Linux Analysis Report fVNp9NC9l9

ID:	491760
Product:	CloudBasic
Start time:	21:33:29
Start date:	27.09.2021
Sample:	fVNp9NC9l9
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	3ad11448f98fc08e6c1107c4327ab97f
SHA1:	9c0d1819f9b9292119560e21b8d2ff4c2f66316d
SHA256:	40b4a8e91427b81ee97fb43a56edce02dce93f88a6c55ad698c50693fb069f6b
Filetype:	ELF Executable and Linkable format (Linux) (4029/14) 50.16%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Multi AV Scanner detection for submitted file

Source: fVNp9NC9l9	Virustotal: Detection: 28%			Perma Link
Source: fVNp9NC9l9	ReversingLabs: Detection: 46%

Spreading:

Opens /proc/net/* files useful for finding connected devices and routers

Source: /tmp/fVNp9NC9l9 (PID: 5220)

Opens: /proc/net/route

Jump to behavior

Networking:

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.23:49078 -> 45.142.182.126:666

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 45.142.182.126
Source: unknown	TCP traffic detected without corresponding DNS query: 45.142.182.126
Source: unknown	TCP traffic detected without corresponding DNS query: 45.142.182.126
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 45.142.182.126
Source: unknown	TCP traffic detected without corresponding DNS query: 45.142.182.126
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 45.142.182.126
Source: unknown	TCP traffic detected without corresponding DNS query: 45.142.182.126
Source: unknown	TCP traffic detected without corresponding DNS query: 45.142.182.126
Source: unknown	TCP traffic detected without corresponding DNS query: 45.142.182.126

System Summary:

Sample contains only a LOAD segment without any section mappings

Source: LOAD without section mappings

Program segment: 0x8048000

Classification label

Source: classification engine

Classification label: mal60.spre.troj.lin@0/0@0/0

Stealing of Sensitive Information:

Yara detected Mirai

Source: Yara match	File source: 5221.1.000000001a887bdc.00000000531557b5.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5220.1.000000001a887bdc.00000000531557b5.r-x.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Mirai

Source: Yara match	File source: 5221.1.000000001a887bdc.00000000531557b5.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5220.1.000000001a887bdc.00000000531557b5.r-x.sdmp, type: MEMORY