Edit tour

Linux Analysis Report
YTcowzAsKa.elf

Overview

General Information

Sample name:	YTcowzAsKa.elf renamed because original name is a hash value
Original sample name:	f63eb157992f99092b43816c3c077e4b.elf
Analysis ID:	1430969
MD5:	f63eb157992f99092b43816c3c077e4b
SHA1:	95eaf91ee9505e43c0b1f9d21ead7c38ef786d84
SHA256:	89ad0ea6bc60873a4926c07a7bf53ca21d52dcff7eba4b8e9f58e108f13d43f0
Tags:	32elfmipsmirai
Infos:

Detection

Mirai, Okiru

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Okiru

Sample tries to kill multiple processes (SIGKILL)

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430969
Start date and time:	2024-04-24 12:37:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	YTcowzAsKa.elf renamed because original name is a hash value
Original Sample Name:	f63eb157992f99092b43816c3c077e4b.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/1025@95/0

Runtime Messages

Command:	/tmp/YTcowzAsKa.elf
PID:	6269
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

YTcowzAsKa.elf (PID: 6269, Parent: 6193, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/YTcowzAsKa.elf

YTcowzAsKa.elf New Fork (PID: 6271, Parent: 6269)

YTcowzAsKa.elf New Fork (PID: 6273, Parent: 6271)

dash New Fork (PID: 6275, Parent: 4334)

rm (PID: 6275, Parent: 4334, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.eR9Ivj1K2p /tmp/tmp.uXvY17EKHf /tmp/tmp.CNcArmq8Nh

dash New Fork (PID: 6276, Parent: 4334)

rm (PID: 6276, Parent: 4334, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.eR9Ivj1K2p /tmp/tmp.uXvY17EKHf /tmp/tmp.CNcArmq8Nh

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
YTcowzAsKa.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
YTcowzAsKa.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
YTcowzAsKa.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
YTcowzAsKa.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x240c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2412c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2417c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x241a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x241b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x241cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x241e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x241f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24208:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2421c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24230:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24244:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24258:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
YTcowzAsKa.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x23f88:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
6269.1.00007fcf8c400000.00007fcf8c427000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6269.1.00007fcf8c400000.00007fcf8c427000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6269.1.00007fcf8c400000.00007fcf8c427000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6269.1.00007fcf8c400000.00007fcf8c427000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x240c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2412c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2417c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x241a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x241b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x241cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x241e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x241f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24208:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2421c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24230:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24244:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24258:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6269.1.00007fcf8c400000.00007fcf8c427000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x23f88:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: YTcowzAsKa.elf PID: 6269	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: YTcowzAsKa.elf PID: 6269	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: YTcowzAsKa.elf PID: 6269	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x6c3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6c4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6c63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6c77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6c8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6c9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6cb3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6cc7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6cdb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6cef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6d03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6d17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6d2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6d3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6d53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6d67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6d7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6d8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6da3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6db7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6dcb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: YTcowzAsKa.elf PID: 6269	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x6b21:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 4 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: YTcowzAsKa.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: YTcowzAsKa.elf

ReversingLabs: Detection: 36%

Source: YTcowzAsKa.elf

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: YTcowzAsKa.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: YTcowzAsKa.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6269.1.00007fcf8c400000.00007fcf8c427000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6269.1.00007fcf8c400000.00007fcf8c427000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: YTcowzAsKa.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: YTcowzAsKa.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: /tmp/YTcowzAsKa.elf (PID: 6273)	SIGKILL sent: pid: 4437, result: successful	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	SIGKILL sent: pid: 4438, result: successful	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	SIGKILL sent: pid: 4525, result: successful	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	SIGKILL sent: pid: 4529, result: successful	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	SIGKILL sent: pid: 4532, result: successful	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	SIGKILL sent: pid: 4535, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/6254/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/YTcowzAsKa.elf (PID: 6273)	File opened: /proc/261/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 6275)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.eR9Ivj1K2p /tmp/tmp.uXvY17EKHf /tmp/tmp.CNcArmq8Nh			Jump to behavior
Source: /usr/bin/dash (PID: 6276)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.eR9Ivj1K2p /tmp/tmp.uXvY17EKHf /tmp/tmp.CNcArmq8Nh			Jump to behavior

Source: YTcowzAsKa.elf, 6269.1.00007ffd7b629000.00007ffd7b64a000.rw-.sdmp	Binary or memory string: Sx86_64/usr/bin/qemu-mips/tmp/YTcowzAsKa.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/YTcowzAsKa.elf
Source: YTcowzAsKa.elf, 6269.1.000055a98f223000.000055a98f2aa000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mips
Source: YTcowzAsKa.elf, 6269.1.000055a98f223000.000055a98f2aa000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: YTcowzAsKa.elf, 6269.1.00007ffd7b629000.00007ffd7b64a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips

Source: Yara match	File source: YTcowzAsKa.elf, type: SAMPLE
Source: Yara match	File source: 6269.1.00007fcf8c400000.00007fcf8c427000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YTcowzAsKa.elf PID: 6269, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source: YTcowzAsKa.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: YTcowzAsKa.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6269.1.00007fcf8c400000.00007fcf8c427000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6269.1.00007fcf8c400000.00007fcf8c427000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: YTcowzAsKa.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: YTcowzAsKa.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source	Detection	Scanner	Label	Link
YTcowzAsKa.elf	37%	ReversingLabs	Linux.Trojan.Mirai
YTcowzAsKa.elf	100%	Avira	EXP/ELF.Mirai.Z.A

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland		13030	INIT7CH	false
91.189.91.42	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
109.202.202.202	Ptge3TuHFs.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ZFxJqgzVsv.elf	Get hash	malicious	Mirai	Browse
	KAIKC433T0.elf	Get hash	malicious	Gafgyt	Browse
	mfMK5ad02Y.elf	Get hash	malicious	Gafgyt	Browse
	JCC3MNVgRd.elf	Get hash	malicious	Gafgyt	Browse
	520VcHQQj7.elf	Get hash	malicious	Unknown	Browse
	jssKanl7bD.elf	Get hash	malicious	Mirai, Okiru	Browse
	eI5fTcq2no.elf	Get hash	malicious	Unknown	Browse
	e9NxPUbA9r.elf	Get hash	malicious	Mirai, Okiru	Browse
	F17oc0pNHk.elf	Get hash	malicious	Mirai, Okiru	Browse
91.189.91.42	Ptge3TuHFs.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ZFxJqgzVsv.elf	Get hash	malicious	Mirai	Browse
	KAIKC433T0.elf	Get hash	malicious	Gafgyt	Browse
	mfMK5ad02Y.elf	Get hash	malicious	Gafgyt	Browse
	JCC3MNVgRd.elf	Get hash	malicious	Gafgyt	Browse
	520VcHQQj7.elf	Get hash	malicious	Unknown	Browse
	jssKanl7bD.elf	Get hash	malicious	Mirai, Okiru	Browse
	eI5fTcq2no.elf	Get hash	malicious	Unknown	Browse
	e9NxPUbA9r.elf	Get hash	malicious	Mirai, Okiru	Browse
	F17oc0pNHk.elf	Get hash	malicious	Mirai, Okiru	Browse

Process:	/tmp/YTcowzAsKa.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:TgWSMWuEw5:TgWS+15
MD5:	0DD7622FF3F21B92B42E1D67CC1C92E9
SHA1:	D06B8DB2E6E72968E4A782A192AB89A77A3B9B38
SHA-256:	21455311D85D61B84A628DD7C9D9926DA1E6DDB1A070B4728DFE9952EE441CC4
SHA-512:	7A2F0561297A7A2DEFF24A3E89CB8C4C08B332E07F8A1382045E98621167454520E6540E3379B390CCFD2ECD38EF23E69A079F31C07F7905A3F347D38A5C7E63
Malicious:	false
Reputation:	low
Preview:	/tmp/YTcowzAsKa.elf.

