Click to jump to signature section
Source: Rubify.arm.elf | Virustotal: Detection: 25% | Perma Link |
Source: Rubify.arm.elf | ReversingLabs: Detection: 36% |
Source: global traffic | TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443 |
Source: global traffic | TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443 |
Source: global traffic | TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown | TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown | TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: Rubify.arm.elf, 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp | String found in binary or memory: http://94.156.71.75/bin |
Source: Rubify.arm.elf, 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp | String found in binary or memory: http://94.156.71.75/bins/Rubify.mips; |
Source: Rubify.arm.elf, 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp | String found in binary or memory: http://94.156.71.75/bins/Rubify.x86 |
Source: Rubify.arm.elf, 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp | String found in binary or memory: http://94.156.71.75/wget.sh; |
Source: Rubify.arm.elf, 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/ |
Source: Rubify.arm.elf, 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding//%22%3E |
Source: Rubify.arm.elf, 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/ |
Source: Rubify.arm.elf, 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope// |
Source: Rubify.arm.elf | String found in binary or memory: http://upx.sf.net |
Source: unknown | Network traffic detected: HTTP traffic on port 43928 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 42836 -> 443 |
Source: 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp, type: MEMORY | Matched rule: Detects ELF malware Mirai related Author: Florian Roth |
Source: Process Memory Space: Rubify.arm.elf PID: 6224, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: LOAD without section mappings | Program segment: 0x8000 |
Source: 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp, type: MEMORY | Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: Process Memory Space: Rubify.arm.elf PID: 6224, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: classification engine | Classification label: mal76.troj.evad.linELF@0/0@0/0 |
Source: initial sample | String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $ |
Source: initial sample | String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $ |
Source: initial sample | String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $ |
Source: Rubify.arm.elf | Submission file: segment LOAD with 7.9605 entropy (max. 8.0) |
Source: /tmp/Rubify.arm.elf (PID: 6224) | Queries kernel information via 'uname': | Jump to behavior |
Source: Rubify.arm.elf, 6224.1.00007ffdbf5bd000.00007ffdbf5de000.rw-.sdmp | Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Rubify.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Rubify.arm.elf |
Source: Rubify.arm.elf, 6224.1.000055aaacac8000.000055aaacc16000.rw-.sdmp | Binary or memory string: U!/etc/qemu-binfmt/arm |
Source: Rubify.arm.elf, 6224.1.000055aaacac8000.000055aaacc16000.rw-.sdmp | Binary or memory string: /etc/qemu-binfmt/arm |
Source: Rubify.arm.elf, 6224.1.00007ffdbf5bd000.00007ffdbf5de000.rw-.sdmp | Binary or memory string: /usr/bin/qemu-arm |
Source: Rubify.arm.elf, 6224.1.00007ffdbf5bd000.00007ffdbf5de000.rw-.sdmp | Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped |
Source: Yara match | File source: 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp, type: MEMORY |
Source: Yara match | File source: 6224.1.00007f8a5c017000.00007f8a5c02d000.r-x.sdmp, type: MEMORY |