST	53	36333	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:18.398932934 CEST	42035	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:18.503583908 CEST	53	42035	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:18.503771067 CEST	32902	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:18.608210087 CEST	53	32902	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:18.608431101 CEST	44780	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:18.713123083 CEST	53	44780	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:18.713272095 CEST	39005	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:18.817800999 CEST	53	39005	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:28.818069935 CEST	40941	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:28.923105001 CEST	53	40941	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:28.923377037 CEST	47915	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:29.030369043 CEST	53	47915	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:29.030672073 CEST	33567	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:29.135708094 CEST	53	33567	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:29.135982037 CEST	44113	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:29.240729094 CEST	53	44113	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:29.240994930 CEST	41857	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:29.345891953 CEST	53	41857	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:36.346075058 CEST	42712	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:36.451286077 CEST	53	42712	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:36.451544046 CEST	45543	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:36.556380987 CEST	53	45543	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:36.556644917 CEST	33826	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:36.662889957 CEST	53	33826	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:36.663031101 CEST	46373	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:36.768210888 CEST	53	46373	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:36.768451929 CEST	53326	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:36.874560118 CEST	53	53326	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:38.874950886 CEST	34717	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:38.979362011 CEST	53	34717	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:38.979693890 CEST	49048	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:39.084141970 CEST	53	49048	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:39.084393024 CEST	52694	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:39.189292908 CEST	53	52694	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:39.189526081 CEST	49857	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:39.294922113 CEST	53	49857	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:39.295177937 CEST	55062	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:39.399935007 CEST	53	55062	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:49.400150061 CEST	39208	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:49.505417109 CEST	53	39208	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:49.505614996 CEST	50507	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:49.610301971 CEST	53	50507	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:49.610460997 CEST	37900	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:49.716222048 CEST	53	37900	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:49.716370106 CEST	34058	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:49.820919991 CEST	53	34058	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:49.821082115 CEST	58763	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:49.926012039 CEST	53	58763	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:51.926316977 CEST	37816	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:52.035912037 CEST	53	37816	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:52.036118984 CEST	46243	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:52.143505096 CEST	53	46243	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:52.143680096 CEST	37650	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:52.248893976 CEST	53	37650	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:52.249102116 CEST	56971	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:52.354110956 CEST	53	56971	8.8.8.8	192.168.2.15
Apr 19, 2024 11:56:52.354279041 CEST	45720	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:56:52.459158897 CEST	53	45720	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:00.459440947 CEST	54870	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:00.564779997 CEST	53	54870	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:00.565047026 CEST	45707	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:00.669785023 CEST	53	45707	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:00.670160055 CEST	43299	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:00.774940968 CEST	53	43299	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:00.775219917 CEST	50213	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:00.881654978 CEST	53	50213	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:00.881937027 CEST	37382	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:00.987263918 CEST	53	37382	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:04.987719059 CEST	36013	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:05.092811108 CEST	53	36013	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:05.093122959 CEST	60884	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:05.198088884 CEST	53	60884	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:05.198314905 CEST	34749	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:05.303585052 CEST	53	34749	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:05.303925037 CEST	44737	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:05.409140110 CEST	53	44737	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:05.409522057 CEST	47032	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:05.515542984 CEST	53	47032	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:13.516014099 CEST	39145	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:13.621308088 CEST	53	39145	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:13.621673107 CEST	35750	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:13.726454973 CEST	53	35750	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:13.726911068 CEST	57558	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:13.831643105 CEST	53	57558	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:13.831921101 CEST	39880	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:13.937124014 CEST	53	39880	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:13.937326908 CEST	59114	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:14.042076111 CEST	53	59114	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:18.042629004 CEST	44462	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:18.156323910 CEST	53	44462	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:18.156848907 CEST	35801	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:18.261976004 CEST	53	35801	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:18.262264013 CEST	53458	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:18.367351055 CEST	53	53458	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:18.367624044 CEST	39526	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:18.472455978 CEST	53	39526	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:18.472704887 CEST	39748	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:18.577723980 CEST	53	39748	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:23.578306913 CEST	40509	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:23.683429003 CEST	53	40509	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:23.683700085 CEST	35885	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:23.788779020 CEST	53	35885	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:23.789073944 CEST	37022	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:23.894681931 CEST	53	37022	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:23.894860983 CEST	48943	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:24.000603914 CEST	53	48943	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:24.000864983 CEST	52913	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:24.106339931 CEST	53	52913	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:29.106836081 CEST	48741	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:29.212197065 CEST	53	48741	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:29.212413073 CEST	39984	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:29.317673922 CEST	53	39984	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:29.317820072 CEST	39616	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:29.427707911 CEST	53	39616	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:29.428056955 CEST	51254	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:29.533108950 CEST	53	51254	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:29.533411980 CEST	53556	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:29.638539076 CEST	53	53556	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:33.639017105 CEST	56032	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:33.744709015 CEST	53	56032	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:33.744939089 CEST	33673	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:33.850550890 CEST	53	33673	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:33.850915909 CEST	54287	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:33.955899000 CEST	53	54287	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:33.956089020 CEST	60326	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:34.061069965 CEST	53	60326	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:34.061351061 CEST	38452	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:34.166532993 CEST	53	38452	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:37.167094946 CEST	60699	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:37.271842003 CEST	53	60699	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:37.272349119 CEST	60147	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:37.377340078 CEST	53	60147	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:37.377702951 CEST	53602	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:37.482690096 CEST	53	53602	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:37.482965946 CEST	49479	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:37.588371038 CEST	53	49479	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:37.588633060 CEST	40826	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:37.693533897 CEST	53	40826	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:42.693897963 CEST	34414	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:42.799689054 CEST	53	34414	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:42.799899101 CEST	51821	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:42.905649900 CEST	53	51821	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:42.905873060 CEST	43618	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:43.011308908 CEST	53	43618	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:43.011495113 CEST	38963	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:43.116264105 CEST	53	38963	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:43.116486073 CEST	59290	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:43.221828938 CEST	53	59290	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:49.222212076 CEST	50628	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:49.326967955 CEST	53	50628	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:49.327260971 CEST	51581	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:49.432491064 CEST	53	51581	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:49.432739019 CEST	46774	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:49.537512064 CEST	53	46774	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:49.537772894 CEST	33346	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:49.642951965 CEST	53	33346	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:49.643202066 CEST	33171	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:49.748064041 CEST	53	33171	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:51.748541117 CEST	59321	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:51.853785038 CEST	53	59321	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:51.854011059 CEST	57909	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:51.959237099 CEST	53	57909	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:51.959451914 CEST	52880	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:52.064590931 CEST	53	52880	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:52.064779043 CEST	38050	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:52.170067072 CEST	53	38050	8.8.8.8	192.168.2.15
Apr 19, 2024 11:57:52.170247078 CEST	33377	53	192.168.2.15	8.8.8.8
Apr 19, 2024 11:57:52.275410891 CEST	53	33377	8.8.8.8	192.168.2.15

Start time (UTC):	09:55:45
Start date (UTC):	19/04/2024
Path:	/tmp/Uma8LJRS7P.elf
Arguments:	/tmp/Uma8LJRS7P.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	09:55:46
Start date (UTC):	19/04/2024
Path:	/tmp/Uma8LJRS7P.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Uma8LJRS7P.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.017Yg9 (deleted)

/tmp/qemu-open.02HNu6 (deleted)

/tmp/qemu-open.0C7X56 (deleted)

/tmp/qemu-open.0E1go8 (deleted)

/tmp/qemu-open.0Iyi94 (deleted)

/tmp/qemu-open.0L8Ku5 (deleted)

/tmp/qemu-open.0LLuM6 (deleted)

/tmp/qemu-open.0SHQb5 (deleted)

/tmp/qemu-open.0YRTl6 (deleted)

/tmp/qemu-open.0ZehH5 (deleted)

/tmp/qemu-open.0amWE7 (deleted)

/tmp/qemu-open.0encH8 (deleted)

/tmp/qemu-open.0fk4N6 (deleted)

/tmp/qemu-open.0iviL5 (deleted)

/tmp/qemu-open.0jHHy9 (deleted)

/tmp/qemu-open.0kj0a6 (deleted)

/tmp/qemu-open.0o2xE7 (deleted)

/tmp/qemu-open.0sI4p9 (deleted)

/tmp/qemu-open.1063S7 (deleted)

/tmp/qemu-open.13dPJ7 (deleted)

/tmp/qemu-open.1PxYp5 (deleted)

/tmp/qemu-open.1TeCm6 (deleted)

/tmp/qemu-open.1VNN26 (deleted)

/tmp/qemu-open.1XBYg8 (deleted)

/tmp/qemu-open.1Zjg78 (deleted)

/tmp/qemu-open.1eqox8 (deleted)

/tmp/qemu-open.1fegH8 (deleted)

/tmp/qemu-open.1kmIZ7 (deleted)

/tmp/qemu-open.1qgwv6 (deleted)

/tmp/qemu-open.1rU6p5 (deleted)

/tmp/qemu-open.1wAdb5 (deleted)

Linux Analysis Report
Uma8LJRS7P.elf

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre