Edit tour

Linux Analysis Report
Space.arm6.elf

Overview

General Information

Sample name:	Space.arm6.elf
Analysis ID:	1665364
MD5:	0f1bbf74ef43b2da343204026b6ad315
SHA1:	4850b0be796f3a51360713a5ec98b395a9c47d2a
SHA256:	e99fa4bfe123332cfa1a3094a6cec18c6a00e76121f71a0949d3e812bc4b9098
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1665364
Start date and time:	2025-04-15 14:07:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Space.arm6.elf
Detection:	MAL
Classification:	mal60.evad.linELF@0/0@0/0

Runtime Messages

Command:	/tmp/Space.arm6.elf
PID:	5529
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

Space.arm6.elf (PID: 5529, Parent: 5448, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Space.arm6.elf

Space.arm6.elf New Fork (PID: 5532, Parent: 5529)

Space.arm6.elf New Fork (PID: 5534, Parent: 5532)

Space.arm6.elf New Fork (PID: 5536, Parent: 5532)

Space.arm6.elf New Fork (PID: 5542, Parent: 5529)

Space.arm6.elf New Fork (PID: 5544, Parent: 5529)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5529.1.00007f6244017000.00007f624402f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1535c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1544c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1549c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5534.1.00007f6244017000.00007f624402f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1535c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1544c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1549c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5542.1.00007f6244017000.00007f624402f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1535c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1544c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1549c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5532.1.00007f6244017000.00007f624402f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1535c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1544c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1549c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.arm6.elf PID: 5529	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1183c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11850:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11864:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11878:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1188c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x118f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11904:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11918:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1192c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11940:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11954:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11968:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1197c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11990:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x119a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x119b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x119cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.arm6.elf PID: 5532	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12294:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1230c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1235c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.arm6.elf PID: 5534	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12a88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ab0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ac4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ad8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12aec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12bf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.arm6.elf PID: 5542	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x300:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x314:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x328:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x350:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x364:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x378:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Space.arm6.elf	Virustotal: Detection: 45%			Perma Link
Source: Space.arm6.elf	ReversingLabs: Detection: 50%

Source: global traffic

TCP traffic: 192.168.2.15:58300 -> 107.173.143.15:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15
Source: unknown	TCP traffic detected without corresponding DNS query: 107.173.143.15

Source: Space.arm6.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5529.1.00007f6244017000.00007f624402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5534.1.00007f6244017000.00007f624402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5542.1.00007f6244017000.00007f624402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5532.1.00007f6244017000.00007f624402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.arm6.elf PID: 5529, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.arm6.elf PID: 5532, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.arm6.elf PID: 5534, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.arm6.elf PID: 5542, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x8000

Source: 5529.1.00007f6244017000.00007f624402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5534.1.00007f6244017000.00007f624402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5542.1.00007f6244017000.00007f624402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5532.1.00007f6244017000.00007f624402f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.arm6.elf PID: 5529, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.arm6.elf PID: 5532, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.arm6.elf PID: 5534, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.arm6.elf PID: 5542, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal60.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/1333/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/1695/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/911/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/3876/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/1591/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/1585/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/804/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/3407/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/1484/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/133/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/1479/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/931/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/1595/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/812/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/933/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/3419/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/3310/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/261/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/262/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/142/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/263/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/264/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/265/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/145/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/266/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/267/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/268/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/3303/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/269/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/1486/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/1806/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/3440/status	Jump to behavior
Source: /tmp/Space.arm6.elf (PID: 5529)	File opened: /proc/270/status	Jump to behavior

Source: Space.arm6.elf

Submission file: segment LOAD with 7.9737 entropy (max. 8.0)

Source: /tmp/Space.arm6.elf (PID: 5529)

Queries kernel information via 'uname':

Jump to behavior

Source: Space.arm6.elf, 5529.1.0000559dc96e5000.0000559dc98d3000.rw-.sdmp, Space.arm6.elf, 5532.1.0000559dc96e5000.0000559dc98d3000.rw-.sdmp, Space.arm6.elf, 5534.1.0000559dc96e5000.0000559dc98d3000.rw-.sdmp, Space.arm6.elf, 5542.1.0000559dc96e5000.0000559dc98d3000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: Space.arm6.elf, 5529.1.00007ffcf73be000.00007ffcf73df000.rw-.sdmp, Space.arm6.elf, 5532.1.00007ffcf73be000.00007ffcf73df000.rw-.sdmp, Space.arm6.elf, 5534.1.00007ffcf73be000.00007ffcf73df000.rw-.sdmp, Space.arm6.elf, 5542.1.00007ffcf73be000.00007ffcf73df000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Space.arm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Space.arm6.elf
Source: Space.arm6.elf, 5529.1.0000559dc96e5000.0000559dc98d3000.rw-.sdmp, Space.arm6.elf, 5532.1.0000559dc96e5000.0000559dc98d3000.rw-.sdmp, Space.arm6.elf, 5534.1.0000559dc96e5000.0000559dc98d3000.rw-.sdmp, Space.arm6.elf, 5542.1.0000559dc96e5000.0000559dc98d3000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Space.arm6.elf, 5529.1.00007ffcf73be000.00007ffcf73df000.rw-.sdmp, Space.arm6.elf, 5532.1.00007ffcf73be000.00007ffcf73df000.rw-.sdmp, Space.arm6.elf, 5534.1.00007ffcf73be000.00007ffcf73df000.rw-.sdmp, Space.arm6.elf, 5542.1.00007ffcf73be000.00007ffcf73df000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Space.arm6.elf	45%	Virustotal		Browse
Space.arm6.elf	50%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Space.arm6.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
107.173.143.15	unknown	United States		36352	AS-COLOCROSSINGUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
107.173.143.15	Space.sh4.elf	Get hash	malicious	Unknown	Browse
	Space.x86.elf	Get hash	malicious	Unknown	Browse
	Space.m68k.elf	Get hash	malicious	Mirai	Browse
	Space.mips.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	Space.sh4.elf	Get hash	malicious	Unknown	Browse	107.173.143.15
	Space.x86.elf	Get hash	malicious	Unknown	Browse	107.173.143.15
	Space.m68k.elf	Get hash	malicious	Mirai	Browse	107.173.143.15
	Space.mips.elf	Get hash	malicious	Unknown	Browse	107.173.143.15
	ORDER-25013-67789543AX.vbs	Get hash	malicious	WSHRat, DarkTortilla	Browse	104.168.7.12
	ORDER-2504014-0054739AP.vbs	Get hash	malicious	WSHRat, DarkTortilla	Browse	172.245.208.13
	15042025Payment .xls	Get hash	malicious	Unknown	Browse	172.245.208.21
	15042025Payment .xls	Get hash	malicious	Unknown	Browse	172.245.208.21
	ORDER#250944.XLS.vbs	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	172.245.208.13
	15042025Payment .xls	Get hash	malicious	Unknown	Browse	172.245.208.21

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.971922427628843
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Space.arm6.elf
File size:	44'592 bytes
MD5:	0f1bbf74ef43b2da343204026b6ad315
SHA1:	4850b0be796f3a51360713a5ec98b395a9c47d2a
SHA256:	e99fa4bfe123332cfa1a3094a6cec18c6a00e76121f71a0949d3e812bc4b9098
SHA512:	74be45e78f374834c83c12431c44a0f1123e2309ee7d40fc5a1f36ea69021756e218133723cd28e5a572002c027a7e1b616347aaf156f8414c01a41b870fe7e2
SSDEEP:	768:3/ZyKJoofyfTtMLfclRAAO+jVbumZnLM3XgcTaWS5HOFz8Vg9OQM9q3UELL:hbjjOAgfnLGRMOSOzLL
TLSH:	4913F1B65E97DC3BC5A9B93D98A44AC70F1B34FDB4FCE042A02586791DF1009A7B1847
File Content Preview:	.ELF..............(.........4...........4. ...(.........................................H...H...H...................Q.td...............................OUPX!...................._..........?.E.h;....#..$.......L..T.\|..r.F..ZS..n.8.I+.e......rQN..D....I.:#/.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x11af8
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0xace5	0xace5	7.9737	0x5	R E	0x8000
LOAD	0xb48	0x20b48	0x20b48	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 15, 2025 14:08:05.945521116 CEST	58300	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:06.079188108 CEST	3778	58300	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:07.091286898 CEST	58302	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:07.225352049 CEST	3778	58302	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:12.280703068 CEST	58304	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:12.414937019 CEST	3778	58304	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:13.418808937 CEST	58306	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:13.553046942 CEST	3778	58306	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:14.227405071 CEST	58308	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:14.361654043 CEST	3778	58308	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:20.555783033 CEST	58310	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:20.689591885 CEST	3778	58310	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:23.365098953 CEST	58312	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:23.499417067 CEST	3778	58312	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:29.691972017 CEST	58314	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:29.826524973 CEST	3778	58314	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:32.503277063 CEST	58316	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:32.637418985 CEST	3778	58316	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:37.640266895 CEST	58318	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:37.780673027 CEST	3778	58318	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:38.829390049 CEST	58320	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:38.967926979 CEST	3778	58320	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:43.970808983 CEST	58322	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:44.111143112 CEST	3778	58322	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:45.783154964 CEST	58324	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:45.924556971 CEST	3778	58324	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:49.927115917 CEST	58326	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:50.060605049 CEST	3778	58326	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:52.113454103 CEST	58328	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:52.247674942 CEST	3778	58328	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:56.250118017 CEST	58330	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:56.383645058 CEST	3778	58330	107.173.143.15	192.168.2.15
Apr 15, 2025 14:08:57.062695980 CEST	58332	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:08:57.196423054 CEST	3778	58332	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:02.198319912 CEST	58334	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:02.332515001 CEST	3778	58334	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:03.385720015 CEST	58336	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:03.519231081 CEST	3778	58336	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:05.335002899 CEST	58338	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:05.468869925 CEST	3778	58338	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:08.521279097 CEST	58340	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:08.655270100 CEST	3778	58340	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:11.657697916 CEST	58342	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:11.791718006 CEST	3778	58342	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:13.471282959 CEST	58344	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:13.605030060 CEST	3778	58344	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:18.608057022 CEST	58346	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:18.741642952 CEST	3778	58346	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:19.794848919 CEST	58348	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:19.928992033 CEST	3778	58348	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:21.744585991 CEST	58350	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:21.878703117 CEST	3778	58350	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:24.931979895 CEST	58352	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:25.066555977 CEST	3778	58352	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:27.882302046 CEST	58354	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:28.016827106 CEST	3778	58354	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:28.069214106 CEST	58356	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:28.202965975 CEST	3778	58356	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:32.019412041 CEST	58358	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:32.153337002 CEST	3778	58358	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:34.205682993 CEST	58360	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:34.339498043 CEST	3778	58360	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:36.155559063 CEST	58362	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:36.291712046 CEST	3778	58362	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:38.294475079 CEST	58364	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:38.342952013 CEST	58366	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:38.428719997 CEST	3778	58364	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:38.476969957 CEST	3778	58366	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:42.480345011 CEST	58368	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:42.615302086 CEST	3778	58368	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:44.432602882 CEST	58370	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:44.566895008 CEST	3778	58370	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:44.618416071 CEST	58372	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:44.752449989 CEST	3778	58372	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:45.570075989 CEST	58374	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:45.704355955 CEST	3778	58374	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:46.707285881 CEST	58376	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:46.841038942 CEST	3778	58376	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:50.755017042 CEST	58378	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:50.889267921 CEST	3778	58378	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:51.891571045 CEST	58380	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:52.025368929 CEST	3778	58380	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:53.028167009 CEST	58382	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:53.162225962 CEST	3778	58382	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:55.844225883 CEST	58384	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:09:55.981106997 CEST	3778	58384	107.173.143.15	192.168.2.15
Apr 15, 2025 14:09:59.983594894 CEST	58386	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:10:00.117252111 CEST	3778	58386	107.173.143.15	192.168.2.15
Apr 15, 2025 14:10:01.119735956 CEST	58388	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:10:01.253595114 CEST	3778	58388	107.173.143.15	192.168.2.15
Apr 15, 2025 14:10:02.164661884 CEST	58390	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:10:02.298878908 CEST	3778	58390	107.173.143.15	192.168.2.15
Apr 15, 2025 14:10:05.255356073 CEST	58392	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:10:05.389703035 CEST	3778	58392	107.173.143.15	192.168.2.15
Apr 15, 2025 14:10:06.301198006 CEST	58394	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:10:06.391468048 CEST	58396	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:10:06.435317039 CEST	3778	58394	107.173.143.15	192.168.2.15
Apr 15, 2025 14:10:06.525815964 CEST	3778	58396	107.173.143.15	192.168.2.15
Apr 15, 2025 14:10:07.437489986 CEST	58398	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:10:07.571249962 CEST	3778	58398	107.173.143.15	192.168.2.15
Apr 15, 2025 14:10:11.573678970 CEST	58400	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:10:11.707324982 CEST	3778	58400	107.173.143.15	192.168.2.15
Apr 15, 2025 14:10:12.710141897 CEST	58402	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:10:12.843841076 CEST	3778	58402	107.173.143.15	192.168.2.15
Apr 15, 2025 14:10:13.527503967 CEST	58404	3778	192.168.2.15	107.173.143.15
Apr 15, 2025 14:10:13.661390066 CEST	3778	58404	107.173.143.15	192.168.2.15

System Behavior

Analysis Process: Space.arm6.elf PID: 5529, Parent PID: 5448

General

Start time (UTC):	12:08:04
Start date (UTC):	15/04/2025
Path:	/tmp/Space.arm6.elf
Arguments:	/tmp/Space.arm6.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5532, Parent PID: 5529

General

Start time (UTC):	12:08:04
Start date (UTC):	15/04/2025
Path:	/tmp/Space.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5534, Parent PID: 5532

General

Start time (UTC):	12:08:04
Start date (UTC):	15/04/2025
Path:	/tmp/Space.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5536, Parent PID: 5532

General

Start time (UTC):	12:08:04
Start date (UTC):	15/04/2025
Path:	/tmp/Space.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5542, Parent PID: 5529

General

Start time (UTC):	12:08:10
Start date (UTC):	15/04/2025
Path:	/tmp/Space.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5544, Parent PID: 5529

General

Start time (UTC):	12:08:10
Start date (UTC):	15/04/2025
Path:	/tmp/Space.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Space.arm6.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: Space.arm6.elf PID: 5529, Parent PID: 5448

General

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5532, Parent PID: 5529

General

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5534, Parent PID: 5532

General

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5536, Parent PID: 5532

General

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5542, Parent PID: 5529

General

Chronological Activities

Analysis Process: Space.arm6.elf PID: 5544, Parent PID: 5529

General

Chronological Activities

Linux Analysis Report
Space.arm6.elf