Linux Analysis Report
qnW5l5Iegw

Overview

General Information

Sample name: qnW5l5Iegw
renamed because original name is a hash value
Original sample name: bb4eee24d6f69698c8acc8e472feecd3
Analysis ID: 1431448
MD5: bb4eee24d6f69698c8acc8e472feecd3
SHA1: 214a44c96c85563d391329a37cf7ee155c727d3d
SHA256: e7d8b915ad94182702f678e78a5b8552ff1c2515a7651b775646d145ba4b1186
Infos:

Detection

Xmrig
Score: 92
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Xmrig cryptocurrency miner
Executes the "crontab" command typically for achieving persistence
Executes the "iptables" command to insert, remove and/or manipulate rules
Found strings related to Crypto-Mining
Performs DNS queries to domains with low reputation
Sample is packed with UPX
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to persist itself using cron
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "iptables" command used for managing IP filtering and manipulation
Executes the "rm" command used to delete files or directories
Reads CPU information from /proc indicative of miner or evasive malware
Reads CPU information from /sys indicative of miner or evasive malware
Reads system information from the proc file system
Reads the 'hosts' file potentially containing internal network hosts
Sample contains only a LOAD segment without any section mappings
Sample has stripped symbol table
Sample listens on a socket
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: qnW5l5Iegw Avira: detected
Multi AV Scanner detection for submitted file
Source: qnW5l5Iegw ReversingLabs: Detection: 65%
Source: qnW5l5Iegw Virustotal: Detection: 49% Perma Link

Bitcoin Miner
barindex
Yara detected Xmrig cryptocurrency miner
Source: Yara match File source: 6206.1.00007f7f472d5000.00007f7f472d8000.rw-.sdmp, type: MEMORY
Source: Yara match File source: 6206.1.00007f7f47ada000.00007f7f47e89000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: qnW5l5Iegw PID: 6206, type: MEMORYSTR
Found strings related to Crypto-Mining
Source: qnW5l5Iegw, 6206.1.00007f7f47ada000.00007f7f47e89000.r-x.sdmp String found in binary or memory: stratum+ssl://randomx.xmrig.com:443
Source: qnW5l5Iegw, 6206.1.00007f7f47ada000.00007f7f47e89000.r-x.sdmp String found in binary or memory: cryptonight/0
Source: qnW5l5Iegw, 6206.1.00007f7f47ada000.00007f7f47e89000.r-x.sdmp String found in binary or memory: -o, --url=URL URL of mining server
Source: qnW5l5Iegw, 6206.1.00007f7f47ada000.00007f7f47e89000.r-x.sdmp String found in binary or memory: stratum+tcp://
Source: qnW5l5Iegw, 6206.1.00007f7f47ada000.00007f7f47e89000.r-x.sdmp String found in binary or memory: Usage: xmrig [OPTIONS]
Source: qnW5l5Iegw, 6206.1.00007f7f47ada000.00007f7f47e89000.r-x.sdmp String found in binary or memory: Usage: xmrig [OPTIONS]
Reads CPU information from /proc indicative of miner or evasive malware
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from proc file: /proc/cpuinfo Jump to behavior
Reads CPU information from /sys indicative of miner or evasive malware
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_cpus Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/die_cpus Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/package_cpus Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/physical_package_id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_cpus Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/die_cpus Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/package_cpus Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/physical_package_id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/coherency_line_size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/number_of_sets Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/physical_line_partition Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/coherency_line_size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/number_of_sets Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/physical_line_partition Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/coherency_line_size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/number_of_sets Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/physical_line_partition Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior

Networking
barindex
Executes the "iptables" command to insert, remove and/or manipulate rules
Source: /bin/sh (PID: 6225) Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 47067 -j ACCEPT Jump to behavior
Performs DNS queries to domains with low reputation
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Source: DNS query: c2.asyncfox.xyz
Source: DNS query: xmr-pool.asyncfox.xyz
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:41982 -> 45.95.147.236:2137
Executes the "iptables" command used for managing IP filtering and manipulation
Source: /bin/sh (PID: 6225) Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 47067 -j ACCEPT Jump to behavior
Reads the 'hosts' file potentially containing internal network hosts
Source: /tmp/qnW5l5Iegw (PID: 6215) Reads hosts file: /etc/hosts Jump to behavior
Sample listens on a socket
Source: /tmp/qnW5l5Iegw (PID: 6215) Socket: 0.0.0.0::47067 Jump to behavior
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: c2.asyncfox.xyz replaycode: Name error (3)
Source: unknown DNS traffic detected: query: xmr-pool.asyncfox.xyz replaycode: Name error (3)
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.147.236
Source: global traffic DNS traffic detected: DNS query: xmr-pool.asyncfox.xyz
Source: global traffic DNS traffic detected: DNS query: c2.asyncfox.xyz
Source: qnW5l5Iegw, 6206.1.00007f7f47ada000.00007f7f47e89000.r-x.sdmp String found in binary or memory: http://download.asyncfox.xyz/download/xmrig.arm7;
Source: qnW5l5Iegw String found in binary or memory: http://upx.sf.net
Source: qnW5l5Iegw, 6206.1.00007f7f47ada000.00007f7f47e89000.r-x.sdmp String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: qnW5l5Iegw, 6206.1.00007f7f47ada000.00007f7f47e89000.r-x.sdmp String found in binary or memory: https://xmrig.com/docs/algorithms
Source: qnW5l5Iegw, 6206.1.00007f7f47ada000.00007f7f47e89000.r-x.sdmp String found in binary or memory: https://xmrig.com/wizard
Source: qnW5l5Iegw, 6206.1.00007f7f47ada000.00007f7f47e89000.r-x.sdmp String found in binary or memory: https://xmrig.com/wizard%s
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 39420
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 39420 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x0
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Source: classification engine Classification label: mal92.troj.evad.mine.lin@0/1@1871/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 4.10 Copyright (C) 1996-2023 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior
barindex
Executes the "crontab" command typically for achieving persistence
Source: /bin/sh (PID: 6210) Crontab executable: /usr/bin/crontab -> crontab -l Jump to behavior
Source: /bin/sh (PID: 6214) Crontab executable: /usr/bin/crontab -> crontab - Jump to behavior
Executes the "iptables" command to insert, remove and/or manipulate rules
Source: /bin/sh (PID: 6225) Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 47067 -j ACCEPT Jump to behavior
Sample reads /proc/mounts (often used for finding a writable filesystem)
Source: /tmp/qnW5l5Iegw (PID: 6206) File: /proc/6206/mounts Jump to behavior
Sample tries to persist itself using cron
Source: /usr/bin/crontab (PID: 6214) File: /var/spool/cron/crontabs/tmp.Wl5qG5 Jump to behavior
Source: /usr/bin/crontab (PID: 6214) File: /var/spool/cron/crontabs/root Jump to behavior
Enumerates processes within the "proc" file system
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/6232/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/6232/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/6232/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/6232/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1582/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1582/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1582/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/3088/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/3088/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/3088/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/230/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/230/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/230/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/110/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/110/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/110/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/231/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/231/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/231/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/111/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/111/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/111/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/232/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/232/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/232/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1579/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1579/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1579/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/112/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/112/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/112/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/233/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/233/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/233/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1699/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1699/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/113/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/113/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/113/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/234/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/234/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/234/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1335/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1335/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1335/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1698/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1698/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/114/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/114/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/114/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/235/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/235/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/235/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1334/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1334/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1334/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1576/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1576/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1576/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/2302/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/2302/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/2302/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/2302/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/115/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/115/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/115/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/236/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/236/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/236/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/116/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/116/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/116/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/237/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/237/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/237/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/117/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/117/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/117/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/118/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/118/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/118/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/910/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/910/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/910/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/910/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/119/maps Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/119/exe Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) File opened: /proc/119/maps Jump to behavior
Executes commands using a shell command-line interpreter
Source: /tmp/qnW5l5Iegw (PID: 6208) Shell command executed: sh -c "crontab -l" Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6211) Shell command executed: sh -c "echo \"@reboot /tmp/qnW5l5Iegw\" | crontab -" Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6223) Shell command executed: sh -c "iptables -I INPUT -p tcp --dport 47067 -j ACCEPT" Jump to behavior
Executes the "iptables" command used for managing IP filtering and manipulation
Source: /bin/sh (PID: 6225) Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 47067 -j ACCEPT Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 6298) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.lxN0S8N9yT /tmp/tmp.nGqllcajKz /tmp/tmp.A4tJ7ptlel Jump to behavior
Source: /usr/bin/dash (PID: 6299) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.lxN0S8N9yT /tmp/tmp.nGqllcajKz /tmp/tmp.A4tJ7ptlel Jump to behavior
Reads system information from the proc file system
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads from proc file: /proc/cpuinfo Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads from proc file: /proc/meminfo Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) Reads from proc file: /proc/meminfo Jump to behavior
Source: submitted sample Stderr: no crontab for root: exit code = 0
ELF contains segments with high entropy indicating compressed/encrypted content
Source: qnW5l5Iegw Submission file: segment LOAD with 7.8988 entropy (max. 8.0)
Source: qnW5l5Iegw Submission file: segment LOAD with 7.9998 entropy (max. 8.0)
Reads CPU information from /proc indicative of miner or evasive malware
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from proc file: /proc/cpuinfo Jump to behavior
Reads CPU information from /sys indicative of miner or evasive malware
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_cpus Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/core_id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/die_cpus Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/package_cpus Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/topology/physical_package_id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/number_of_sets Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index1/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/number_of_sets Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/number_of_sets Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_cpus Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/core_id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/die_cpus Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/package_cpus Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/topology/physical_package_id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/coherency_line_size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/number_of_sets Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index0/physical_line_partition Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index1/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/coherency_line_size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/number_of_sets Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index2/physical_line_partition Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/shared_cpu_map Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/level Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/type Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/id Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/coherency_line_size Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/number_of_sets Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6206) Reads CPU info from /sys: /sys/devices/system/cpu/cpu1/cache/index3/physical_line_partition Jump to behavior
Source: /tmp/qnW5l5Iegw (PID: 6215) Reads CPU info from /sys: /sys/devices/system/cpu/online Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/qnW5l5Iegw (PID: 6206) Queries kernel information via 'uname': Jump to behavior
Source: qnW5l5Iegw, 6206.1.000055b481d45000.000055b481f1b000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/arm
Source: qnW5l5Iegw, 6206.1.00007ffd1d3fd000.00007ffd1d41e000.rw-.sdmp Binary or memory string: ~%x86_64/usr/bin/qemu-arm/tmp/qnW5l5IegwSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/qnW5l5Iegw
Source: qnW5l5Iegw, 6206.1.000055b481d45000.000055b481f1b000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/arm
Source: qnW5l5Iegw, 6206.1.00007ffd1d3fd000.00007ffd1d41e000.rw-.sdmp Binary or memory string: /usr/bin/qemu-arm

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.249.145.219
 unknown United States
16509 AMAZON-02US false
45.95.147.236
 unknown Netherlands
51942 EKMEDIANL false
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
91.189.91.43
 unknown United Kingdom
41231 CANONICAL-ASGB false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false

Contacted Domains

Name IP Active
c2.asyncfox.xyz unknown unknown
xmr-pool.asyncfox.xyz unknown unknown