Edit tour

Linux Analysis Report
aMTecZscrq.elf

Overview

General Information

Sample name:	aMTecZscrq.elf renamed because original name is a hash value
Original sample name:	b47f3536853c35d92aba19db36515232.elf
Analysis ID:	1431622
MD5:	b47f3536853c35d92aba19db36515232
SHA1:	529ee90adf360c41fff966bec633f70f7debb331
SHA256:	bb1b663711fdd974e4a669d6c58a69023b83e86691a0999a37b9b10a157169cb
Tags:	32elfmirairenesas
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Uses dynamic DNS services

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431622
Start date and time:	2024-04-25 14:40:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	aMTecZscrq.elf renamed because original name is a hash value
Original Sample Name:	b47f3536853c35d92aba19db36515232.elf
Detection:	MAL
Classification:	mal76.spre.troj.linELF@0/510@102/0

Runtime Messages

Command:	/tmp/aMTecZscrq.elf
PID:	5516
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	most
Standard Error:

Process Tree

system is lnxubuntu20

aMTecZscrq.elf (PID: 5516, Parent: 5432, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/aMTecZscrq.elf

aMTecZscrq.elf New Fork (PID: 5518, Parent: 5516)

aMTecZscrq.elf New Fork (PID: 5520, Parent: 5518)

aMTecZscrq.elf New Fork (PID: 5522, Parent: 5520)

xfce4-session New Fork (PID: 5544, Parent: 3011)

xfdesktop (PID: 5544, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5545, Parent: 3011)

xfdesktop (PID: 5545, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5551, Parent: 3011)

xfdesktop (PID: 5551, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5552, Parent: 3011)

xfdesktop (PID: 5552, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5553, Parent: 3011)

xfdesktop (PID: 5553, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
aMTecZscrq.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x162a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1632c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1637c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1641c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5522.1.00007fb814400000.00007fb814419000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x162a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1632c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1637c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1641c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5516.1.00007fb814400000.00007fb814419000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x162a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1632c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1637c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1641c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: aMTecZscrq.elf PID: 5516	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x7a1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7aab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7abf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7ad3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7ae7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7afb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b9b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7baf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: aMTecZscrq.elf PID: 5522	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1472:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1486:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x149a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14c2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14d6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1512:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1526:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1562:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1576:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x158a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1602:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

String: HTTP/1.1 200 OKmost-armmost-arm5most-arm6most-arm7most-mipsmost-mpslmost-x86_64most-sh4./pkillkillallwgetbusyboxtopcurlrebootpsftptftppgrepgrepxargsawktoybox./dvr_gui./upnp_server./dvr_app/procKh

Source: aMTecZscrq.elf	ReversingLabs: Detection: 64%
Source: aMTecZscrq.elf	Virustotal: Detection: 59%			Perma Link

Source: global traffic	DNS traffic detected: malformed DNS query: aomacamada.ddns.net. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: net-killer.ddns.net. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: Vet-killer.io.v. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: net-killer.ooguy.com. [malformed]

Source: unknown	DNS query: name: net-killer.ddns.net
Source: unknown	DNS query: name: aomacamada.ddns.net
Source: unknown	DNS query: name: aomacamada.ddns.net. [malformed]
Source: unknown	DNS query: name: net-killer.ddns.net. [malformed]

Source: global traffic	TCP traffic: 192.168.2.14:50430 -> 203.145.46.240:2023
Source: global traffic	TCP traffic: 192.168.2.14:53962 -> 51.79.217.59:2023

Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26

Source: global traffic	DNS traffic detected: DNS query: net-killer.ooguy.com
Source: global traffic	DNS traffic detected: DNS query: aomacamada.ddns.net. [malformed]
Source: global traffic	DNS traffic detected: DNS query: net-killer.ddns.net. [malformed]
Source: global traffic	DNS traffic detected: DNS query: Vet-killer.io.v. [malformed]
Source: global traffic	DNS traffic detected: DNS query: net-killer.ooguy.com. [malformed]
Source: global traffic	DNS traffic detected: DNS query: aomacamada.ddns.net
Source: global traffic	DNS traffic detected: DNS query: net-killer.ddns.net
Source: global traffic	DNS traffic detected: DNS query: domain-botnet.servehttp.com

Source: aMTecZscrq.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5522.1.00007fb814400000.00007fb814419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5516.1.00007fb814400000.00007fb814419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: aMTecZscrq.elf PID: 5516, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: aMTecZscrq.elf PID: 5522, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: /tmp/aMTecZscrq.elf (PID: 5520)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	SIGKILL sent: pid: 928, result: successful	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	SIGKILL sent: pid: 3183, result: successful	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	SIGKILL sent: pid: 5544, result: successful	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	SIGKILL sent: pid: 5545, result: successful	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	SIGKILL sent: pid: 5551, result: successful	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	SIGKILL sent: pid: 5552, result: successful	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	SIGKILL sent: pid: 5553, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKmost-armmost-arm5most-arm6most-arm7most-mipsmost-mpslmost-x86_64most-sh4./pkillkillallwgetbusyboxtopcurlrebootpsftptftppgrepgrepxargsawktoybox./dvr_gui./upnp_server./dvr_app/procKh

Source: /usr/bin/xfdesktop (PID: 5545)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5551)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5552)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5553)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior

Source: aMTecZscrq.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5522.1.00007fb814400000.00007fb814419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5516.1.00007fb814400000.00007fb814419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: aMTecZscrq.elf PID: 5516, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: aMTecZscrq.elf PID: 5522, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: aMTecZscrq.elf, 5516.1.00007ffe23f99000.00007ffe23fba000.rw-.sdmp, aMTecZscrq.elf, 5522.1.00007ffe23f99000.00007ffe23fba000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/aMTecZscrq.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/aMTecZscrq.elf
Source: aMTecZscrq.elf, 5516.1.0000562819672000.00005628196d5000.rw-.sdmp, aMTecZscrq.elf, 5522.1.0000562819672000.00005628196d5000.rw-.sdmp	Binary or memory string: (V5!/etc/qemu-binfmt/sh4
Source: aMTecZscrq.elf, 5516.1.00007ffe23f99000.00007ffe23fba000.rw-.sdmp, aMTecZscrq.elf, 5522.1.00007ffe23f99000.00007ffe23fba000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: aMTecZscrq.elf, 5516.1.0000562819672000.00005628196d5000.rw-.sdmp, aMTecZscrq.elf, 5522.1.0000562819672000.00005628196d5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
aMTecZscrq.elf	65%	ReversingLabs	Linux.Trojan.Mirai
aMTecZscrq.elf	59%	Virustotal		Browse
aMTecZscrq.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/3757/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/3758/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/aMTecZscrq.elf (PID: 5520)	File opened: /proc/262/cmdline	Jump to behavior

Source: /tmp/aMTecZscrq.elf (PID: 5516)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5545)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5551)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5552)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5553)	Queries kernel information via 'uname':	Jump to behavior

Source	Detection	Scanner	Link
aomacamada.ddns.net	8%	Virustotal	Browse
net-killer.ddns.net	18%	Virustotal	Browse
net-killer.ooguy.com	4%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
aomacamada.ddns.net	203.145.46.240	true	true	8%, Virustotal, Browse	unknown
net-killer.ddns.net	203.145.46.240	true	true	18%, Virustotal, Browse	unknown
net-killer.ooguy.com	203.145.46.240	true	true	4%, Virustotal, Browse	unknown
domain-botnet.servehttp.com	51.79.217.59	true	false		unknown
aomacamada.ddns.net. [malformed]	unknown	unknown	true		unknown
net-killer.ooguy.com. [malformed]	unknown	unknown	true		unknown
net-killer.ddns.net. [malformed]	unknown	unknown	true		unknown
Vet-killer.io.v. [malformed]	unknown	unknown	true		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
51.79.217.59	domain-botnet.servehttp.com	Canada	16276	OVHFR	false
185.125.190.26	unknown	United Kingdom	41231	CANONICAL-ASGB	false
203.145.46.240	aomacamada.ddns.net	unknown	9313	ONTHENET-ASNetworkTechnologyAUSTPLAU	true

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
51.79.217.59	v2cDqXmZtv.elf	Get hash	malicious	Mirai	Browse
	Wd2T9v9ZMT.elf	Get hash	malicious	Mirai	Browse
	7T1vOaCJto.elf	Get hash	malicious	Mirai	Browse
185.125.190.26	ldCdti5sRA.elf	Get hash	malicious	Mirai, Okiru	Browse
	vlxx.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse
	gCqnbN34QY.elf	Get hash	malicious	Unknown	Browse
	PylIt4izlJ.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKD.24576.11147.21229.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKD.24541.15958.30966.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Other.Malware-gen.31307.16494.elf	Get hash	malicious	Mirai	Browse
	gFHZn3Ck3v.elf	Get hash	malicious	Unknown	Browse
	2V7qaSy0Jl.elf	Get hash	malicious	Unknown	Browse
	EfsIiZhHxS.elf	Get hash	malicious	Gafgyt, Mirai	Browse
203.145.46.240	v2cDqXmZtv.elf	Get hash	malicious	Mirai	Browse
	EV66ROvDut.elf	Get hash	malicious	Mirai	Browse
	Wd2T9v9ZMT.elf	Get hash	malicious	Mirai	Browse
	7T1vOaCJto.elf	Get hash	malicious	Mirai	Browse
	sGQ61OAVck.elf	Get hash	malicious	Mirai	Browse
	0oJ784pwEP.elf	Get hash	malicious	Mirai	Browse
	7oIrVgpQFQ.elf	Get hash	malicious	Mirai	Browse
	n4J9NMfLTM.elf	Get hash	malicious	Mirai	Browse
	4wngRroxli.elf	Get hash	malicious	Mirai	Browse
	igIKGnfg87.elf	Get hash	malicious	Mirai	Browse

Process:	/tmp/aMTecZscrq.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887362
Encrypted:	false
SSDEEP:	3:TgBZWx0Nl:TgqxC
MD5:	9A30C55F146C01C87489FB93DC96A47D
SHA1:	32170567CB30231F539144FC06DC0F1156B64DA3
SHA-256:	CF9244B050D6AC98C47E9938B17F005E67F8EE89494DF39A871C7659EA1BE30B
SHA-512:	20B9781A28BE8D86B1090864BE33D79B8657A1C3D28381A24B16800C9F7CE5ED5F306586D264FCF3CEACB5FCCCAE677443B7CAF018C53ED3E36F98A65FF9C19F
Malicious:	false
Reputation:	low
Preview:	/tmp/aMTecZscrq.elf.

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.178126641663092
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	aMTecZscrq.elf
File size:	121'440 bytes
MD5:	b47f3536853c35d92aba19db36515232
SHA1:	529ee90adf360c41fff966bec633f70f7debb331
SHA256:	bb1b663711fdd974e4a669d6c58a69023b83e86691a0999a37b9b10a157169cb
SHA512:	7b5358b436d83079487c377bf2ceb7954747607279578c19b43ebf91a9e69e3223bd70edc53cae09ffe0066f517704f68abf40cd76fcee51fa15a40690dc96a6
SSDEEP:	1536:4aNcQD9AjX74f3PWfNySCSKcXlfKwUX90h1Wc4jt1lIhr:4BQi76OFySQcBUX61Wfjt8hr
TLSH:	F5C36B73D8266F58C555D0B4B0B08F796F53AA8182872FBA56B7C2B48043D8DF605BF8
File Content Preview:	.ELF.....................@.4...........4. ...(...............@...@...........................B...B.dH..............Q.td............................././"O.n........#.@........#.*@.`...o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	121000
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x160c0	0x0	0x6	AX	32
.fini	PROGBITS	0x4161a0	0x161a0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x4161c4	0x161c4	0x272c	0x0	0x2	A	4
.ctors	PROGBITS	0x429000	0x19000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x42900c	0x1900c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x429020	0x19020	0x4830	0x0	0x3	WA	32
.got	PROGBITS	0x42d850	0x1d850	0x14	0x4	0x3	WA	4
.bss	NOBITS	0x42d864	0x1d864	0x4574	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1d864	0x43	0x0	0x0		1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report aMTecZscrq.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.09VAnC (deleted)

