Source: mJ4CsuZhyr.elf |
ReversingLabs: Detection: 47% |
Source: mJ4CsuZhyr.elf |
String: EOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff[locker] killed process: %s ;; pid: %d |
Source: unknown |
DNS traffic detected: query: cnc.voidnet.click.'f!p66a/PV!E(*:5we))'fpNNPV!a/E@7 |
Source: unknown |
DNS traffic detected: query: cnc.voidnet.click.'f66a/PV!E(:+5sp-)'f}NNPV!a/E@7 |
Source: unknown |
DNS traffic detected: query: cnc.voidnet.click.'fm66a/PV!E(G7j6I5o)'f"nNNPV!a/E@7 |
Source: unknown |
DNS traffic detected: query: cnc.voidnet.click.'f66a/PV!E(9O5?)'fZNNPV!a/E@8.@@/.5,.cncvoidnetclickn'f |
Source: unknown |
DNS traffic detected: query: cnc.voidnet.click.'f66a/PV!E($:}5)'fJJPV!a/E<.@@(^OM^%K|+'f,JJa/PV!E<@6^OM^.,%n9|+'f=-BBPV!a/E4m@@(^OM^%`, |
Source: global traffic |
TCP traffic: 192.168.2.13:51550 -> 94.156.79.77:33966 |
Source: unknown |
DNS traffic detected: queries for: cnc.voidnet.click |
Source: ELF static info symbol of initial sample |
Name: attack.c |
Source: ELF static info symbol of initial sample |
Name: attack_get_opt_int |
Source: ELF static info symbol of initial sample |
Name: attack_get_opt_ip |
Source: ELF static info symbol of initial sample |
Name: attack_gre.c |
Source: ELF static info symbol of initial sample |
Name: attack_gre_eth |
Source: ELF static info symbol of initial sample |
Name: attack_gre_ip |
Source: ELF static info symbol of initial sample |
Name: attack_init |
Source: ELF static info symbol of initial sample |
Name: attack_parse |
Source: ELF static info symbol of initial sample |
Name: attack_start |
Source: ELF static info symbol of initial sample |
Name: attack_std |
Source: mJ4CsuZhyr.elf |
ELF static info symbol of initial sample: __gnu_unwind_execute |
Source: classification engine |
Classification label: mal76.troj.evad.linELF@0/1@6/0 |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/11/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/11/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/11/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/11/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/11/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/22/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/22/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/22/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/22/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/22/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/55/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/55/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/66/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/88/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/88/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/88/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/88/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/99/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/99/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/99/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/99/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/33/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/33/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/111/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/111/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/111/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/111/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/222/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/222/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/222/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/222/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/333/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/333/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/777/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/777/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/888/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/888/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/11111/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/11111/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/999/cmdline |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5435) |
File opened: /proc/999/stat |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5433) |
File: /tmp/mJ4CsuZhyr.elf |
Jump to behavior |
Source: /tmp/mJ4CsuZhyr.elf (PID: 5431) |
Queries kernel information via 'uname': |
Jump to behavior |
Source: mJ4CsuZhyr.elf, 5431.1.00007ffe3904e000.00007ffe3906f000.rw-.sdmp |
Binary or memory string: /tmp/qemu-open.eDFJ3P |
Source: mJ4CsuZhyr.elf, 5431.1.00007ffe3904e000.00007ffe3906f000.rw-.sdmp |
Binary or memory string: V/tmp/qemu-open.eDFJ3P:uW |
Source: mJ4CsuZhyr.elf, 5431.1.0000561ccd5e3000.0000561ccd734000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/arm |
Source: mJ4CsuZhyr.elf, 5431.1.00007ffe3904e000.00007ffe3906f000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-arm |
Source: mJ4CsuZhyr.elf, 5431.1.0000561ccd5e3000.0000561ccd734000.rw-.sdmp |
Binary or memory string: V!/etc/qemu-binfmt/arm |
Source: mJ4CsuZhyr.elf, 5431.1.00007ffe3904e000.00007ffe3906f000.rw-.sdmp |
Binary or memory string: 5x86_64/usr/bin/qemu-arm/tmp/mJ4CsuZhyr.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mJ4CsuZhyr.elf |
Source: Yara match |
File source: mJ4CsuZhyr.elf, type: SAMPLE |
Source: Yara match |
File source: mJ4CsuZhyr.elf, type: SAMPLE |