Edit tour

Linux Analysis Report
V06ANR64H4.elf

Overview

General Information

Sample name:	V06ANR64H4.elf renamed because original name is a hash value
Original sample name:	ee1e42e88091c9a71836464480547a49.elf
Analysis ID:	1430863
MD5:	ee1e42e88091c9a71836464480547a49
SHA1:	8ef3c1402cdec529dc85a1de3500bce4c6b8a4fe
SHA256:	40225130e8a42e93e1ff1428829a1af8ccc5c78a9ae57effb3c4fe940cafdc2a
Tags:	32armelfmirai
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430863
Start date and time:	2024-04-24 10:18:50 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	V06ANR64H4.elf renamed because original name is a hash value
Original Sample Name:	ee1e42e88091c9a71836464480547a49.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@16/0

Runtime Messages

Command:	/tmp/V06ANR64H4.elf
PID:	6214
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

V06ANR64H4.elf (PID: 6214, Parent: 6130, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/V06ANR64H4.elf

V06ANR64H4.elf New Fork (PID: 6216, Parent: 6214)

V06ANR64H4.elf New Fork (PID: 6218, Parent: 6216)

dash New Fork (PID: 6223, Parent: 4331)

rm (PID: 6223, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.lwVWrD7sUY /tmp/tmp.gj5Dp9AVP9 /tmp/tmp.AanjD0a1pQ

dash New Fork (PID: 6224, Parent: 4331)

rm (PID: 6224, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.lwVWrD7sUY /tmp/tmp.gj5Dp9AVP9 /tmp/tmp.AanjD0a1pQ

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
V06ANR64H4.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
V06ANR64H4.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
V06ANR64H4.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
V06ANR64H4.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a624:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a638:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a64c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a660:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a674:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a688:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a69c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a700:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a714:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a728:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a73c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a750:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a764:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a778:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a78c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
V06ANR64H4.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a4e4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
6214.1.00007fabcc017000.00007fabcc034000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6214.1.00007fabcc017000.00007fabcc034000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6214.1.00007fabcc017000.00007fabcc034000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6214.1.00007fabcc017000.00007fabcc034000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1a624:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a638:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a64c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a660:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a674:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a688:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a69c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a700:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a714:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a728:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a73c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a750:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a764:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a778:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a78c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6214.1.00007fabcc017000.00007fabcc034000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1a4e4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: V06ANR64H4.elf PID: 6214	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: V06ANR64H4.elf PID: 6214	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: V06ANR64H4.elf PID: 6214	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x892:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x90a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x91e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x932:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x946:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x95a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x96e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x982:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x996:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: V06ANR64H4.elf PID: 6214	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x778:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 4 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:19:50.749886
SID:	2030490
Source Port:	53848
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:20:28.527090
SID:	2030490
Source Port:	53858
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:21:03.539862
SID:	2030490
Source Port:	53866
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:20:21.773477
SID:	2030490
Source Port:	53856
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:19:47.994229
SID:	2030490
Source Port:	53846
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:21:23.054291
SID:	2030490
Source Port:	53870
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:20:39.278110
SID:	2030490
Source Port:	53860
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:21:12.295864
SID:	2030490
Source Port:	53868
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:21:31.808852
SID:	2030490
Source Port:	53872
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:19:55.502459
SID:	2030490
Source Port:	53850
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:20:04.261398
SID:	2030490
Source Port:	53852
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:20:46.032585
SID:	2030490
Source Port:	53862
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:19:40.240038
SID:	2030490
Source Port:	53844
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:20:15.015419
SID:	2030490
Source Port:	53854
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:19:29.483339
SID:	2030490
Source Port:	53842
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.88.90.30

Timestamp:	04/24/24-10:20:56.784639
SID:	2030490
Source Port:	53864
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: V06ANR64H4.elf	ReversingLabs: Detection: 57%
Source: V06ANR64H4.elf	Virustotal: Detection: 45%			Perma Link

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53842 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53844 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53846 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53848 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53850 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53852 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53854 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53856 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53858 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53860 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53862 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53864 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53866 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53868 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53870 -> 45.88.90.30:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:53872 -> 45.88.90.30:43957

Source: global traffic	TCP traffic: 192.168.2.23:33606 -> 54.171.230.55:443
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: V06ANR64H4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: V06ANR64H4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6214.1.00007fabcc017000.00007fabcc034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6214.1.00007fabcc017000.00007fabcc034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: V06ANR64H4.elf PID: 6214, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: V06ANR64H4.elf PID: 6214, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/V06ANR64H4.elf (PID: 6218)	SIGKILL sent: pid: 4437, result: successful	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	SIGKILL sent: pid: 4442, result: successful	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	SIGKILL sent: pid: 4466, result: successful	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	SIGKILL sent: pid: 4472, result: successful	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	SIGKILL sent: pid: 4476, result: successful	Jump to behavior

Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6227/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6226/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6229/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6228/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6240/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6238/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6237/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/6239/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/V06ANR64H4.elf (PID: 6218)	File opened: /proc/256/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 6223)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.lwVWrD7sUY /tmp/tmp.gj5Dp9AVP9 /tmp/tmp.AanjD0a1pQ			Jump to behavior
Source: /usr/bin/dash (PID: 6224)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.lwVWrD7sUY /tmp/tmp.gj5Dp9AVP9 /tmp/tmp.AanjD0a1pQ			Jump to behavior

Source: V06ANR64H4.elf, 6214.1.000055e353c36000.000055e353d64000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: V06ANR64H4.elf, 6214.1.000055e353c36000.000055e353d64000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: V06ANR64H4.elf, 6214.1.00007ffeec3ff000.00007ffeec420000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: V06ANR64H4.elf, 6214.1.00007ffeec3ff000.00007ffeec420000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/V06ANR64H4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/V06ANR64H4.elf

Source: Yara match	File source: V06ANR64H4.elf, type: SAMPLE
Source: Yara match	File source: 6214.1.00007fabcc017000.00007fabcc034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V06ANR64H4.elf PID: 6214, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
V06ANR64H4.elf	58%	ReversingLabs	Linux.Trojan.Mirai
V06ANR64H4.elf	45%	Virustotal		Browse
V06ANR64H4.elf	100%	Avira	EXP/ELF.Mirai.Z.A

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false
45.88.90.30	putin.zelenskyj.ru	Bulgaria	10753	LVLT-10753US	true

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.171.230.55	az9a0rNKvy.elf	Get hash	malicious	Mirai, Okiru	Browse
	gwX4DFn6ue.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.DownLoader.532.20148.6112.elf	Get hash	malicious	Unknown	Browse
	tB42BIvqlr.elf	Get hash	malicious	Unknown	Browse
	AfF3NP01xL.elf	Get hash	malicious	Unknown	Browse
	client1.elf	Get hash	malicious	Unknown	Browse
	1lkozpLZNX.elf	Get hash	malicious	Unknown	Browse
	igIKGnfg87.elf	Get hash	malicious	Mirai	Browse
	MR6rclGNGX.elf	Get hash	malicious	Gafgyt	Browse
109.202.202.202	DI3Zukrm4Y.elf	Get hash	malicious	Mirai, Okiru	Browse
	WINSx8yLsb.elf	Get hash	malicious	Mirai, Okiru	Browse
	Rubify.arm.elf	Get hash	malicious	Mirai	Browse
	2TZqqUPBJw.elf	Get hash	malicious	Mirai, Okiru	Browse
	VlmPWVuJv9.elf	Get hash	malicious	Mirai, Okiru	Browse
	ke9n9bQgFS.elf	Get hash	malicious	Mirai, Okiru	Browse
	8awpc7GpMh.elf	Get hash	malicious	Unknown	Browse
	6WfrjCTjs8.elf	Get hash	malicious	Unknown	Browse
	cG1d8L6E2V.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	DI3Zukrm4Y.elf	Get hash	malicious	Mirai, Okiru	Browse
	WINSx8yLsb.elf	Get hash	malicious	Mirai, Okiru	Browse
	Rubify.arm.elf	Get hash	malicious	Mirai	Browse
	2TZqqUPBJw.elf	Get hash	malicious	Mirai, Okiru	Browse
	VlmPWVuJv9.elf	Get hash	malicious	Mirai, Okiru	Browse
	ke9n9bQgFS.elf	Get hash	malicious	Mirai, Okiru	Browse
	8awpc7GpMh.elf	Get hash	malicious	Unknown	Browse
	6WfrjCTjs8.elf	Get hash	malicious	Unknown	Browse
	cG1d8L6E2V.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	DI3Zukrm4Y.elf	Get hash	malicious	Mirai, Okiru	Browse
	WINSx8yLsb.elf	Get hash	malicious	Mirai, Okiru	Browse
	Rubify.arm.elf	Get hash	malicious	Mirai	Browse
	2TZqqUPBJw.elf	Get hash	malicious	Mirai, Okiru	Browse
	VlmPWVuJv9.elf	Get hash	malicious	Mirai, Okiru	Browse
	ke9n9bQgFS.elf	Get hash	malicious	Mirai, Okiru	Browse
	8awpc7GpMh.elf	Get hash	malicious	Unknown	Browse
	6WfrjCTjs8.elf	Get hash	malicious	Unknown	Browse
	cG1d8L6E2V.elf	Get hash	malicious	Unknown	Browse
45.88.90.30	nLGuZwgIuX.elf	Get hash	malicious	Mirai, Okiru	Browse

