Source: insetto-x86.elf |
ReversingLabs: Detection: 44% |
Source: /tmp/insetto-x86.elf (PID: 6224) |
Reads CPU info from proc file: /proc/cpuinfo |
Jump to behavior |
Source: global traffic |
TCP traffic: 185.196.8.213 ports 59432,6,7,8,9,6789 |
Source: global traffic |
TCP traffic: 192.168.2.23:56634 -> 185.196.8.213:6789 |
Source: global traffic |
TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443 |
Source: global traffic |
TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443 |
Source: global traffic |
TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown |
DNS traffic detected: queries for: jhbaghjbasdg.shop |
Source: unknown |
Network traffic detected: HTTP traffic on port 43928 -> 443 |
Source: unknown |
Network traffic detected: HTTP traffic on port 42836 -> 443 |
Source: insetto-x86.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown |
Source: insetto-x86.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown |
Source: insetto-x86.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown |
Source: 6225.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown |
Source: 6225.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown |
Source: 6225.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown |
Source: 6223.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_3a56423b Author: unknown |
Source: 6223.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_dab39a25 Author: unknown |
Source: 6223.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown |
Source: ELF static info symbol of initial sample |
.symtab present: no |
Source: insetto-x86.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16 |
Source: insetto-x86.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26 |
Source: insetto-x86.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26 |
Source: 6225.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16 |
Source: 6225.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26 |
Source: 6225.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26 |
Source: 6223.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_3a56423b os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75, id = 3a56423b-c0cf-4483-87e3-552beb40563a, last_modified = 2021-09-16 |
Source: 6223.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_dab39a25 reference_sample = 3e02fb63803110cabde08e809cf4acc1b8fb474ace531959a311858fdd578bab, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 5a628d9af9d6dccf29e78f780bb74a2fa25167954c34d4a1529bdea5ea891ac0, id = dab39a25-852b-441f-86ab-23d945daa62c, last_modified = 2022-01-26 |
Source: 6223.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26 |
Source: classification engine |
Classification label: mal64.troj.linELF@0/0@72/0 |
Source: /tmp/insetto-x86.elf (PID: 6224) |
Reads from proc file: /proc/cpuinfo |
Jump to behavior |
Source: /tmp/insetto-x86.elf (PID: 6224) |
Reads CPU info from proc file: /proc/cpuinfo |
Jump to behavior |