Edit tour

Linux Analysis Report
uuC6SqiHEK

Overview

General Information

Sample Name:	uuC6SqiHEK
Analysis ID:	626460
MD5:	772945ce381f38c38472a94893995e6f
SHA1:	62c42fe68280e67aa016afa49f844da73a1d2df1
SHA256:	cfcdff7a98c3829650988decae442e8daaf67cb471d13048ad0d578d8c5f63cf
Tags:	32elfmipsmirai
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Uses known network protocols on non-standard ports

Sample contains only a LOAD segment without any section mappings

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626460
Start date and time: 14/05/202203:44:04	2022-05-14 03:44:04 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	uuC6SqiHEK
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal64.troj.evad.lin@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/uuC6SqiHEK
PID:	6223
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

uuC6SqiHEK (PID: 6223, Parent: 6122, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/uuC6SqiHEK

uuC6SqiHEK New Fork (PID: 6225, Parent: 6223)

uuC6SqiHEK New Fork (PID: 6326, Parent: 6225)

uuC6SqiHEK New Fork (PID: 6328, Parent: 6225)

uuC6SqiHEK New Fork (PID: 6330, Parent: 6328)

uuC6SqiHEK New Fork (PID: 6343, Parent: 6330)

uuC6SqiHEK New Fork (PID: 6345, Parent: 6330)

uuC6SqiHEK New Fork (PID: 6332, Parent: 6328)

uuC6SqiHEK New Fork (PID: 6333, Parent: 6328)

uuC6SqiHEK New Fork (PID: 6226, Parent: 6223)

uuC6SqiHEK New Fork (PID: 6227, Parent: 6223)

uuC6SqiHEK New Fork (PID: 6231, Parent: 6227)

uuC6SqiHEK New Fork (PID: 6337, Parent: 6231)

uuC6SqiHEK New Fork (PID: 6339, Parent: 6231)

uuC6SqiHEK New Fork (PID: 6233, Parent: 6227)

uuC6SqiHEK New Fork (PID: 6234, Parent: 6227)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: uuC6SqiHEK

Virustotal: Detection: 42%

Perma Link

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32898
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32900
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32904
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32906
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32910
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32912
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32914
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32916
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32920
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32922

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:60988 -> 107.172.197.117:1312

Source: /tmp/uuC6SqiHEK (PID: 6225)	Socket: 0.0.0.0::0	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	Socket: 0.0.0.0::23	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	Socket: 0.0.0.0::53413	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	Socket: 0.0.0.0::80	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	Socket: 0.0.0.0::52869	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	Socket: 0.0.0.0::37215	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	Socket: 0.0.0.0::0	Jump to behavior

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.197.117
Source: unknown	TCP traffic detected without corresponding DNS query: 81.164.18.153
Source: unknown	TCP traffic detected without corresponding DNS query: 81.190.24.117
Source: unknown	TCP traffic detected without corresponding DNS query: 176.255.189.66
Source: unknown	TCP traffic detected without corresponding DNS query: 169.60.0.176
Source: unknown	TCP traffic detected without corresponding DNS query: 158.41.69.167
Source: unknown	TCP traffic detected without corresponding DNS query: 201.168.217.66
Source: unknown	TCP traffic detected without corresponding DNS query: 149.187.54.80
Source: unknown	TCP traffic detected without corresponding DNS query: 186.229.17.36
Source: unknown	TCP traffic detected without corresponding DNS query: 156.122.41.224
Source: unknown	TCP traffic detected without corresponding DNS query: 162.43.188.92
Source: unknown	TCP traffic detected without corresponding DNS query: 80.219.143.79
Source: unknown	TCP traffic detected without corresponding DNS query: 73.215.253.205
Source: unknown	TCP traffic detected without corresponding DNS query: 177.247.14.87
Source: unknown	TCP traffic detected without corresponding DNS query: 170.218.61.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.229.196.150
Source: unknown	TCP traffic detected without corresponding DNS query: 160.98.192.57
Source: unknown	TCP traffic detected without corresponding DNS query: 73.77.195.60
Source: unknown	TCP traffic detected without corresponding DNS query: 199.95.0.73
Source: unknown	TCP traffic detected without corresponding DNS query: 19.142.189.170
Source: unknown	TCP traffic detected without corresponding DNS query: 178.248.85.9
Source: unknown	TCP traffic detected without corresponding DNS query: 254.184.255.182
Source: unknown	TCP traffic detected without corresponding DNS query: 93.22.122.203
Source: unknown	TCP traffic detected without corresponding DNS query: 178.34.193.211
Source: unknown	TCP traffic detected without corresponding DNS query: 135.200.206.144
Source: unknown	TCP traffic detected without corresponding DNS query: 114.223.243.18
Source: unknown	TCP traffic detected without corresponding DNS query: 164.189.145.57
Source: unknown	TCP traffic detected without corresponding DNS query: 220.108.224.202
Source: unknown	TCP traffic detected without corresponding DNS query: 167.206.70.100
Source: unknown	TCP traffic detected without corresponding DNS query: 93.7.20.188
Source: unknown	TCP traffic detected without corresponding DNS query: 141.156.199.81
Source: unknown	TCP traffic detected without corresponding DNS query: 23.61.30.224
Source: unknown	TCP traffic detected without corresponding DNS query: 186.241.155.185
Source: unknown	TCP traffic detected without corresponding DNS query: 223.30.162.238
Source: unknown	TCP traffic detected without corresponding DNS query: 251.194.244.233
Source: unknown	TCP traffic detected without corresponding DNS query: 253.171.246.232
Source: unknown	TCP traffic detected without corresponding DNS query: 35.50.253.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.130.38.27
Source: unknown	TCP traffic detected without corresponding DNS query: 146.193.251.221
Source: unknown	TCP traffic detected without corresponding DNS query: 199.100.229.31
Source: unknown	TCP traffic detected without corresponding DNS query: 253.77.247.140
Source: unknown	TCP traffic detected without corresponding DNS query: 68.103.221.205
Source: unknown	TCP traffic detected without corresponding DNS query: 213.182.0.235
Source: unknown	TCP traffic detected without corresponding DNS query: 77.175.88.85
Source: unknown	TCP traffic detected without corresponding DNS query: 123.30.15.218
Source: unknown	TCP traffic detected without corresponding DNS query: 40.61.201.120
Source: unknown	TCP traffic detected without corresponding DNS query: 60.220.22.152
Source: unknown	TCP traffic detected without corresponding DNS query: 19.32.126.236

Source: uuC6SqiHEK

String found in binary or memory: http://upx.sf.net

Source: LOAD without section mappings

Program segment: 0x100000

Source: /tmp/uuC6SqiHEK (PID: 6225)	SIGKILL sent: pid: 936, result: successful			Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	SIGKILL sent: pid: 936, result: successful			Jump to behavior

Source: classification engine

Classification label: mal64.troj.evad.lin@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/793/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/796/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/797/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/799/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/785/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/720/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/721/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/788/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/789/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/847/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6231)	File opened: /proc/904/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/793/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/796/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/797/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/799/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/785/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/720/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/721/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/788/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/789/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/847/fd	Jump to behavior
Source: /tmp/uuC6SqiHEK (PID: 6225)	File opened: /proc/904/fd	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32898
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32900
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32904
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32906
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32910
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32912
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32914
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32916
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32920
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 32922

Source: /tmp/uuC6SqiHEK (PID: 6223)

Queries kernel information via 'uname':

Jump to behavior

Source: uuC6SqiHEK, 6223.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6225.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6326.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6343.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6332.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6226.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6337.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6233.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: uuC6SqiHEK, 6223.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6225.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6326.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6343.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6332.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6226.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6337.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6233.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp	Binary or memory string: #Zx86_64/usr/bin/qemu-mipsel/tmp/uuC6SqiHEKSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/uuC6SqiHEK
Source: uuC6SqiHEK, 6223.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6225.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6326.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6343.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6332.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6226.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6337.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp, uuC6SqiHEK, 6233.1.00000000dd7321fd.00000000cd8ca4c8.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: uuC6SqiHEK, 6223.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6225.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6326.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6343.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6332.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6226.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6337.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp, uuC6SqiHEK, 6233.1.00000000d7e36c8e.00000000ca13ce42.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
uuC6SqiHEK	43%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	uuC6SqiHEK	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
106.74.102.98	unknown	China	133118	UNICOM-CNChinaUnicomIPnetworkCN	false
16.145.233.90	unknown	United States	unknown	unknown	false
103.48.197.179	unknown	India	133982	EXCITEL-AS-INExcitelBroadbandPrivateLimitedIN	false
94.65.166.89	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
4.85.99.192	unknown	United States	3356	LEVEL3US	false
244.229.95.159	unknown	Reserved	unknown	unknown	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report uuC6SqiHEK

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

PCAP (Network Traffic)

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Linux Analysis Report
uuC6SqiHEK