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.033075362393043
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	YTcowzAsKa.elf
File size:	181'968 bytes
MD5:	f63eb157992f99092b43816c3c077e4b
SHA1:	95eaf91ee9505e43c0b1f9d21ead7c38ef786d84
SHA256:	89ad0ea6bc60873a4926c07a7bf53ca21d52dcff7eba4b8e9f58e108f13d43f0
SHA512:	6ff7299548e9074c0ac6b350cb4f0a473af28752e30b1c38e94890b408bc9aebf1a18b6ff76b7a2d184401e562bb28ce8797cab7c15161308b98eb8c84153939
SSDEEP:	3072:f6uSXvJnzjP0jCNzpyi579Yxy52tIen9A6qewZQIhaMh:f6uSXvJnvP0ONzYigAEnfqnZzhaa
TLSH:	E504985E6E128F7DF668873447B78E25976833DA27E1D680D2ACC1101E6039E641FFAC
File Content Preview:	.ELF.....................@.`...4.........4. ...(.............@...@....f...f...............p..Fp..Fp...T<............dt.Q............................<...'.9....!'.......................<...'.9....!...$....'9... ......................<...'.9....!... ....'98

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	181408
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x23770	0x0	0x6	AX	16
.fini	PROGBITS	0x423890	0x23890	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x4238f0	0x238f0	0x2d10	0x0	0x2	A	16
.ctors	PROGBITS	0x467000	0x27000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x46700c	0x2700c	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x467018	0x27018	0xcc	0x0	0x3	WA	4
.data	PROGBITS	0x467100	0x27100	0x4998	0x0	0x3	WA	32
.got	PROGBITS	0x46baa0	0x2baa0	0x99c	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x46c43c	0x2c43c	0x4c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x46c490	0x2c43c	0x4840	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x126c	0x2c43c	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x2c43c	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x26600	0x26600	5.4562	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x27000	0x467000	0x467000	0x543c	0x9cd0	1.1608	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 12:39:01.384416103 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 24, 2024 12:39:19.557887077 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 24, 2024 12:39:21.605669022 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 24, 2024 12:40:02.560151100 CEST	43928	443	192.168.2.23	91.189.91.42

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 12:39:00.209333897 CEST	49692	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:00.380417109 CEST	53	49692	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:00.380769968 CEST	49974	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:00.550654888 CEST	53	49974	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:00.550797939 CEST	51982	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:00.720645905 CEST	53	51982	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:00.720828056 CEST	44877	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:00.890713930 CEST	53	44877	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:00.890835047 CEST	45403	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:01.061043024 CEST	53	45403	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:02.061930895 CEST	49446	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:02.231738091 CEST	53	49446	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:02.234869003 CEST	46858	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:02.405558109 CEST	53	46858	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:02.405715942 CEST	51600	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:02.577219009 CEST	53	51600	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:02.577370882 CEST	51449	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:02.748215914 CEST	53	51449	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:02.748380899 CEST	60716	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:02.919760942 CEST	53	60716	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:03.919998884 CEST	60305	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:04.089785099 CEST	53	60305	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:04.089931011 CEST	47446	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:04.260818005 CEST	53	47446	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:04.260984898 CEST	36071	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:04.431004047 CEST	53	36071	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:04.431433916 CEST	55134	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:04.603140116 CEST	53	55134	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:04.603297949 CEST	52919	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:04.773118973 CEST	53	52919	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:11.772471905 CEST	47503	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:11.943265915 CEST	53	47503	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:11.944878101 CEST	57290	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:12.116699934 CEST	53	57290	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:12.118870974 CEST	38359	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:12.289710999 CEST	53	38359	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:12.290937901 CEST	47334	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:12.461694002 CEST	53	47334	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:12.462897062 CEST	37816	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:12.633035898 CEST	53	37816	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:20.633966923 CEST	48554	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:20.803885937 CEST	53	48554	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:20.806910038 CEST	36726	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:20.977807999 CEST	53	36726	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:20.978923082 CEST	53316	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:21.148817062 CEST	53	53316	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:21.150918961 CEST	35778	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:21.320827961 CEST	53	35778	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:21.323096037 CEST	60564	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:21.499058008 CEST	53	60564	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:26.502556086 CEST	35048	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:26.672319889 CEST	53	35048	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:26.672579050 CEST	49385	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:26.842405081 CEST	53	49385	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:26.842566013 CEST	33454	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:27.015827894 CEST	53	33454	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:27.016000032 CEST	46679	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:27.186400890 CEST	53	46679	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:27.186577082 CEST	54291	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:27.356765985 CEST	53	54291	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:35.356023073 CEST	54912	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:35.526932955 CEST	53	54912	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:35.527062893 CEST	54892	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:35.696822882 CEST	53	54892	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:35.696964979 CEST	46795	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:35.866969109 CEST	53	46795	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:35.867099047 CEST	60482	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:36.037136078 CEST	53	60482	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:36.037313938 CEST	59144	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:36.208312988 CEST	53	59144	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:39.208363056 CEST	36735	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:39.379307032 CEST	53	36735	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:39.379549026 CEST	42572	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:39.549122095 CEST	53	42572	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:39.549329996 CEST	44332	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:39.720056057 CEST	53	44332	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:39.720205069 CEST	53752	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:39.889920950 CEST	53	53752	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:39.890168905 CEST	43587	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:40.061289072 CEST	53	43587	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:47.060970068 CEST	59630	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:47.231921911 CEST	53	59630	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:47.232280016 CEST	50773	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:47.401999950 CEST	53	50773	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:47.402452946 CEST	48640	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:47.572629929 CEST	53	48640	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:47.573059082 CEST	46116	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:47.743120909 CEST	53	46116	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:47.743412971 CEST	55833	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:47.914386988 CEST	53	55833	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:56.913680077 CEST	41163	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:57.084532022 CEST	53	41163	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:57.084706068 CEST	46299	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:57.254650116 CEST	53	46299	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:57.254802942 CEST	58074	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:57.424595118 CEST	53	58074	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:57.424777031 CEST	58493	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:57.595822096 CEST	53	58493	8.8.8.8	192.168.2.23
Apr 24, 2024 12:39:57.595973969 CEST	51673	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:39:57.766916037 CEST	53	51673	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:03.766551971 CEST	35452	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:03.936345100 CEST	53	35452	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:03.936573982 CEST	45522	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:04.106431007 CEST	53	45522	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:04.106918097 CEST	52763	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:04.277766943 CEST	53	52763	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:04.277997971 CEST	37773	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:04.448648930 CEST	53	37773	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:04.448887110 CEST	57640	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:04.618573904 CEST	53	57640	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:11.618168116 CEST	50215	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:11.788074017 CEST	53	50215	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:11.788300037 CEST	48499	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:11.958297968 CEST	53	48499	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:11.958543062 CEST	48641	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:12.129549026 CEST	53	48641	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:12.129816055 CEST	48561	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:12.299654007 CEST	53	48561	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:12.299868107 CEST	56146	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:12.470660925 CEST	53	56146	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:20.470149994 CEST	43166	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:20.640932083 CEST	53	43166	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:20.641129971 CEST	45282	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:20.811995029 CEST	53	45282	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:20.812264919 CEST	35368	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:20.983007908 CEST	53	35368	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:20.983306885 CEST	48433	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:21.154400110 CEST	53	48433	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:21.154690027 CEST	34578	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:21.325476885 CEST	53	34578	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:30.324624062 CEST	45227	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:30.494380951 CEST	53	45227	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:30.494569063 CEST	54448	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:30.665397882 CEST	53	54448	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:30.665580034 CEST	37371	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:30.836347103 CEST	53	37371	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:30.836512089 CEST	56053	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:31.006398916 CEST	53	56053	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:31.006546974 CEST	40754	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:31.177376032 CEST	53	40754	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:38.176780939 CEST	36028	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:38.346719980 CEST	53	36028	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:38.346894026 CEST	52545	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:38.518199921 CEST	53	52545	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:38.518340111 CEST	48931	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:38.688158989 CEST	53	48931	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:38.688299894 CEST	34324	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:38.858349085 CEST	53	34324	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:38.858520031 CEST	43189	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:39.028364897 CEST	53	43189	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:47.027585983 CEST	58716	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:47.197740078 CEST	53	58716	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:47.197890043 CEST	56520	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:47.368338108 CEST	53	56520	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:47.368627071 CEST	59827	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:47.539824009 CEST	53	59827	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:47.540045023 CEST	33809	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:47.710890055 CEST	53	33809	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:47.711009026 CEST	39852	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:47.882246017 CEST	53	39852	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:53.881824017 CEST	56659	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:54.052695990 CEST	53	56659	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:54.053003073 CEST	54632	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:54.222999096 CEST	53	54632	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:54.223195076 CEST	33660	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:54.393024921 CEST	53	33660	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:54.393205881 CEST	53164	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:54.562980890 CEST	53	53164	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:54.563177109 CEST	52909	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:54.733577967 CEST	53	52909	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:56.733720064 CEST	33995	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:56.903631926 CEST	53	33995	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:56.903860092 CEST	39145	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:57.073968887 CEST	53	39145	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:57.074182034 CEST	56003	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:57.244811058 CEST	53	56003	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:57.245043039 CEST	40134	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:57.414875984 CEST	53	40134	8.8.8.8	192.168.2.23
Apr 24, 2024 12:40:57.415044069 CEST	49386	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:40:57.586236000 CEST	53	49386	8.8.8.8	192.168.2.23
Apr 24, 2024 12:41:02.585983038 CEST	43083	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:41:02.757009983 CEST	53	43083	8.8.8.8	192.168.2.23
Apr 24, 2024 12:41:02.757261992 CEST	38149	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:41:02.927069902 CEST	53	38149	8.8.8.8	192.168.2.23
Apr 24, 2024 12:41:02.927304029 CEST	41950	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:41:03.097280979 CEST	53	41950	8.8.8.8	192.168.2.23
Apr 24, 2024 12:41:03.097456932 CEST	39655	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:41:03.268398046 CEST	53	39655	8.8.8.8	192.168.2.23
Apr 24, 2024 12:41:03.268603086 CEST	47716	53	192.168.2.23	8.8.8.8
Apr 24, 2024 12:41:03.439003944 CEST	53	47716	8.8.8.8	192.168.2.23

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report YTcowzAsKa.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00wlpy (deleted)

/tmp/qemu-open.05662v (deleted)

/tmp/qemu-open.05A4Iv (deleted)

/tmp/qemu-open.07L3pz (deleted)

/tmp/qemu-open.09pNsv (deleted)

/tmp/qemu-open.0CasUx (deleted)

/tmp/qemu-open.0D4p8v (deleted)

/tmp/qemu-open.0Kq18w (deleted)

/tmp/qemu-open.0ZBJ6x (deleted)

/tmp/qemu-open.0eu9nw (deleted)

/tmp/qemu-open.0jgiKv (deleted)

/tmp/qemu-open.0rO02w (deleted)

/tmp/qemu-open.0uiNsy (deleted)

/tmp/qemu-open.16CaOx (deleted)

/tmp/qemu-open.16xYWv (deleted)

/tmp/qemu-open.1Fcoyy (deleted)

/tmp/qemu-open.1GssHx (deleted)

/tmp/qemu-open.1Gy9pw (deleted)

/tmp/qemu-open.1IrbAx (deleted)

/tmp/qemu-open.1Lz9fw (deleted)

/tmp/qemu-open.1P1c9v (deleted)

/tmp/qemu-open.1Tnk3x (deleted)

/tmp/qemu-open.1VVbZy (deleted)

/tmp/qemu-open.1ZDMUw (deleted)

/tmp/qemu-open.1ZvFiv (deleted)

/tmp/qemu-open.1hkOjx (deleted)

/tmp/qemu-open.1mLAPx (deleted)

/tmp/qemu-open.1rUTmy (deleted)

/tmp/qemu-open.204P6x (deleted)

Linux Analysis Report
YTcowzAsKa.elf

Start time (UTC):	10:38:59
Start date (UTC):	24/04/2024
Path:	/tmp/YTcowzAsKa.elf
Arguments:	/tmp/YTcowzAsKa.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	10:39:00
Start date (UTC):	24/04/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre