Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf

Overview

General Information

Sample name:SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf
Analysis ID:1504848
MD5:0e9baddd505edcaf077b6935323b608f
SHA1:8cedefd89863bf40ea986e8a0ed6bdaf5b3cd6e5
SHA256:f5a9ea37f7c2b08313ca8da83d0e0685d5539d3ae23a2276bcd22513a97b5b39
Tags:elf
Infos:

Detection

Mirai
Score:76
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample contains only a LOAD segment without any section mappings
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1504848
Start date and time:2024-09-05 14:22:11 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 2s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf
Detection:MAL
Classification:mal76.troj.evad.linELF@0/0@0/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • VT rate limit hit for: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf

Runtime Messages

Command:/tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf
PID:6204
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

  • system is lnxubuntu20
  • dash New Fork (PID: 6194, Parent: 4333)
  • rm (PID: 6194, Parent: 4333, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.9yohMkvOXt /tmp/tmp.Ax2zdBdAp6 /tmp/tmp.afWcU9SYKv
  • dash New Fork (PID: 6195, Parent: 4333)
  • rm (PID: 6195, Parent: 4333, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.9yohMkvOXt /tmp/tmp.Ax2zdBdAp6 /tmp/tmp.afWcU9SYKv
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
6218.1.00007f7220017000.00007f7220029000.r-x.sdmpJoeSecurity_Mirai_9Yara detected MiraiJoe Security
    6218.1.00007f7220017000.00007f7220029000.r-x.sdmpJoeSecurity_Mirai_5Yara detected MiraiJoe Security
      6218.1.00007f7220017000.00007f7220029000.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
      • 0x10574:$x1: POST /cdn-cgi/
      • 0x10a2c:$s1: LCOGQGPTGP
      6218.1.00007f7220017000.00007f7220029000.r-x.sdmpMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
      • 0x10574:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
      6207.1.00007f7220017000.00007f7220029000.r-x.sdmpJoeSecurity_Mirai_9Yara detected MiraiJoe Security
        Click to see the 7 entries

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Multi AV Scanner detection for submitted file
        Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elfReversingLabs: Detection: 39%
        Source: global trafficTCP traffic: 192.168.2.23:33046 -> 154.216.17.218:9506
        Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
        Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
        Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.218
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.218
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.218
        Source: unknownTCP traffic detected without corresponding DNS query: 206.187.94.80
        Source: unknownTCP traffic detected without corresponding DNS query: 9.0.49.169
        Source: unknownTCP traffic detected without corresponding DNS query: 58.20.36.176
        Source: unknownTCP traffic detected without corresponding DNS query: 245.31.125.108
        Source: unknownTCP traffic detected without corresponding DNS query: 221.158.243.207
        Source: unknownTCP traffic detected without corresponding DNS query: 192.114.222.129
        Source: unknownTCP traffic detected without corresponding DNS query: 154.15.185.87
        Source: unknownTCP traffic detected without corresponding DNS query: 19.172.102.2
        Source: unknownTCP traffic detected without corresponding DNS query: 8.175.73.226
        Source: unknownTCP traffic detected without corresponding DNS query: 170.59.108.176
        Source: unknownTCP traffic detected without corresponding DNS query: 92.56.54.255
        Source: unknownTCP traffic detected without corresponding DNS query: 150.44.149.87
        Source: unknownTCP traffic detected without corresponding DNS query: 212.248.148.31
        Source: unknownTCP traffic detected without corresponding DNS query: 196.255.115.200
        Source: unknownTCP traffic detected without corresponding DNS query: 163.235.66.150
        Source: unknownTCP traffic detected without corresponding DNS query: 158.211.65.19
        Source: unknownTCP traffic detected without corresponding DNS query: 46.82.79.150
        Source: unknownTCP traffic detected without corresponding DNS query: 167.142.178.126
        Source: unknownTCP traffic detected without corresponding DNS query: 83.234.99.18
        Source: unknownTCP traffic detected without corresponding DNS query: 196.167.242.232
        Source: unknownTCP traffic detected without corresponding DNS query: 76.102.241.106
        Source: unknownTCP traffic detected without corresponding DNS query: 24.43.222.133
        Source: unknownTCP traffic detected without corresponding DNS query: 242.186.207.204
        Source: unknownTCP traffic detected without corresponding DNS query: 139.251.121.207
        Source: unknownTCP traffic detected without corresponding DNS query: 168.37.197.254
        Source: unknownTCP traffic detected without corresponding DNS query: 133.136.247.80
        Source: unknownTCP traffic detected without corresponding DNS query: 84.48.227.120
        Source: unknownTCP traffic detected without corresponding DNS query: 169.195.30.83
        Source: unknownTCP traffic detected without corresponding DNS query: 182.60.146.214
        Source: unknownTCP traffic detected without corresponding DNS query: 98.85.160.164
        Source: unknownTCP traffic detected without corresponding DNS query: 46.63.255.194
        Source: unknownTCP traffic detected without corresponding DNS query: 34.12.177.53
        Source: unknownTCP traffic detected without corresponding DNS query: 1.173.123.245
        Source: unknownTCP traffic detected without corresponding DNS query: 159.47.145.232
        Source: unknownTCP traffic detected without corresponding DNS query: 245.33.215.59
        Source: unknownTCP traffic detected without corresponding DNS query: 195.249.211.112
        Source: unknownTCP traffic detected without corresponding DNS query: 101.146.34.112
        Source: unknownTCP traffic detected without corresponding DNS query: 159.129.81.32
        Source: unknownTCP traffic detected without corresponding DNS query: 84.19.132.114
        Source: unknownTCP traffic detected without corresponding DNS query: 93.128.32.10
        Source: unknownTCP traffic detected without corresponding DNS query: 42.175.113.198
        Source: unknownTCP traffic detected without corresponding DNS query: 100.127.88.184
        Source: unknownTCP traffic detected without corresponding DNS query: 76.158.178.197
        Source: unknownTCP traffic detected without corresponding DNS query: 154.216.17.218
        Source: unknownTCP traffic detected without corresponding DNS query: 173.103.40.46
        Source: unknownTCP traffic detected without corresponding DNS query: 218.231.200.102
        Source: unknownTCP traffic detected without corresponding DNS query: 97.46.225.230
        Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elfString found in binary or memory: http://upx.sf.net
        Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

        System Summary

        barindex
        Malicious sample detected (through community Yara rule)
        Source: 6218.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
        Source: 6218.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
        Source: 6207.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
        Source: 6207.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
        Source: 6204.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
        Source: 6204.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
        Source: LOAD without section mappingsProgram segment: 0x8000
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6206)SIGKILL sent: pid: 759, result: successfulJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6206)SIGKILL sent: pid: 6034, result: successfulJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)SIGKILL sent: pid: 759, result: successfulJump to behavior
        Source: 6218.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
        Source: 6218.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
        Source: 6207.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
        Source: 6207.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
        Source: 6204.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
        Source: 6204.1.00007f7220017000.00007f7220029000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
        Source: classification engineClassification label: mal76.troj.evad.linELF@0/0@0/0

        Data Obfuscation

        barindex
        Sample is packed with UPX
        Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
        Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
        Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1582/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2033/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2275/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/3088/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1612/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1579/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1699/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1335/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1698/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2028/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1334/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1576/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2302/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/3236/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2025/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2146/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/910/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/4444/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/4445/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/912/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/4446/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/517/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/759/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/4447/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2307/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/918/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1594/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2285/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2281/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1349/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1623/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/761/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1622/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/884/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1983/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2038/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1344/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1465/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1586/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1860/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1463/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2156/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/800/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/801/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1629/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1627/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1900/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/4470/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/4474/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/4476/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/3021/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/491/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2294/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2050/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1877/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/772/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1633/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1599/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1632/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/774/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1477/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/654/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/896/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1476/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1872/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2048/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/655/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1475/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2289/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/656/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/777/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/657/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/658/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/4468/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/419/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/936/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1639/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1638/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2208/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2180/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/6145/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1809/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1494/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1890/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2063/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2062/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1888/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1886/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/420/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1489/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/785/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1642/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/788/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/667/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/789/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/1648/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/6034/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/6154/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2078/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2077/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2074/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2195/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/670/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/2746/exeJump to behavior
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6212)File opened: /proc/793/exeJump to behavior
        Source: /usr/bin/dash (PID: 6194)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.9yohMkvOXt /tmp/tmp.Ax2zdBdAp6 /tmp/tmp.afWcU9SYKvJump to behavior
        Source: /usr/bin/dash (PID: 6195)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.9yohMkvOXt /tmp/tmp.Ax2zdBdAp6 /tmp/tmp.afWcU9SYKvJump to behavior
        Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elfSubmission file: segment LOAD with 7.9526 entropy (max. 8.0)
        Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf (PID: 6204)Queries kernel information via 'uname': Jump to behavior
        Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6204.1.0000557ecf015000.0000557ecf1a3000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6207.1.0000557ecf015000.0000557ecf1a3000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6218.1.0000557ecf015000.0000557ecf1a3000.rw-.sdmpBinary or memory string: ~U!/etc/qemu-binfmt/arm
        Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6204.1.0000557ecf015000.0000557ecf1a3000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6207.1.0000557ecf015000.0000557ecf1a3000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6218.1.0000557ecf015000.0000557ecf1a3000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6204.1.00007fffcc09e000.00007fffcc0bf000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6207.1.00007fffcc09e000.00007fffcc0bf000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6218.1.00007fffcc09e000.00007fffcc0bf000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
        Source: SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6204.1.00007fffcc09e000.00007fffcc0bf000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6207.1.00007fffcc09e000.00007fffcc0bf000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf, 6218.1.00007fffcc09e000.00007fffcc0bf000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SecuriteInfo.com.Linux.Siggen.9999.8352.26322.elf

        Stealing of Sensitive Information

        bar