/tmp/qemu-open.0GZBGz (deleted)

/tmp/qemu-open.0L203z (deleted)

/tmp/qemu-open.0LppJA (deleted)

/tmp/qemu-open.0Nuk3A (deleted)

/tmp/qemu-open.0ph7zA (deleted)

/tmp/qemu-open.0zPtJC (deleted)

/tmp/qemu-open.14XjfD (deleted)

/tmp/qemu-open.16BJjD (deleted)

/tmp/qemu-open.181rlz (deleted)

/tmp/qemu-open.1OWyhC (deleted)

/tmp/qemu-open.1QYxTz (deleted)

/tmp/qemu-open.1nXWKC (deleted)

/tmp/qemu-open.1szwVy (deleted)

/tmp/qemu-open.1ubBeA (deleted)

/tmp/qemu-open.2DXveC (deleted)

/tmp/qemu-open.2IXWYy (deleted)

/tmp/qemu-open.2JEUfC (deleted)

/tmp/qemu-open.2NmMIC (deleted)

/tmp/qemu-open.2SCYVy (deleted)

/tmp/qemu-open.2dDSqD (deleted)

/tmp/qemu-open.2lgEdA (deleted)

/tmp/qemu-open.2qbFtC (deleted)

/tmp/qemu-open.2yv8kD (deleted)

/tmp/qemu-open.3DJF5C (deleted)

/tmp/qemu-open.3HAHDA (deleted)

/tmp/qemu-open.3IHqhD (deleted)

/tmp/qemu-open.3Usu5z (deleted)

/tmp/qemu-open.3fjfXz (deleted)

/tmp/qemu-open.3jM7YA (deleted)

/tmp/qemu-open.3pEY2y (deleted)

Linux Analysis Report
aMTecZscrq.elf

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x188f0	0x188f0	6.9044	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x19000	0x429000	0x429000	0x4864	0x8dd8	0.3278	0x6	RW	0x10000	.ctors .dtors .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 14:41:02.189524889 CEST	50430	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:41:02.548700094 CEST	2023	50430	203.145.46.240	192.168.2.14
Apr 25, 2024 14:41:08.310523033 CEST	50432	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:41:08.689963102 CEST	2023	50432	203.145.46.240	192.168.2.14
Apr 25, 2024 14:41:11.313853025 CEST	46540	443	192.168.2.14	185.125.190.26
Apr 25, 2024 14:41:16.800564051 CEST	50434	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:41:17.186897993 CEST	2023	50434	203.145.46.240	192.168.2.14
Apr 25, 2024 14:41:21.299027920 CEST	50436	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:41:21.697009087 CEST	2023	50436	203.145.46.240	192.168.2.14
Apr 25, 2024 14:41:42.288636923 CEST	46540	443	192.168.2.14	185.125.190.26
Apr 25, 2024 14:41:55.814846992 CEST	50438	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:41:56.192414999 CEST	2023	50438	203.145.46.240	192.168.2.14
Apr 25, 2024 14:42:01.303320885 CEST	53962	2023	192.168.2.14	51.79.217.59
Apr 25, 2024 14:42:01.626615047 CEST	2023	53962	51.79.217.59	192.168.2.14
Apr 25, 2024 14:42:11.391463995 CEST	50442	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:42:11.735747099 CEST	2023	50442	203.145.46.240	192.168.2.14
Apr 25, 2024 14:42:21.846432924 CEST	50444	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:42:22.207468033 CEST	2023	50444	203.145.46.240	192.168.2.14
Apr 25, 2024 14:42:25.318140030 CEST	50446	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:42:25.681852102 CEST	2023	50446	203.145.46.240	192.168.2.14
Apr 25, 2024 14:42:33.792869091 CEST	50448	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:42:34.145883083 CEST	2023	50448	203.145.46.240	192.168.2.14
Apr 25, 2024 14:42:39.256688118 CEST	50450	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:42:40.270243883 CEST	50450	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:42:40.616472006 CEST	2023	50450	203.145.46.240	192.168.2.14
Apr 25, 2024 14:42:45.281138897 CEST	53974	2023	192.168.2.14	51.79.217.59
Apr 25, 2024 14:42:45.598929882 CEST	2023	53974	51.79.217.59	192.168.2.14
Apr 25, 2024 14:42:56.812325954 CEST	50454	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:42:57.180802107 CEST	2023	50454	203.145.46.240	192.168.2.14
Apr 25, 2024 14:42:58.293318033 CEST	50456	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:42:59.309474945 CEST	50456	2023	192.168.2.14	203.145.46.240
Apr 25, 2024 14:42:59.693705082 CEST	2023	50456	203.145.46.240	192.168.2.14
Apr 25, 2024 14:43:03.913456917 CEST	53980	2023	192.168.2.14	51.79.217.59
Apr 25, 2024 14:43:04.243429899 CEST	2023	53980	51.79.217.59	192.168.2.14

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 14:41:02.078258991 CEST	51421	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:02.189086914 CEST	53	51421	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:05.549324036 CEST	53254	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:05.659293890 CEST	53	53254	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:05.659477949 CEST	59461	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:05.769732952 CEST	53	59461	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:05.769861937 CEST	41879	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:05.879890919 CEST	53	41879	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:05.880023003 CEST	44558	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:05.989985943 CEST	53	44558	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:05.990144014 CEST	39870	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:06.100135088 CEST	53	39870	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:06.100394011 CEST	38911	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:06.210483074 CEST	53	38911	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:06.210829020 CEST	35128	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:06.320774078 CEST	53	35128	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:06.320940018 CEST	46968	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:06.430804968 CEST	53	46968	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:06.430969000 CEST	54339	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:06.541121960 CEST	53	54339	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:06.541404963 CEST	32810	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:06.651470900 CEST	53	32810	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:06.651734114 CEST	47358	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:06.761778116 CEST	53	47358	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:06.761914968 CEST	33985	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:06.871874094 CEST	53	33985	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:06.872041941 CEST	55114	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:06.982232094 CEST	53	55114	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:06.982444048 CEST	44541	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:07.092478037 CEST	53	44541	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:07.092668056 CEST	45333	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:07.202625036 CEST	53	45333	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:07.202867031 CEST	58342	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:07.312941074 CEST	53	58342	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:07.313088894 CEST	37259	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:07.423017979 CEST	53	37259	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:07.423202038 CEST	36902	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:07.533416986 CEST	53	36902	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:07.533576965 CEST	37984	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:07.645246029 CEST	53	37984	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:07.645390987 CEST	38363	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:07.755637884 CEST	53	38363	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:07.755897999 CEST	58348	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:07.866473913 CEST	53	58348	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:07.866614103 CEST	45313	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:07.976826906 CEST	53	45313	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:07.976964951 CEST	44752	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:08.087544918 CEST	53	44752	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:08.087692976 CEST	54438	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:08.197671890 CEST	53	54438	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:08.197834015 CEST	38986	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:08.307881117 CEST	53	38986	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:16.689974070 CEST	42099	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:16.800390005 CEST	53	42099	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:21.187941074 CEST	54578	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:21.298459053 CEST	53	54578	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:28.703022003 CEST	56583	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:33.705310106 CEST	33951	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:38.708863020 CEST	53871	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:43.712634087 CEST	60958	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:48.716470003 CEST	32935	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:50.181988001 CEST	53	53871	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:53.720226049 CEST	55980	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:53.830210924 CEST	53	55980	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:53.830338001 CEST	52476	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:53.940237045 CEST	53	52476	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:53.940340042 CEST	36747	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:54.050539970 CEST	53	36747	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:54.050674915 CEST	37445	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:54.160725117 CEST	53	37445	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:54.160927057 CEST	39029	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:54.271017075 CEST	53	39029	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:54.271186113 CEST	47288	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:54.381295919 CEST	53	47288	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:54.381439924 CEST	56011	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:54.491446018 CEST	53	56011	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:54.491586924 CEST	59508	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:54.601651907 CEST	53	59508	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:54.601772070 CEST	38078	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:54.712069988 CEST	53	38078	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:54.712191105 CEST	32798	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:54.823060036 CEST	53	32798	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:54.823240042 CEST	51453	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:54.933151960 CEST	53	51453	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:54.933331966 CEST	44532	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:55.043162107 CEST	53	44532	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:55.043334007 CEST	56024	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:55.153347015 CEST	53	56024	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:55.153475046 CEST	47222	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:55.263514042 CEST	53	47222	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:55.263667107 CEST	36739	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:55.373792887 CEST	53	36739	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:55.373912096 CEST	46228	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:55.483804941 CEST	53	46228	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:55.483952999 CEST	57324	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:55.594043016 CEST	53	57324	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:55.594170094 CEST	47594	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:55.704556942 CEST	53	47594	8.8.8.8	192.168.2.14