Process:	/tmp/V06ANR64H4.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887363
Encrypted:	false
SSDEEP:	3:Tg2vy3:Tgwy3
MD5:	56AE06AA595213396B0A716EEA63F0CB
SHA1:	877A49975BF641DA02C6BACB683DD75C4BE7DAE4
SHA-256:	7DF466B5F94486B05CD643E226B5FE5749EF6F352E9CA33411DC776E2C5D6ED0
SHA-512:	F4B8B9AFCB724FC6232C8ED822162036B78D673AB61EB06819A7904AA23B6707E851E5A0E1ACAC60CA39779A40A8F72D24EBC0FCD1C36A744333FF7B5C150340
Malicious:	false
Reputation:	low
Preview:	/tmp/V06ANR64H4.elf.

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.531196921436377
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	V06ANR64H4.elf
File size:	137'984 bytes
MD5:	ee1e42e88091c9a71836464480547a49
SHA1:	8ef3c1402cdec529dc85a1de3500bce4c6b8a4fe
SHA256:	40225130e8a42e93e1ff1428829a1af8ccc5c78a9ae57effb3c4fe940cafdc2a
SHA512:	46ff250554c6560e27884cd412ca1d997cb8a4c6ab710c1a2449481b54dd38e4dbccffec143a9a80fd0c8b66064397af6e4a9d9a5bdbcb9e578e11d7a2784a4c
SSDEEP:	1536:reIIcq87ZO8VQzlHaurUAZXlFFAeSz4VAZJsTgVUs/Br22/I/dLl2zUwywmFfbB1:aIIifMrUSVFFM4UiMVUs/Hg/GxyvQS
TLSH:	5AD30945F8414F23C6D612BBFB5E428D7B2A17E8D3EE72039D216F60378695B0E3A542
File Content Preview:	.ELF...a..........(.........4...p.......4. ...(.....................................................0I..............Q.td..................................-...L."...Wg..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	137584
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report V06ANR64H4.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.05Pvso (deleted)

/tmp/qemu-open.05aI2o (deleted)

/tmp/qemu-open.06xkom (deleted)

/tmp/qemu-open.0AG5pn (deleted)

/tmp/qemu-open.0B8Kdm (deleted)

/tmp/qemu-open.0DZEzm (deleted)

/tmp/qemu-open.0Fohlo (deleted)

/tmp/qemu-open.0G2Q9n (deleted)

/tmp/qemu-open.0IYxhn (deleted)

/tmp/qemu-open.0LE8zo (deleted)

/tmp/qemu-open.0Q1hum (deleted)

/tmp/qemu-open.0R18ml (deleted)

/tmp/qemu-open.0SZRtl (deleted)

/tmp/qemu-open.0V3Xwp (deleted)

/tmp/qemu-open.0dzPtm (deleted)

/tmp/qemu-open.0jsoap (deleted)

/tmp/qemu-open.0nfc3l (deleted)

/tmp/qemu-open.0oTXZo (deleted)

/tmp/qemu-open.0obsKl (deleted)

/tmp/qemu-open.0sqT7l (deleted)

/tmp/qemu-open.0tGljp (deleted)

/tmp/qemu-open.11ShBl (deleted)

/tmp/qemu-open.12ugTm (deleted)

/tmp/qemu-open.18Oenp (deleted)

/tmp/qemu-open.18lOEl (deleted)

/tmp/qemu-open.1CNNvl (deleted)

/tmp/qemu-open.1DLbXm (deleted)

/tmp/qemu-open.1Gx1Bm (deleted)

Linux Analysis Report
V06ANR64H4.elf

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x19d94	0x0	0x6	AX	16
.fini	PROGBITS	0x21e44	0x19e44	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x21e58	0x19e58	0x2b74	0x0	0x2	A	4
.ctors	PROGBITS	0x2d000	0x1d000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x2d00c	0x1d00c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2d020	0x1d020	0x4910	0x0	0x3	WA	32
.bss	NOBITS	0x31930	0x21930	0x46bc	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x21930	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1c9cc	0x1c9cc	6.0819	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x1d000	0x2d000	0x2d000	0x4930	0x8fec	0.4017	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 10:19:27.674817085 CEST	33606	443	192.168.2.23	54.171.230.55
Apr 24, 2024 10:19:28.954441071 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 24, 2024 10:19:29.190779924 CEST	53842	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:29.482908010 CEST	43957	53842	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:29.483004093 CEST	53842	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:29.483339071 CEST	53842	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:29.773081064 CEST	43957	53842	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:29.773340940 CEST	43957	53842	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:29.773643017 CEST	53842	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:30.064882994 CEST	43957	53842	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:34.585628986 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 24, 2024 10:19:36.121413946 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 24, 2024 10:19:39.949126959 CEST	53844	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:40.239865065 CEST	43957	53844	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:40.239948034 CEST	53844	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:40.240037918 CEST	53844	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:40.530839920 CEST	43957	53844	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:40.530951977 CEST	43957	53844	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:40.531047106 CEST	53844	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:40.821585894 CEST	43957	53844	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:47.703217983 CEST	53846	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:47.994075060 CEST	43957	53846	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:47.994168043 CEST	53846	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:47.994229078 CEST	53846	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:48.284673929 CEST	43957	53846	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:48.284948111 CEST	43957	53846	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:48.285037041 CEST	53846	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:48.577526093 CEST	43957	53846	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:49.175569057 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 24, 2024 10:19:50.457161903 CEST	53848	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:50.749739885 CEST	43957	53848	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:50.749834061 CEST	53848	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:50.749886036 CEST	53848	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:51.040967941 CEST	43957	53848	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:51.041002989 CEST	43957	53848	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:51.041083097 CEST	53848	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:51.332066059 CEST	43957	53848	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:55.212356091 CEST	53850	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:55.502190113 CEST	43957	53850	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:55.502458096 CEST	53850	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:55.502459049 CEST	53850	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:55.793950081 CEST	43957	53850	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:55.795106888 CEST	43957	53850	45.88.90.30	192.168.2.23
Apr 24, 2024 10:19:55.795363903 CEST	53850	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:19:56.091003895 CEST	43957	53850	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:01.462135077 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 24, 2024 10:20:03.966348886 CEST	53852	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:04.261013985 CEST	43957	53852	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:04.261398077 CEST	53852	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:04.261398077 CEST	53852	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:04.551558971 CEST	43957	53852	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:04.551875114 CEST	43957	53852	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:04.552097082 CEST	53852	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:04.847168922 CEST	43957	53852	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:05.557446957 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 24, 2024 10:20:14.721565008 CEST	53854	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:15.015079021 CEST	43957	53854	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:15.015419006 CEST	53854	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:15.015419006 CEST	53854	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:15.310082912 CEST	43957	53854	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:15.310142040 CEST	43957	53854	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:15.310437918 CEST	53854	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:15.604259014 CEST	43957	53854	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:21.480051041 CEST	53856	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:21.773186922 CEST	43957	53856	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:21.773374081 CEST	53856	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:21.773477077 CEST	53856	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:22.063862085 CEST	43957	53856	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:22.064291000 CEST	43957	53856	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:22.064403057 CEST	53856	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:22.354787111 CEST	43957	53856	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:28.236751080 CEST	53858	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:28.526922941 CEST	43957	53858	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:28.527031898 CEST	53858	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:28.527090073 CEST	53858	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:28.818624973 CEST	43957	53858	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:28.818804026 CEST	43957	53858	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:28.818934917 CEST	53858	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:29.108979940 CEST	43957	53858	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:30.129928112 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 24, 2024 10:20:38.987401009 CEST	53860	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:39.277899981 CEST	43957	53860	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:39.278048038 CEST	53860	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:39.278110027 CEST	53860	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:39.569581985 CEST	43957	53860	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:39.569601059 CEST	43957	53860	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:39.569742918 CEST	53860	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:39.859802008 CEST	43957	53860	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:45.740914106 CEST	53862	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:46.032284975 CEST	43957	53862	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:46.032457113 CEST	53862	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:46.032584906 CEST	53862	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:46.322618008 CEST	43957	53862	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:46.322774887 CEST	43957	53862	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:46.322976112 CEST	53862	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:46.613218069 CEST	43957	53862	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:56.494256020 CEST	53864	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:56.784465075 CEST	43957	53864	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:56.784595013 CEST	53864	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:56.784638882 CEST	53864	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:57.074745893 CEST	43957	53864	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:57.074932098 CEST	43957	53864	45.88.90.30	192.168.2.23
Apr 24, 2024 10:20:57.075010061 CEST	53864	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:20:57.366955996 CEST	43957	53864	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:03.246328115 CEST	53866	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:03.539637089 CEST	43957	53866	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:03.539861917 CEST	53866	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:03.539861917 CEST	53866	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:03.833733082 CEST	43957	53866	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:03.833796978 CEST	43957	53866	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:03.833965063 CEST	53866	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:04.125400066 CEST	43957	53866	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:12.005536079 CEST	53868	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:12.295717001 CEST	43957	53868	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:12.295819044 CEST	53868	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:12.295864105 CEST	53868	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:12.586220980 CEST	43957	53868	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:12.586251974 CEST	43957	53868	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:12.586345911 CEST	53868	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:12.876471996 CEST	43957	53868	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:22.761410952 CEST	53870	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:23.054101944 CEST	43957	53870	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:23.054225922 CEST	53870	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:23.054291010 CEST	53870	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:23.346546888 CEST	43957	53870	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:23.346807003 CEST	43957	53870	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:23.346951962 CEST	53870	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:23.639731884 CEST	43957	53870	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:31.517170906 CEST	53872	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:31.808588982 CEST	43957	53872	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:31.808746099 CEST	53872	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:31.808851957 CEST	53872	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:32.100307941 CEST	43957	53872	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:32.100485086 CEST	43957	53872	45.88.90.30	192.168.2.23
Apr 24, 2024 10:21:32.100714922 CEST	53872	43957	192.168.2.23	45.88.90.30
Apr 24, 2024 10:21:32.392283916 CEST	43957	53872	45.88.90.30	192.168.2.23

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 10:19:29.017009974 CEST	42994	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:19:29.189956903 CEST	53	42994	8.8.8.8	192.168.2.23
Apr 24, 2024 10:19:39.772805929 CEST	33632	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:19:39.948942900 CEST	53	33632	8.8.8.8	192.168.2.23
Apr 24, 2024 10:19:47.530250072 CEST	45101	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:19:47.703071117 CEST	53	45101	8.8.8.8	192.168.2.23
Apr 24, 2024 10:19:50.284931898 CEST	59411	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:19:50.457009077 CEST	53	59411	8.8.8.8	192.168.2.23
Apr 24, 2024 10:19:55.040803909 CEST	37305	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:19:55.212017059 CEST	53	37305	8.8.8.8	192.168.2.23
Apr 24, 2024 10:20:03.794406891 CEST	56645	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:20:03.965722084 CEST	53	56645	8.8.8.8	192.168.2.23
Apr 24, 2024 10:20:14.550923109 CEST	39404	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:20:14.721118927 CEST	53	39404	8.8.8.8	192.168.2.23
Apr 24, 2024 10:20:21.309730053 CEST	34134	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:20:21.479876995 CEST	53	34134	8.8.8.8	192.168.2.23
Apr 24, 2024 10:20:28.063733101 CEST	33766	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:20:28.236617088 CEST	53	33766	8.8.8.8	192.168.2.23
Apr 24, 2024 10:20:38.817739010 CEST	48309	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:20:38.987265110 CEST	53	48309	8.8.8.8	192.168.2.23
Apr 24, 2024 10:20:45.569310904 CEST	36987	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:20:45.740633965 CEST	53	36987	8.8.8.8	192.168.2.23
Apr 24, 2024 10:20:56.321715117 CEST	38947	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:20:56.494061947 CEST	53	38947	8.8.8.8	192.168.2.23
Apr 24, 2024 10:21:03.074496984 CEST	42264	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:21:03.246150017 CEST	53	42264	8.8.8.8	192.168.2.23
Apr 24, 2024 10:21:11.833054066 CEST	32951	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:21:12.005362988 CEST	53	32951	8.8.8.8	192.168.2.23
Apr 24, 2024 10:21:22.585308075 CEST	50184	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:21:22.761145115 CEST	53	50184	8.8.8.8	192.168.2.23
Apr 24, 2024 10:21:31.346072912 CEST	53199	53	192.168.2.23	8.8.8.8
Apr 24, 2024 10:21:31.516952991 CEST	53	53199	8.8.8.8	192.168.2.23

Start time (UTC):	08:19:27
Start date (UTC):	24/04/2024
Path:	/tmp/V06ANR64H4.elf
Arguments:	/tmp/V06ANR64H4.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	08:19:28
Start date (UTC):	24/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre