Play interactive tour

Edit tour

Linux Analysis Report fVA3Q44QAK

Overview

General Information

Sample Name:	fVA3Q44QAK
Analysis ID:	553483
MD5:	cd6521521289846e8001d5f05cf0e10d
SHA1:	ecb03ba794a579a02ad8e0ef94b29ebed527a155
SHA256:	00a6f460395d2f545eba81ead528fcf2883582412affb7b052e7fef3478361c0
Tags:	32elfintelmirai
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Uses known network protocols on non-standard ports

Sample contains only a LOAD segment without any section mappings

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	553483
Start date:	15.01.2022
Start time:	01:01:50
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 25s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	fVA3Q44QAK
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal72.troj.evad.lin@0/0@0/0
Warnings:	Show All Report size exceeded maximum capacity and may have missing network information. TCP Packets have been reduced to 100

Process Tree

system is lnxubuntu20

fVA3Q44QAK (PID: 5218, Parent: 5108, MD5: cd6521521289846e8001d5f05cf0e10d) Arguments: /tmp/fVA3Q44QAK

fVA3Q44QAK New Fork (PID: 5219, Parent: 5218)

fVA3Q44QAK New Fork (PID: 5326, Parent: 5219)

fVA3Q44QAK New Fork (PID: 5328, Parent: 5219)

fVA3Q44QAK New Fork (PID: 5329, Parent: 5328)

fVA3Q44QAK New Fork (PID: 5335, Parent: 5329)

fVA3Q44QAK New Fork (PID: 5336, Parent: 5329)

fVA3Q44QAK New Fork (PID: 5330, Parent: 5328)

fVA3Q44QAK New Fork (PID: 5331, Parent: 5328)

fVA3Q44QAK New Fork (PID: 5220, Parent: 5218)

fVA3Q44QAK New Fork (PID: 5221, Parent: 5218)

fVA3Q44QAK New Fork (PID: 5222, Parent: 5221)

fVA3Q44QAK New Fork (PID: 5325, Parent: 5222)

fVA3Q44QAK New Fork (PID: 5327, Parent: 5222)

fVA3Q44QAK New Fork (PID: 5223, Parent: 5221)

fVA3Q44QAK New Fork (PID: 5224, Parent: 5221)

dash New Fork (PID: 5264, Parent: 4331)

rm (PID: 5264, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.FZJy5QRkED /tmp/tmp.Cx4p8ienxO /tmp/tmp.ayYQw5P6KC

cleanup

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: fVA3Q44QAK	Virustotal: Detection: 36%			Perma Link
Source: fVA3Q44QAK	ReversingLabs: Detection: 51%

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 716 INFO TELNET access 41.57.43.2:23 -> 192.168.2.23:52626
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 41.57.43.2:23 -> 192.168.2.23:52626
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 41.57.43.2:23 -> 192.168.2.23:52626
Source: Traffic	Snort IDS: 716 INFO TELNET access 41.57.43.2:23 -> 192.168.2.23:52648
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 41.57.43.2:23 -> 192.168.2.23:52648
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 41.57.43.2:23 -> 192.168.2.23:52648
Source: Traffic	Snort IDS: 716 INFO TELNET access 177.7.221.41:23 -> 192.168.2.23:59270
Source: Traffic	Snort IDS: 2023433 ET TROJAN Possible Linux.Mirai Login Attempt (7ujMko0admin) 192.168.2.23:59270 -> 177.7.221.41:23
Source: Traffic	Snort IDS: 716 INFO TELNET access 41.57.43.2:23 -> 192.168.2.23:52658
Source: Traffic	Snort IDS: 716 INFO TELNET access 177.7.221.41:23 -> 192.168.2.23:59276
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 41.57.43.2:23 -> 192.168.2.23:52658
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 41.57.43.2:23 -> 192.168.2.23:52658
Source: Traffic	Snort IDS: 716 INFO TELNET access 177.7.221.41:23 -> 192.168.2.23:59280
Source: Traffic	Snort IDS: 716 INFO TELNET access 177.7.221.41:23 -> 192.168.2.23:59292
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 178.219.113.60:23 -> 192.168.2.23:41272
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 178.219.113.60:23 -> 192.168.2.23:41272
Source: Traffic	Snort IDS: 716 INFO TELNET access 41.57.43.2:23 -> 192.168.2.23:52684
Source: Traffic	Snort IDS: 716 INFO TELNET access 177.7.221.41:23 -> 192.168.2.23:59346
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 41.57.43.2:23 -> 192.168.2.23:52684
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 41.57.43.2:23 -> 192.168.2.23:52684
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 178.219.113.60:23 -> 192.168.2.23:41390
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 178.219.113.60:23 -> 192.168.2.23:41390
Source: Traffic	Snort IDS: 716 INFO TELNET access 41.57.43.2:23 -> 192.168.2.23:52836
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 223.8.49.214:23 -> 192.168.2.23:34430
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 41.57.43.2:23 -> 192.168.2.23:52836
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 41.57.43.2:23 -> 192.168.2.23:52836
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 178.219.113.60:23 -> 192.168.2.23:41482
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 178.219.113.60:23 -> 192.168.2.23:41482
Source: Traffic	Snort IDS: 716 INFO TELNET access 41.57.43.2:23 -> 192.168.2.23:52978
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.75.91.70:23 -> 192.168.2.23:44108
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 41.57.43.2:23 -> 192.168.2.23:52978
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 41.57.43.2:23 -> 192.168.2.23:52978
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 178.219.113.60:23 -> 192.168.2.23:41600
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 178.219.113.60:23 -> 192.168.2.23:41600
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.75.91.70:23 -> 192.168.2.23:44198
Source: Traffic	Snort IDS: 716 INFO TELNET access 41.57.43.2:23 -> 192.168.2.23:53088
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 178.219.113.60:23 -> 192.168.2.23:41692
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 178.219.113.60:23 -> 192.168.2.23:41692
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 41.57.43.2:23 -> 192.168.2.23:53088
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 41.57.43.2:23 -> 192.168.2.23:53088
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.75.91.70:23 -> 192.168.2.23:44220
Source: Traffic	Snort IDS: 716 INFO TELNET access 41.57.43.2:23 -> 192.168.2.23:53138
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 178.219.113.60:23 -> 192.168.2.23:41734
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 178.219.113.60:23 -> 192.168.2.23:41734
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 41.57.43.2:23 -> 192.168.2.23:53138
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 41.57.43.2:23 -> 192.168.2.23:53138
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.75.91.70:23 -> 192.168.2.23:44296
Source: Traffic	Snort IDS: 404 ICMP Destination Unreachable Protocol Unreachable 190.111.231.121: -> 192.168.2.23:
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 178.219.113.60:23 -> 192.168.2.23:41778
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 178.219.113.60:23 -> 192.168.2.23:41778
Source: Traffic	Snort IDS: 716 INFO TELNET access 41.57.43.2:23 -> 192.168.2.23:53190
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 93.49.107.156:23 -> 192.168.2.23:43966
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 93.49.107.156:23 -> 192.168.2.23:43966
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 41.57.43.2:23 -> 192.168.2.23:53190
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 41.57.43.2:23 -> 192.168.2.23:53190
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.75.91.70:23 -> 192.168.2.23:44352
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 178.219.113.60:23 -> 192.168.2.23:41830
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 178.219.113.60:23 -> 192.168.2.23:41830
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 93.49.107.156:23 -> 192.168.2.23:44020
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 93.49.107.156:23 -> 192.168.2.23:44020
Source: Traffic	Snort IDS: 716 INFO TELNET access 41.57.43.2:23 -> 192.168.2.23:53284
Source: Traffic	Snort IDS: 2023448 ET TROJAN Possible Linux.Mirai Login Attempt (ubnt) 192.168.2.23:41898 -> 178.219.113.60:23
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 41.57.43.2:23 -> 192.168.2.23:53284
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 41.57.43.2:23 -> 192.168.2.23:53284
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.75.91.70:23 -> 192.168.2.23:44426
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 178.219.113.60:23 -> 192.168.2.23:41898
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 178.219.113.60:23 -> 192.168.2.23:41898
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 120.198.210.199:23 -> 192.168.2.23:50898
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 93.49.107.156:23 -> 192.168.2.23:44100
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 93.49.107.156:23 -> 192.168.2.23:44100
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 178.219.113.60:23 -> 192.168.2.23:41944
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 178.219.113.60:23 -> 192.168.2.23:41944
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 93.49.107.156:23 -> 192.168.2.23:44132
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 93.49.107.156:23 -> 192.168.2.23:44132
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.75.91.70:23 -> 192.168.2.23:44482
Source: Traffic	Snort IDS: 716 INFO TELNET access 27.35.231.182:23 -> 192.168.2.23:34932
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 221.2.193.110:23 -> 192.168.2.23:54124
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 27.35.231.182:23 -> 192.168.2.23:34932
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 27.35.231.182:23 -> 192.168.2.23:34932
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 93.49.107.156:23 -> 192.168.2.23:44180
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 93.49.107.156:23 -> 192.168.2.23:44180
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 221.2.193.110:23 -> 192.168.2.23:54182
Source: Traffic	Snort IDS: 716 INFO TELNET access 27.35.231.182:23 -> 192.168.2.23:35018
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.75.91.70:23 -> 192.168.2.23:44568
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 93.49.107.156:23 -> 192.168.2.23:44236
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 93.49.107.156:23 -> 192.168.2.23:44236
Source: Traffic	Snort IDS: 716 INFO TELNET access 41.181.140.130:23 -> 192.168.2.23:57582
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 27.35.231.182:23 -> 192.168.2.23:35018
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 27.35.231.182:23 -> 192.168.2.23:35018
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.75.91.70:23 -> 192.168.2.23:44616
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 221.2.193.110:23 -> 192.168.2.23:54230
Source: Traffic	Snort IDS: 716 INFO TELNET access 201.20.102.53:23 -> 192.168.2.23:46814
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 93.49.107.156:23 -> 192.168.2.23:44284
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 93.49.107.156:23 -> 192.168.2.23:44284
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 201.20.102.53:23 -> 192.168.2.23:46814
Source: Traffic	Snort IDS: 716 INFO TELNET access 27.35.231.182:23 -> 192.168.2.23:35082
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 221.2.193.110:23 -> 192.168.2.23:54248
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 218.75.91.70:23 -> 192.168.2.23:44642
Source: Traffic	Snort IDS: 716 INFO TELNET access 201.20.102.53:23 -> 192.168.2.23:46832
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 201.20.102.53:23 -> 192.168.2.23:46832
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 93.49.107.156:23 -> 192.168.2.23:44308
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 93.49.107.156:23 -> 192.168.2.23:44308
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 27.35.231.182:23 -> 192.168.2.23:35082
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 27.35.231.182:23 -> 192.168.2.23:35082
Source: Traffic	Snort IDS: 716 INFO TELNET access 201.20.102.53:23 -> 192.168.2.23:46876
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 221.2.193.110:23 -> 192.168.2.23:54306
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 201.20.102.53:23 -> 192.168.2.23:46876
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.115.194.129:23 -> 192.168.2.23:57130
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 93.49.107.156:23 -> 192.168.2.23:44362
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 93.49.107.156:23 -> 192.168.2.23:44362
Source: Traffic	Snort IDS: 716 INFO TELNET access 183.236.171.20:23 -> 192.168.2.23:55824
Source: Traffic	Snort IDS: 716 INFO TELNET access 201.20.102.53:23 -> 192.168.2.23:46982
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.115.194.129:23 -> 192.168.2.23:57130
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 201.20.102.53:23 -> 192.168.2.23:46982
Source: Traffic	Snort IDS: 716 INFO TELNET access 27.35.231.182:23 -> 192.168.2.23:35228
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 183.236.171.20:23 -> 192.168.2.23:55824
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 183.236.171.20:23 -> 192.168.2.23:55824
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.115.194.129:23 -> 192.168.2.23:57252
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 221.2.193.110:23 -> 192.168.2.23:54484
Source: Traffic	Snort IDS: 716 INFO TELNET access 201.20.102.53:23 -> 192.168.2.23:47096
Source: Traffic	Snort IDS: 716 INFO TELNET access 210.165.140.156:23 -> 192.168.2.23:42788
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 93.49.107.156:23 -> 192.168.2.23:44536
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 93.49.107.156:23 -> 192.168.2.23:44536
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.115.194.129:23 -> 192.168.2.23:57252
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 201.20.102.53:23 -> 192.168.2.23:47096
Source: Traffic	Snort IDS: 716 INFO TELNET access 106.240.171.6:23 -> 192.168.2.23:56382
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.112.121.182:23 -> 192.168.2.23:44974
Source: Traffic	Snort IDS: 716 INFO TELNET access 183.236.171.20:23 -> 192.168.2.23:56072
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.115.194.129:23 -> 192.168.2.23:57416
Source: Traffic	Snort IDS: 716 INFO TELNET access 201.20.102.53:23 -> 192.168.2.23:47240
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 27.35.231.182:23 -> 192.168.2.23:35228
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 27.35.231.182:23 -> 192.168.2.23:35228
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 201.20.102.53:23 -> 192.168.2.23:47240
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.115.194.129:23 -> 192.168.2.23:57416
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 183.236.171.20:23 -> 192.168.2.23:56072
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 183.236.171.20:23 -> 192.168.2.23:56072
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.14.56.69:23 -> 192.168.2.23:57868
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 221.2.193.110:23 -> 192.168.2.23:54710
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.115.194.129:23 -> 192.168.2.23:57480
Source: Traffic	Snort IDS: 716 INFO TELNET access 201.20.102.53:23 -> 192.168.2.23:47298
Source: Traffic	Snort IDS: 716 INFO TELNET access 23.91.241.26:23 -> 192.168.2.23:38630
Source: Traffic	Snort IDS: 716 INFO TELNET access 211.160.177.2:23 -> 192.168.2.23:44084
Source: Traffic	Snort IDS: 716 INFO TELNET access 27.35.231.182:23 -> 192.168.2.23:35580
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.14.56.69:23 -> 192.168.2.23:57874
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 201.20.102.53:23 -> 192.168.2.23:47298
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 23.91.241.26:23 -> 192.168.2.23:38630
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.115.194.129:23 -> 192.168.2.23:57480
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.14.56.69:23 -> 192.168.2.23:57948
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 211.160.177.2:23 -> 192.168.2.23:44084
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.14.56.69:23 -> 192.168.2.23:57962
Source: Traffic	Snort IDS: 716 INFO TELNET access 111.163.72.218:23 -> 192.168.2.23:34104
Source: Traffic	Snort IDS: 716 INFO TELNET access 183.236.171.20:23 -> 192.168.2.23:56238
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.14.56.69:23 -> 192.168.2.23:58000
Source: Traffic	Snort IDS: 716 INFO TELNET access 23.91.241.26:23 -> 192.168.2.23:38750
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.115.194.129:23 -> 192.168.2.23:57612
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 27.35.231.182:23 -> 192.168.2.23:35580
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 27.35.231.182:23 -> 192.168.2.23:35580
Source: Traffic	Snort IDS: 716 INFO TELNET access 201.20.102.53:23 -> 192.168.2.23:47428
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.14.56.69:23 -> 192.168.2.23:58024
Source: Traffic	Snort IDS: 716 INFO TELNET access 211.160.177.2:23 -> 192.168.2.23:44208
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 221.2.193.110:23 -> 192.168.2.23:54860
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 23.91.241.26:23 -> 192.168.2.23:38750
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.14.56.69:23 -> 192.168.2.23:58040
Source: Traffic	Snort IDS: 716 INFO TELNET access 111.163.72.218:23 -> 192.168.2.23:34178
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 183.236.171.20:23 -> 192.168.2.23:56238
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 183.236.171.20:23 -> 192.168.2.23:56238
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 201.20.102.53:23 -> 192.168.2.23:47428
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.14.56.69:23 -> 192.168.2.23:58048
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 189.115.194.129:23 -> 192.168.2.23:57612
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 211.160.177.2:23 -> 192.168.2.23:44208
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.14.56.69:23 -> 192.168.2.23:58062
Source: Traffic	Snort IDS: 716 INFO TELNET access 23.91.241.26:23 -> 192.168.2.23:38816
Source: Traffic	Snort IDS: 716 INFO TELNET access 60.14.56.69:23 -> 192.168.2.23:58078
Source: Traffic	Snort IDS: 716 INFO TELNET access 189.115.194.129:23 -> 192.168.2.23:57712
Source: Traffic	Snort IDS: 716 INFO TELNET access 201.20.102.53:23 -> 192.168.2.23:47524
Source: Traffic	Snort IDS: 716 INFO TELNET access 211.160.177.2:23 -> 192.168.2.23:44294
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 23.91.241.26:23 -> 192.168.2.23:38816

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41240
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41248
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41258
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41278
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41288
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41306
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41330
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41334
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41338
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41340

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:39274 -> 34.249.145.219:443

Source: global traffic

TCP traffic: 192.168.2.23:51422 -> 136.144.41.15:1312

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39274 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 136.144.41.15
Source: unknown	TCP traffic detected without corresponding DNS query: 86.114.208.209
Source: unknown	TCP traffic detected without corresponding DNS query: 243.174.106.35
Source: unknown	TCP traffic detected without corresponding DNS query: 67.49.248.210
Source: unknown	TCP traffic detected without corresponding DNS query: 16.114.55.95
Source: unknown	TCP traffic detected without corresponding DNS query: 197.22.95.112
Source: unknown	TCP traffic detected without corresponding DNS query: 35.102.24.95
Source: unknown	TCP traffic detected without corresponding DNS query: 126.36.123.32
Source: unknown	TCP traffic detected without corresponding DNS query: 116.151.253.46
Source: unknown	TCP traffic detected without corresponding DNS query: 194.173.176.105
Source: unknown	TCP traffic detected without corresponding DNS query: 130.193.17.243
Source: unknown	TCP traffic detected without corresponding DNS query: 103.222.112.39
Source: unknown	TCP traffic detected without corresponding DNS query: 181.22.75.4
Source: unknown	TCP traffic detected without corresponding DNS query: 124.97.161.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.108.62.151
Source: unknown	TCP traffic detected without corresponding DNS query: 168.109.209.2
Source: unknown	TCP traffic detected without corresponding DNS query: 75.119.233.6
Source: unknown	TCP traffic detected without corresponding DNS query: 82.61.135.125
Source: unknown	TCP traffic detected without corresponding DNS query: 147.228.81.150
Source: unknown	TCP traffic detected without corresponding DNS query: 193.130.162.15
Source: unknown	TCP traffic detected without corresponding DNS query: 151.221.106.243
Source: unknown	TCP traffic detected without corresponding DNS query: 13.95.76.153
Source: unknown	TCP traffic detected without corresponding DNS query: 243.232.160.119
Source: unknown	TCP traffic detected without corresponding DNS query: 202.25.239.217
Source: unknown	TCP traffic detected without corresponding DNS query: 63.242.170.205
Source: unknown	TCP traffic detected without corresponding DNS query: 58.17.227.90
Source: unknown	TCP traffic detected without corresponding DNS query: 251.104.219.53
Source: unknown	TCP traffic detected without corresponding DNS query: 255.21.84.13
Source: unknown	TCP traffic detected without corresponding DNS query: 9.97.192.97
Source: unknown	TCP traffic detected without corresponding DNS query: 63.127.95.221
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.239.87
Source: unknown	TCP traffic detected without corresponding DNS query: 194.50.7.65
Source: unknown	TCP traffic detected without corresponding DNS query: 172.155.57.146
Source: unknown	TCP traffic detected without corresponding DNS query: 92.232.14.56
Source: unknown	TCP traffic detected without corresponding DNS query: 119.167.39.218
Source: unknown	TCP traffic detected without corresponding DNS query: 200.237.13.70
Source: unknown	TCP traffic detected without corresponding DNS query: 17.135.153.56
Source: unknown	TCP traffic detected without corresponding DNS query: 155.245.80.45
Source: unknown	TCP traffic detected without corresponding DNS query: 170.170.202.40
Source: unknown	TCP traffic detected without corresponding DNS query: 133.95.172.234
Source: unknown	TCP traffic detected without corresponding DNS query: 75.48.59.107
Source: unknown	TCP traffic detected without corresponding DNS query: 73.39.38.124
Source: unknown	TCP traffic detected without corresponding DNS query: 255.1.109.214
Source: unknown	TCP traffic detected without corresponding DNS query: 123.46.224.16
Source: unknown	TCP traffic detected without corresponding DNS query: 78.140.215.45
Source: unknown	TCP traffic detected without corresponding DNS query: 4.77.72.12
Source: unknown	TCP traffic detected without corresponding DNS query: 23.138.112.226
Source: unknown	TCP traffic detected without corresponding DNS query: 41.66.188.103
Source: unknown	TCP traffic detected without corresponding DNS query: 221.206.147.174
Source: unknown	TCP traffic detected without corresponding DNS query: 61.141.254.232

Source: fVA3Q44QAK

String found in binary or memory: http://upx.sf.net

Source: LOAD without section mappings

Program segment: 0xc01000

Source: /tmp/fVA3Q44QAK (PID: 5219)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/fVA3Q44QAK (PID: 5222)	SIGKILL sent: pid: 936, result: successful

Source: classification engine

Classification label: mal72.troj.evad.lin@0/0@0/0

Data Obfuscation:

Sample is packed with UPX

Show sources

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/5222/exe
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/491/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/793/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/772/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/796/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/774/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/797/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/777/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/799/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/658/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/912/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/759/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/936/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/918/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/1/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/761/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/785/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/884/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/720/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/721/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/788/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/789/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/800/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/801/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/847/fd
Source: /tmp/fVA3Q44QAK (PID: 5222)	File opened: /proc/904/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/491/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/793/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/772/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/796/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/774/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/797/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/777/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/799/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/658/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/912/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/759/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/936/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/5219/exe
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/918/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/1/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/761/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/785/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/884/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/720/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/721/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/788/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/789/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/800/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/801/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/847/fd
Source: /tmp/fVA3Q44QAK (PID: 5219)	File opened: /proc/904/fd

Source: /usr/bin/dash (PID: 5264)

Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.FZJy5QRkED /tmp/tmp.Cx4p8ienxO /tmp/tmp.ayYQw5P6KC

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41240
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41248
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41258
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41278
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41288
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41306
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41330
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41334
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41338
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41340

Stealing of Sensitive Information:

Yara detected Mirai

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality:

Yara detected Mirai

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Obfuscated Files or Information1	OS Credential Dumping1	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	File Deletion1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
fVA3Q44QAK	37%	Virustotal		Browse
fVA3Q44QAK	51%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	fVA3Q44QAK	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
118.211.239.132	unknown	Australia	4739	INTERNODE-ASInternodePtyLtdAU	false
210.106.38.203	unknown	Korea Republic of	17839	DREAMPLUS-AS-KRLGHelloVisionCorpKR	false
242.236.222.254	unknown	Reserved	unknown	unknown	false
119.222.246.123	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
118.251.164.218	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
61.125.29.174	unknown	Japan	9595	XEPHIONNTT-MECorporationJP	false
197.89.97.58	unknown	South Africa	10474	OPTINETZA	false
145.151.15.79	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
213.46.86.255	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
147.125.210.77	unknown	Austria	2488	IIASA-NETInternationalInstituteforAppliedSystemsAnalys	false
32.249.33.88	unknown	United States	2686	ATGS-MMD-ASUS	false
74.136.69.5	unknown	United States	10796	TWC-10796-MIDWESTUS	false
248.169.175.87	unknown	Reserved	unknown	unknown	false
27.197.55.18	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
213.52.109.228	unknown	Norway	2116	ASN-CATCHCOMNO	false
156.34.23.163	unknown	Canada	855	CANET-ASN-4CA	false
122.4.122.86	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
66.3.241.117	unknown	United States	2828	XO-AS15US	false
112.252.196.33	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
156.49.160.15	unknown	Sweden	29975	VODACOM-ZA	false
89.113.117.183	unknown	Russian Federation	44699	STROITELNAYA_INNOVACIARU	false
87.196.249.120	unknown	Portugal	2860	NOS_COMUNICACOESPT	false
192.84.228.183	unknown	Hungary	1741	FUNETASFI	false
32.220.131.221	unknown	United States	46690	SNET-FCCUS	false
1.255.173.186	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
4.164.140.27	unknown	United States	3356	LEVEL3US	false
36.17.156.115	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
153.15.14.52	unknown	Norway	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
151.208.73.143	unknown	United States	11003	PANDGUS	false
61.191.66.240	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
42.66.128.89	unknown	Taiwan; Republic of China (ROC)	17421	EMOME-NETMobileBusinessGroupTW	false
206.32.17.122	unknown	United States	3356	LEVEL3US	false
113.82.60.114	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
48.5.47.35	unknown	United States	2686	ATGS-MMD-ASUS	false
122.131.61.127	unknown	Japan	2518	BIGLOBEBIGLOBEIncJP	false
196.142.51.78	unknown	Egypt	36935	Vodafone-EG	false
118.143.163.141	unknown	Hong Kong	9304	HUTCHISON-AS-APHGCGlobalCommunicationsLimitedHK	false
45.167.218.35	unknown	Brazil	268009	BELINFONETSERVICOSDECOMUNICACAOEMULTIMIDIAEBR	false
85.208.2.15	unknown	Finland	209378	INIOS-ASFI	false
150.210.115.42	unknown	United States	31822	CITY-UNIVERSITY-OF-NEW-YORKUS	false
80.107.7.150	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
253.91.52.203	unknown	Reserved	unknown	unknown	false
168.151.75.250	unknown	United States	204472	ROYALEASNDE	false
142.22.118.16	unknown	Canada	3633	PROVINCE-OF-BRITISH-COLUMBIACA	false
5.24.72.65	unknown	Turkey	16135	TURKCELL-ASTurkcellASTR	false
88.16.182.184	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
194.12.251.222	unknown	Bulgaria	8262	EVOLINK-ASBG	false
99.13.97.229	unknown	United States	7018	ATT-INTERNET4US	false
246.175.96.4	unknown	Reserved	unknown	unknown	false
147.75.13.99	unknown	Switzerland	35914	ARMOR-DEFENSEUS	false
191.30.36.92	unknown	Brazil	18881	TELEFONICABRASILSABR	false
65.144.152.0	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
155.200.239.157	unknown	United States	8698	NationwideBuildingSocietyGB	false
247.249.240.163	unknown	Reserved	unknown	unknown	false
167.181.16.213	unknown	United States	62481	SUNTRUST-BANKUS	false
14.116.97.246	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
14.255.164.60	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
153.85.227.119	unknown	United States	14962	NCR-252US	false
241.197.46.115	unknown	Reserved	unknown	unknown	false
253.193.91.235	unknown	Reserved	unknown	unknown	false
208.27.147.39	unknown	United States	36837	ASN-TELETRACUS	false
81.137.109.241	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
37.195.118.225	unknown	Russian Federation	31200	NTKIPv6customersRU	false
181.24.7.243	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
181.21.8.118	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
108.132.57.207	unknown	United States	16509	AMAZON-02US	false
149.131.43.106	unknown	United States	33022	WELLESLEY-COLLEGEUS	false
67.29.230.68	unknown	United States	202818	LEVEL3COMMUNICATIONSFR	false
96.178.243.163	unknown	United States	7922	COMCAST-7922US	false
250.124.165.154	unknown	Reserved	unknown	unknown	false
107.204.213.78	unknown	United States	7018	ATT-INTERNET4US	false
158.178.211.100	unknown	United Kingdom	15830	EQUINIX-CONNECT-EMEAGB	false
216.4.87.55	unknown	United States	2828	XO-AS15US	false
18.243.215.229	unknown	United States	16509	AMAZON-02US	false
12.239.5.98	unknown	United States	7018	ATT-INTERNET4US	false
194.216.31.188	unknown	United Kingdom	702	UUNETUS	false
116.96.79.11	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
74.192.181.152	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	false
2.149.14.35	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
105.120.247.64	unknown	Nigeria	36873	VNL1-ASNG	false
194.64.149.47	unknown	Germany	4589	EASYNETEasynetGlobalServicesEU	false
146.88.159.180	unknown	Malaysia	133847	ICT-AS-APAnppleTechEnterpriseMY	false
4.143.53.39	unknown	United States	3356	LEVEL3US	false
167.212.83.51	unknown	United States	33166	BFS-49-33166US	false
208.78.192.218	unknown	United States	11763	IBX-CHICAGOUS	false
85.219.218.240	unknown	Poland	205738	MARMITEPL	false
177.56.151.219	unknown	Brazil	22085	ClaroSABR	false
102.228.74.21	unknown	unknown	36926	CKL1-ASNKE	false
81.102.118.139	unknown	United Kingdom	5089	NTLGB	false
197.252.128.132	unknown	Sudan	15706	SudatelSD	false
60.186.225.153	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
184.7.217.32	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
169.132.160.131	unknown	United States	7270	NET2PHONEUS	false
42.164.86.69	unknown	China	4249	LILLY-ASUS	false
63.57.227.252	unknown	United States	701	UUNETUS	false
196.240.143.25	unknown	Seychelles	37518	FIBERGRIDSC	false
124.66.201.250	unknown	Japan	18281	TAC-NETTokonameNew-TVCorporationJP	false
205.221.42.4	unknown	United States	6122	ICN-ASUS	false
126.54.223.48	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
57.166.240.145	unknown	Belgium	2686	ATGS-MMD-ASUS	false

Runtime Messages

Command:	/tmp/fVA3Q44QAK
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped
Entropy (8bit):	7.87055577615585
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	fVA3Q44QAK
File size:	24728
MD5:	cd6521521289846e8001d5f05cf0e10d
SHA1:	ecb03ba794a579a02ad8e0ef94b29ebed527a155
SHA256:	00a6f460395d2f545eba81ead528fcf2883582412affb7b052e7fef3478361c0
SHA512:	f454f474a2de88b0923adf988d07d94c0e352b444bfb94fbadc0a0cf842faef5daa1e9c651274c24c979e12f369ce138e6cb48d38eb133093704f06f79b3b320
SSDEEP:	768:i/QOC0Yhn6RODyF94cwNEFCnNBml1YHtfzbcN:i/nihnuFHwTNBuktcN
File Content Preview:	.ELF.....................g..4...........4. ...(......................_..._...................W...W..................Q.td...............................tUPX!....................Z........?d..ELF.......d.......4.,..4. (.......k.-.#.`...........?..P......d..l

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc067a0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x5f9b	0x5f9b	4.5585	0x5	R E	0x1000
LOAD	0x700	0x8055700	0x8055700	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2022 01:02:31.614181042 CET	51422	1312	192.168.2.23	136.144.41.15
Jan 15, 2022 01:02:31.614451885 CET	3886	23	192.168.2.23	86.114.208.209
Jan 15, 2022 01:02:31.614471912 CET	3886	23	192.168.2.23	243.174.106.35
Jan 15, 2022 01:02:31.614500999 CET	3886	23	192.168.2.23	67.49.248.210
Jan 15, 2022 01:02:31.614500999 CET	3886	23	192.168.2.23	16.114.55.95
Jan 15, 2022 01:02:31.614516973 CET	3886	23	192.168.2.23	197.22.95.112
Jan 15, 2022 01:02:31.614518881 CET	3886	23	192.168.2.23	35.102.24.95
Jan 15, 2022 01:02:31.614538908 CET	3886	23	192.168.2.23	126.36.123.32
Jan 15, 2022 01:02:31.614545107 CET	3886	23	192.168.2.23	116.151.253.46
Jan 15, 2022 01:02:31.614547014 CET	3886	23	192.168.2.23	194.173.176.105
Jan 15, 2022 01:02:31.614561081 CET	3886	23	192.168.2.23	130.193.17.243
Jan 15, 2022 01:02:31.614569902 CET	3886	23	192.168.2.23	103.222.112.39
Jan 15, 2022 01:02:31.614573956 CET	3886	23	192.168.2.23	181.22.75.4
Jan 15, 2022 01:02:31.614577055 CET	3886	23	192.168.2.23	124.97.161.209
Jan 15, 2022 01:02:31.614588022 CET	3886	23	192.168.2.23	39.108.62.151
Jan 15, 2022 01:02:31.614588976 CET	3886	23	192.168.2.23	168.109.209.2
Jan 15, 2022 01:02:31.614593983 CET	3886	23	192.168.2.23	75.119.233.6
Jan 15, 2022 01:02:31.614597082 CET	3886	23	192.168.2.23	82.61.135.125
Jan 15, 2022 01:02:31.614597082 CET	3886	23	192.168.2.23	147.228.81.150
Jan 15, 2022 01:02:31.614610910 CET	3886	23	192.168.2.23	193.130.162.15
Jan 15, 2022 01:02:31.614614964 CET	3886	23	192.168.2.23	151.221.106.243
Jan 15, 2022 01:02:31.614620924 CET	3886	23	192.168.2.23	13.95.76.153
Jan 15, 2022 01:02:31.614625931 CET	3886	23	192.168.2.23	243.232.160.119
Jan 15, 2022 01:02:31.614631891 CET	3886	23	192.168.2.23	202.25.239.217
Jan 15, 2022 01:02:31.614634037 CET	3886	23	192.168.2.23	63.242.170.205
Jan 15, 2022 01:02:31.614638090 CET	3886	23	192.168.2.23	58.17.227.90
Jan 15, 2022 01:02:31.614645958 CET	3886	23	192.168.2.23	251.104.219.53
Jan 15, 2022 01:02:31.614648104 CET	3886	23	192.168.2.23	255.21.84.13
Jan 15, 2022 01:02:31.614655018 CET	3886	23	192.168.2.23	9.97.192.97
Jan 15, 2022 01:02:31.614655972 CET	3886	23	192.168.2.23	63.127.95.221
Jan 15, 2022 01:02:31.614661932 CET	3886	23	192.168.2.23	128.31.239.87
Jan 15, 2022 01:02:31.614665985 CET	3886	23	192.168.2.23	194.50.7.65
Jan 15, 2022 01:02:31.614671946 CET	3886	23	192.168.2.23	172.155.57.146
Jan 15, 2022 01:02:31.614677906 CET	3886	23	192.168.2.23	92.232.14.56
Jan 15, 2022 01:02:31.614684105 CET	3886	23	192.168.2.23	119.167.39.218
Jan 15, 2022 01:02:31.614686012 CET	3886	23	192.168.2.23	200.237.13.70
Jan 15, 2022 01:02:31.614691019 CET	3886	23	192.168.2.23	17.135.153.56
Jan 15, 2022 01:02:31.614694118 CET	3886	23	192.168.2.23	155.245.80.45
Jan 15, 2022 01:02:31.614695072 CET	3886	23	192.168.2.23	170.170.202.40
Jan 15, 2022 01:02:31.614700079 CET	3886	23	192.168.2.23	133.95.172.234
Jan 15, 2022 01:02:31.614701033 CET	3886	23	192.168.2.23	75.48.59.107
Jan 15, 2022 01:02:31.614703894 CET	3886	23	192.168.2.23	73.39.38.124
Jan 15, 2022 01:02:31.614706039 CET	3886	23	192.168.2.23	255.1.109.214
Jan 15, 2022 01:02:31.614716053 CET	3886	23	192.168.2.23	123.46.224.16
Jan 15, 2022 01:02:31.614720106 CET	3886	23	192.168.2.23	78.140.215.45
Jan 15, 2022 01:02:31.614725113 CET	3886	23	192.168.2.23	4.77.72.12
Jan 15, 2022 01:02:31.614727974 CET	3886	23	192.168.2.23	23.138.112.226
Jan 15, 2022 01:02:31.614731073 CET	3886	23	192.168.2.23	41.66.188.103
Jan 15, 2022 01:02:31.614739895 CET	3886	23	192.168.2.23	221.206.147.174
Jan 15, 2022 01:02:31.614748955 CET	3886	23	192.168.2.23	61.141.254.232
Jan 15, 2022 01:02:31.614756107 CET	3886	23	192.168.2.23	46.101.166.218
Jan 15, 2022 01:02:31.614783049 CET	3886	23	192.168.2.23	38.82.173.166
Jan 15, 2022 01:02:31.614784002 CET	3886	23	192.168.2.23	122.122.193.47
Jan 15, 2022 01:02:31.614789963 CET	3886	23	192.168.2.23	242.191.110.178
Jan 15, 2022 01:02:31.614793062 CET	3886	23	192.168.2.23	252.191.214.230
Jan 15, 2022 01:02:31.614793062 CET	3886	23	192.168.2.23	140.204.52.216
Jan 15, 2022 01:02:31.614797115 CET	3886	23	192.168.2.23	200.191.224.30
Jan 15, 2022 01:02:31.614804029 CET	3886	23	192.168.2.23	124.55.3.157
Jan 15, 2022 01:02:31.614809990 CET	3886	23	192.168.2.23	59.1.125.73
Jan 15, 2022 01:02:31.614810944 CET	3886	23	192.168.2.23	65.214.254.122
Jan 15, 2022 01:02:31.614816904 CET	3886	23	192.168.2.23	62.97.196.178
Jan 15, 2022 01:02:31.614820004 CET	3886	23	192.168.2.23	40.54.255.228
Jan 15, 2022 01:02:31.614824057 CET	3886	23	192.168.2.23	115.150.231.122
Jan 15, 2022 01:02:31.614828110 CET	3886	23	192.168.2.23	240.195.202.231
Jan 15, 2022 01:02:31.614834070 CET	3886	23	192.168.2.23	153.225.24.76
Jan 15, 2022 01:02:31.614835978 CET	3886	23	192.168.2.23	45.117.143.148
Jan 15, 2022 01:02:31.614845037 CET	3886	23	192.168.2.23	241.147.130.230
Jan 15, 2022 01:02:31.614845037 CET	3886	23	192.168.2.23	162.98.145.166
Jan 15, 2022 01:02:31.614846945 CET	3886	23	192.168.2.23	252.167.52.152
Jan 15, 2022 01:02:31.614854097 CET	3886	23	192.168.2.23	71.181.30.186
Jan 15, 2022 01:02:31.614855051 CET	3886	23	192.168.2.23	72.246.122.69
Jan 15, 2022 01:02:31.614856005 CET	3886	23	192.168.2.23	208.211.148.36
Jan 15, 2022 01:02:31.614857912 CET	3886	23	192.168.2.23	221.12.70.220
Jan 15, 2022 01:02:31.614860058 CET	3886	23	192.168.2.23	107.235.46.82
Jan 15, 2022 01:02:31.614865065 CET	3886	23	192.168.2.23	176.54.248.33
Jan 15, 2022 01:02:31.614866972 CET	3886	23	192.168.2.23	114.126.194.251
Jan 15, 2022 01:02:31.614871025 CET	3886	23	192.168.2.23	73.162.137.30
Jan 15, 2022 01:02:31.614872932 CET	3886	23	192.168.2.23	254.215.86.99
Jan 15, 2022 01:02:31.614880085 CET	3886	23	192.168.2.23	45.128.62.54
Jan 15, 2022 01:02:31.614882946 CET	3886	23	192.168.2.23	248.226.16.59
Jan 15, 2022 01:02:31.614891052 CET	3886	23	192.168.2.23	118.244.241.111
Jan 15, 2022 01:02:31.614898920 CET	3886	23	192.168.2.23	45.199.69.23
Jan 15, 2022 01:02:31.614906073 CET	3886	23	192.168.2.23	210.216.123.136
Jan 15, 2022 01:02:31.614919901 CET	3886	23	192.168.2.23	62.3.105.70
Jan 15, 2022 01:02:31.614928007 CET	3886	23	192.168.2.23	157.198.63.148
Jan 15, 2022 01:02:31.614948034 CET	3886	23	192.168.2.23	136.38.178.119
Jan 15, 2022 01:02:31.614948034 CET	3886	23	192.168.2.23	163.152.122.232
Jan 15, 2022 01:02:31.614950895 CET	3886	23	192.168.2.23	163.237.145.2
Jan 15, 2022 01:02:31.614950895 CET	3886	23	192.168.2.23	99.33.196.187
Jan 15, 2022 01:02:31.614953041 CET	3886	23	192.168.2.23	64.2.140.102
Jan 15, 2022 01:02:31.614953995 CET	3886	23	192.168.2.23	243.40.35.127
Jan 15, 2022 01:02:31.614953995 CET	3886	23	192.168.2.23	83.155.147.35
Jan 15, 2022 01:02:31.614955902 CET	3886	23	192.168.2.23	78.82.182.101
Jan 15, 2022 01:02:31.614959955 CET	3886	23	192.168.2.23	27.125.45.221
Jan 15, 2022 01:02:31.614963055 CET	3886	23	192.168.2.23	156.218.110.212
Jan 15, 2022 01:02:31.614964962 CET	3886	23	192.168.2.23	159.109.7.188
Jan 15, 2022 01:02:31.614967108 CET	3886	23	192.168.2.23	189.187.102.212
Jan 15, 2022 01:02:31.614965916 CET	3886	23	192.168.2.23	209.131.252.31
Jan 15, 2022 01:02:31.614969015 CET	3886	23	192.168.2.23	44.250.64.94
Jan 15, 2022 01:02:31.614974976 CET	3886	23	192.168.2.23	59.170.249.49

System Behavior

Analysis Process: fVA3Q44QAK PID: 5218 Parent PID: 5108

General

Start time:	01:02:31
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	/tmp/fVA3Q44QAK
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5219 Parent PID: 5218

General

Start time:	01:02:31
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5326 Parent PID: 5219

General

Start time:	01:05:21
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5328 Parent PID: 5219

General

Start time:	01:05:21
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5329 Parent PID: 5328

General

Start time:	01:05:21
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5335 Parent PID: 5329

General

Start time:	01:05:26
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5336 Parent PID: 5329

General

Start time:	01:05:26
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5330 Parent PID: 5328

General

Start time:	01:05:21
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5331 Parent PID: 5328

General

Start time:	01:05:21
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5220 Parent PID: 5218

General

Start time:	01:02:31
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5221 Parent PID: 5218

General

Start time:	01:02:31
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5222 Parent PID: 5221

General

Start time:	01:02:31
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5325 Parent PID: 5222

General

Start time:	01:05:21
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5327 Parent PID: 5222

General

Start time:	01:05:21
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5223 Parent PID: 5221

General

Start time:	01:02:31
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: fVA3Q44QAK PID: 5224 Parent PID: 5221

General

Start time:	01:02:31
Start date:	15/01/2022
Path:	/tmp/fVA3Q44QAK
Arguments:	n/a
File size:	24728 bytes
MD5 hash:	cd6521521289846e8001d5f05cf0e10d

Analysis Process: dash PID: 5264 Parent PID: 4331

General

Start time:	01:03:56
Start date:	15/01/2022
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: rm PID: 5264 Parent PID: 4331

General

Start time:	01:03:56
Start date:	15/01/2022
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.FZJy5QRkED /tmp/tmp.Cx4p8ienxO /tmp/tmp.ayYQw5P6KC
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Linux Analysis Report fVA3Q44QAK

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Process Tree

Yara Overview

PCAP (Network Traffic)

Jbx Signature Overview

AV Detection:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Runtime Messages

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: fVA3Q44QAK PID: 5218 Parent PID: 5108

General

Analysis Process: fVA3Q44QAK PID: 5219 Parent PID: 5218

General

Analysis Process: fVA3Q44QAK PID: 5326 Parent PID: 5219

General

Analysis Process: fVA3Q44QAK PID: 5328 Parent PID: 5219

General

Analysis Process: fVA3Q44QAK PID: 5329 Parent PID: 5328

General

Analysis Process: fVA3Q44QAK PID: 5335 Parent PID: 5329

General

Analysis Process: fVA3Q44QAK PID: 5336 Parent PID: 5329

General

Analysis Process: fVA3Q44QAK PID: 5330 Parent PID: 5328

General

Analysis Process: fVA3Q44QAK PID: 5331 Parent PID: 5328

General

Analysis Process: fVA3Q44QAK PID: 5220 Parent PID: 5218

General

Analysis Process: fVA3Q44QAK PID: 5221 Parent PID: 5218

General

Analysis Process: fVA3Q44QAK PID: 5222 Parent PID: 5221