Apr 25, 2024 14:41:55.704679012 CEST	52775	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:41:55.814698935 CEST	53	52775	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:01.192451954 CEST	55921	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:01.303173065 CEST	53	55921	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:09.626564980 CEST	46864	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:09.736763000 CEST	53	46864	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:09.736902952 CEST	60032	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:09.847009897 CEST	53	60032	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:09.847187042 CEST	33915	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:09.957461119 CEST	53	33915	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:09.957566977 CEST	40296	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:10.067826986 CEST	53	40296	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:10.067934036 CEST	58940	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:10.178097010 CEST	53	58940	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:10.178253889 CEST	43365	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:10.288290977 CEST	53	43365	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:10.288479090 CEST	58379	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:10.398638964 CEST	53	58379	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:10.398742914 CEST	60446	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:10.508869886 CEST	53	60446	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:10.509048939 CEST	54244	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:10.619267941 CEST	53	54244	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:10.619395971 CEST	47508	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:10.729342937 CEST	53	47508	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:10.729506016 CEST	38966	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:10.839477062 CEST	53	38966	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:10.839596033 CEST	33660	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:10.949685097 CEST	53	33660	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:10.949781895 CEST	43101	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:11.060096979 CEST	53	43101	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:11.060271025 CEST	43359	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:11.170274973 CEST	53	43359	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:11.170373917 CEST	40817	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:11.280440092 CEST	53	40817	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:11.280559063 CEST	60103	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:11.391285896 CEST	53	60103	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:21.735754013 CEST	41330	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:21.846266031 CEST	53	41330	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:25.207662106 CEST	60812	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:25.317969084 CEST	53	60812	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:33.681916952 CEST	47352	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:33.792685032 CEST	53	47352	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:39.146080017 CEST	56187	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:39.256539106 CEST	53	56187	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:44.616655111 CEST	33350	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:44.726766109 CEST	53	33350	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:44.727077007 CEST	56331	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:44.837353945 CEST	53	56331	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:44.837878942 CEST	37786	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:44.947956085 CEST	53	37786	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:44.948160887 CEST	47091	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:45.058448076 CEST	53	47091	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:45.059900999 CEST	46136	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:45.170000076 CEST	53	46136	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:45.170325041 CEST	57615	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:45.280986071 CEST	53	57615	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:55.598778009 CEST	55465	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:55.708808899 CEST	53	55465	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:55.708940029 CEST	40256	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:55.819806099 CEST	53	40256	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:55.819973946 CEST	57916	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:55.930126905 CEST	53	57916	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:55.930257082 CEST	37749	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:56.040221930 CEST	53	37749	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:56.040308952 CEST	54112	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:56.150302887 CEST	53	54112	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:56.150475025 CEST	54822	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:56.260437965 CEST	53	54822	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:56.260543108 CEST	43084	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:56.370738029 CEST	53	43084	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:56.370835066 CEST	41553	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:56.481004000 CEST	53	41553	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:56.481153965 CEST	56753	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:56.591377974 CEST	53	56753	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:56.591469049 CEST	46523	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:56.701554060 CEST	53	46523	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:56.701692104 CEST	37896	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:56.812186003 CEST	53	37896	8.8.8.8	192.168.2.14
Apr 25, 2024 14:42:58.181128025 CEST	41337	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:42:58.293184996 CEST	53	41337	8.8.8.8	192.168.2.14
Apr 25, 2024 14:43:02.694004059 CEST	41094	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:43:02.804122925 CEST	53	41094	8.8.8.8	192.168.2.14
Apr 25, 2024 14:43:02.804299116 CEST	58499	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:43:02.914495945 CEST	53	58499	8.8.8.8	192.168.2.14
Apr 25, 2024 14:43:02.914652109 CEST	44175	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:43:03.024743080 CEST	53	44175	8.8.8.8	192.168.2.14
Apr 25, 2024 14:43:03.024954081 CEST	58685	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:43:03.137864113 CEST	53	58685	8.8.8.8	192.168.2.14
Apr 25, 2024 14:43:03.138000011 CEST	34445	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:43:03.251194000 CEST	53	34445	8.8.8.8	192.168.2.14
Apr 25, 2024 14:43:03.251357079 CEST	44986	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:43:03.361326933 CEST	53	44986	8.8.8.8	192.168.2.14
Apr 25, 2024 14:43:03.361505985 CEST	60716	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:43:03.471673012 CEST	53	60716	8.8.8.8	192.168.2.14
Apr 25, 2024 14:43:03.471834898 CEST	58366	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:43:03.581823111 CEST	53	58366	8.8.8.8	192.168.2.14
Apr 25, 2024 14:43:03.582040071 CEST	44446	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:43:03.691966057 CEST	53	44446	8.8.8.8	192.168.2.14
Apr 25, 2024 14:43:03.692147017 CEST	36682	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:43:03.802319050 CEST	53	36682	8.8.8.8	192.168.2.14
Apr 25, 2024 14:43:03.802659988 CEST	59859	53	192.168.2.14	8.8.8.8
Apr 25, 2024 14:43:03.913237095 CEST	53	59859	8.8.8.8	192.168.2.14

Start time (UTC):	12:41:01
Start date (UTC):	25/04/2024
Path:	/tmp/aMTecZscrq.elf
Arguments:	/tmp/aMTecZscrq.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	12:41:02
Start date (UTC):	25/04/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	12:41:05
Start date (UTC):	25/04/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	12:41:06
Start date (UTC):	25/04/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	12:41:07
Start date (UTC):	25/04/2024
Path:	/usr/bin/xfdesktop
Arguments:	xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba
File size:	473520 bytes
MD5 hash:	dfb13e1581f80065dcea16f2476f16f2

Start time (UTC):	12:41:08
Start date (UTC):	25/04/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre