Edit tour

Linux Analysis Report
peYe24ayqp

Overview

General Information

Sample Name:	peYe24ayqp
Analysis ID:	626461
MD5:	9bfc4e323b0925534fea18588b776a79
SHA1:	9a6e06578d0f9ebfc65c39c513b4c6ee9015a6b0
SHA256:	1e85e1f64e03c60ea0cdf08ef7227e6153fad2810dff6a58a0c49da88fce3c9b
Tags:	32elfmipsmirai
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Uses known network protocols on non-standard ports

Sample contains only a LOAD segment without any section mappings

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626461
Start date and time: 14/05/202203:49:31	2022-05-14 03:49:31 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 40s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	peYe24ayqp
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal64.troj.evad.lin@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100

Runtime Messages

Command:	/tmp/peYe24ayqp
PID:	6228
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

peYe24ayqp (PID: 6228, Parent: 6125, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/peYe24ayqp

peYe24ayqp New Fork (PID: 6230, Parent: 6228)

peYe24ayqp New Fork (PID: 6326, Parent: 6230)

peYe24ayqp New Fork (PID: 6329, Parent: 6230)

peYe24ayqp New Fork (PID: 6334, Parent: 6329)

peYe24ayqp New Fork (PID: 6344, Parent: 6334)

peYe24ayqp New Fork (PID: 6345, Parent: 6334)

peYe24ayqp New Fork (PID: 6336, Parent: 6329)

peYe24ayqp New Fork (PID: 6338, Parent: 6329)

peYe24ayqp New Fork (PID: 6231, Parent: 6228)

peYe24ayqp New Fork (PID: 6232, Parent: 6228)

peYe24ayqp New Fork (PID: 6236, Parent: 6232)

peYe24ayqp New Fork (PID: 6327, Parent: 6236)

peYe24ayqp New Fork (PID: 6331, Parent: 6236)

peYe24ayqp New Fork (PID: 6238, Parent: 6232)

peYe24ayqp New Fork (PID: 6239, Parent: 6232)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: peYe24ayqp

Virustotal: Detection: 39%

Perma Link

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37648
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37654
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37660
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37662
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37664
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37666
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37670
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37672
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37678
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37680
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37480
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37496
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37510
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37516
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37524
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37534
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37542
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37560
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37618
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37644

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:60988 -> 107.172.197.117:1312

Source: /tmp/peYe24ayqp (PID: 6230)	Socket: 0.0.0.0::0
Source: /tmp/peYe24ayqp (PID: 6230)	Socket: 0.0.0.0::23
Source: /tmp/peYe24ayqp (PID: 6230)	Socket: 0.0.0.0::53413
Source: /tmp/peYe24ayqp (PID: 6230)	Socket: 0.0.0.0::80
Source: /tmp/peYe24ayqp (PID: 6230)	Socket: 0.0.0.0::52869
Source: /tmp/peYe24ayqp (PID: 6230)	Socket: 0.0.0.0::37215
Source: /tmp/peYe24ayqp (PID: 6236)	Socket: 0.0.0.0::0

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.197.117
Source: unknown	TCP traffic detected without corresponding DNS query: 102.107.118.157
Source: unknown	TCP traffic detected without corresponding DNS query: 223.244.51.45
Source: unknown	TCP traffic detected without corresponding DNS query: 180.190.143.75
Source: unknown	TCP traffic detected without corresponding DNS query: 32.51.237.157
Source: unknown	TCP traffic detected without corresponding DNS query: 74.81.62.205
Source: unknown	TCP traffic detected without corresponding DNS query: 182.236.84.253
Source: unknown	TCP traffic detected without corresponding DNS query: 251.196.131.93
Source: unknown	TCP traffic detected without corresponding DNS query: 113.62.205.134
Source: unknown	TCP traffic detected without corresponding DNS query: 65.61.105.48
Source: unknown	TCP traffic detected without corresponding DNS query: 89.20.39.97
Source: unknown	TCP traffic detected without corresponding DNS query: 59.13.162.104
Source: unknown	TCP traffic detected without corresponding DNS query: 42.165.196.24
Source: unknown	TCP traffic detected without corresponding DNS query: 41.106.182.17
Source: unknown	TCP traffic detected without corresponding DNS query: 165.86.37.217
Source: unknown	TCP traffic detected without corresponding DNS query: 203.20.140.68
Source: unknown	TCP traffic detected without corresponding DNS query: 243.131.121.67
Source: unknown	TCP traffic detected without corresponding DNS query: 80.28.47.160
Source: unknown	TCP traffic detected without corresponding DNS query: 249.254.163.117
Source: unknown	TCP traffic detected without corresponding DNS query: 12.142.250.113
Source: unknown	TCP traffic detected without corresponding DNS query: 35.117.75.7
Source: unknown	TCP traffic detected without corresponding DNS query: 16.39.203.168
Source: unknown	TCP traffic detected without corresponding DNS query: 77.221.202.71
Source: unknown	TCP traffic detected without corresponding DNS query: 126.71.140.176
Source: unknown	TCP traffic detected without corresponding DNS query: 73.3.63.49
Source: unknown	TCP traffic detected without corresponding DNS query: 103.19.84.15
Source: unknown	TCP traffic detected without corresponding DNS query: 184.138.5.127
Source: unknown	TCP traffic detected without corresponding DNS query: 149.239.122.147
Source: unknown	TCP traffic detected without corresponding DNS query: 72.253.75.249
Source: unknown	TCP traffic detected without corresponding DNS query: 246.21.12.17
Source: unknown	TCP traffic detected without corresponding DNS query: 62.88.142.52
Source: unknown	TCP traffic detected without corresponding DNS query: 250.6.251.242
Source: unknown	TCP traffic detected without corresponding DNS query: 138.220.204.61
Source: unknown	TCP traffic detected without corresponding DNS query: 168.190.2.78
Source: unknown	TCP traffic detected without corresponding DNS query: 187.165.17.140
Source: unknown	TCP traffic detected without corresponding DNS query: 38.161.174.176
Source: unknown	TCP traffic detected without corresponding DNS query: 142.113.78.26
Source: unknown	TCP traffic detected without corresponding DNS query: 149.73.61.93
Source: unknown	TCP traffic detected without corresponding DNS query: 180.186.166.215
Source: unknown	TCP traffic detected without corresponding DNS query: 169.61.111.91
Source: unknown	TCP traffic detected without corresponding DNS query: 187.217.147.1
Source: unknown	TCP traffic detected without corresponding DNS query: 120.22.9.83
Source: unknown	TCP traffic detected without corresponding DNS query: 108.189.250.24
Source: unknown	TCP traffic detected without corresponding DNS query: 166.84.139.24
Source: unknown	TCP traffic detected without corresponding DNS query: 83.196.76.168
Source: unknown	TCP traffic detected without corresponding DNS query: 111.227.241.33
Source: unknown	TCP traffic detected without corresponding DNS query: 189.140.229.240
Source: unknown	TCP traffic detected without corresponding DNS query: 125.120.45.197
Source: unknown	TCP traffic detected without corresponding DNS query: 175.94.38.106
Source: unknown	TCP traffic detected without corresponding DNS query: 251.37.61.193

Source: peYe24ayqp

String found in binary or memory: http://upx.sf.net

Source: LOAD without section mappings

Program segment: 0x100000

Source: /tmp/peYe24ayqp (PID: 6230)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/peYe24ayqp (PID: 6236)	SIGKILL sent: pid: 936, result: successful

Source: classification engine

Classification label: mal64.troj.evad.lin@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/491/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/793/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/772/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/796/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/774/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/797/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/777/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/799/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/658/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/912/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/759/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/936/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/918/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/1/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/761/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/785/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/884/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/720/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/721/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/788/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/789/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/800/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/801/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/847/fd
Source: /tmp/peYe24ayqp (PID: 6230)	File opened: /proc/904/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/491/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/793/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/772/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/796/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/774/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/797/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/777/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/799/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/658/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/912/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/759/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/936/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/918/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/1/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/761/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/785/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/884/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/720/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/721/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/788/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/789/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/800/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/801/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/847/fd
Source: /tmp/peYe24ayqp (PID: 6236)	File opened: /proc/904/fd

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37648
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37654
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37660
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37662
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37664
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37666
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37670
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37672
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37678
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37680
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37480
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37496
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37510
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37516
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37524
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37534
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37542
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37560
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37618
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 37644

Source: /tmp/peYe24ayqp (PID: 6228)

Queries kernel information via 'uname':

Source: peYe24ayqp, 6228.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6230.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6326.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6344.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6336.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6231.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6327.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6238.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/peYe24ayqpSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/peYe24ayqp
Source: peYe24ayqp, 6228.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6230.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6326.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6344.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6336.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6231.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6327.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6238.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mips
Source: peYe24ayqp, 6228.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6230.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6326.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6344.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6336.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6231.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6327.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp, peYe24ayqp, 6238.1.00000000d1aa28eb.0000000094e88a65.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: peYe24ayqp, 6228.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6230.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6326.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6344.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6336.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6231.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6327.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp, peYe24ayqp, 6238.1.00000000d1404dbe.00000000a76905e6.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
peYe24ayqp	39%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	peYe24ayqp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
14.29.123.26	unknown	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false
68.146.32.212	unknown	Canada	6327	SHAWCA	false
102.55.12.135	unknown	Morocco	6713	IAM-ASMA	false
119.135.93.16	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
4.126.218.135	unknown	United States	3356	LEVEL3US	false
161.29.58.110	unknown	New Zealand	9790	VOCUSGROUPNZVocusGroupNZ	false
190.41.237.126	unknown	Peru	6147	TelefonicadelPeruSAAPE	false
157.199.114.232	unknown	United States	3356	LEVEL3US	false
133.84.240.180	unknown	Japan	55904	KOGAKUIN-ASKOGAKUINUniversityJP	false
32.129.235.55	unknown	United States	2686	ATGS-MMD-ASUS	false
24.210.193.128	unknown	United States	10796	TWC-10796-MIDWESTUS	false
177.35.57.101	unknown	Brazil	28573	CLAROSABR	false
253.161.145.216	unknown	Reserved	unknown	unknown	false
58.208.50.191	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
160.27.251.134	unknown	Japan	9371	SAKURA-CSAKURAInternetIncJP	false
14.222.189.102	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
240.152.191.178	unknown	Reserved	unknown	unknown	false
60.181.164.23	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
42.116.150.25	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	false
95.229.249.242	unknown	Italy	3269	ASN-IBSNAZIT	false
68.232.101.62	unknown	United States	21570	ACI-1CA	false
252.212.204.102	unknown	Reserved	unknown	unknown	false
240.245.1.2	unknown	Reserved	unknown	unknown	false
161.93.54.151	unknown	Japan	14298	EPA-NETUS	false
46.56.82.245	unknown	Belarus	25106	MTSBY-ASBY	false
41.215.59.21	unknown	Kenya	15808	ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE	false
59.84.94.186	unknown	Japan	10010	TOKAITOKAICommunicationsCorporationJP	false
207.123.91.124	unknown	United States	3356	LEVEL3US	false
45.2.242.94	unknown	Canada	7311	FRONTIERCA	false
78.166.82.213	unknown	Turkey	9121	TTNETTR	false
187.218.161.255	unknown	Mexico	8151	UninetSAdeCVMX	false
12.175.157.173	unknown	United States	7018	ATT-INTERNET4US	false
194.175.56.102	unknown	Germany	702	UUNETUS	false
43.110.126.185	unknown	Japan	4249	LILLY-ASUS	false
74.205.21.243	unknown	United States	27357	RACKSPACEUS	false
113.155.242.51	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
39.205.48.21	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
93.143.119.222	unknown	Croatia (LOCAL Name: Hrvatska)	5391	T-HTCroatianTelecomIncHR	false
14.49.183.189	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
105.108.43.204	unknown	Algeria	36947	ALGTEL-ASDZ	false
32.66.61.204	unknown	United States	2686	ATGS-MMD-ASUS	false
81.223.241.91	unknown	Austria	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
142.124.141.1	unknown	Canada	577	BACOMCA	false
169.209.98.56	unknown	Korea Republic of	37611	AfrihostZA	false
209.101.91.219	unknown	United States	4565	MEGAPATH2-US	false
210.212.47.131	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
86.55.160.151	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
210.212.47.132	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
89.45.44.194	unknown	Romania	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
156.146.203.249	unknown	United States	1448	UNITED-BROADBANDUS	false
35.21.235.111	unknown	United States	36375	UMICH-AS-5US	false
62.215.172.89	unknown	Kuwait	21050	FAST-TELCOKW	false
110.42.146.95	unknown	China	136188	CHINATELECOM-ZHEJIANG-NINGBO-IDCNINGBOZHEJIANGProvince	false
252.12.195.243	unknown	Reserved	unknown	unknown	false
78.88.244.98	unknown	Poland	29314	VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL	false
213.13.73.149	unknown	Portugal	3243	MEO-RESIDENCIALPT	false
39.29.179.34	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
37.165.124.192	unknown	France	51207	FREEMFR	false
69.174.188.24	unknown	United States	54373	MESSAGEEXPRESSINTERNETUS	false
107.232.142.23	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
172.141.183.80	unknown	United States	7018	ATT-INTERNET4US	false
89.62.186.148	unknown	Germany	5430	FREENETDEfreenetDatenkommunikationsGmbHDE	false
108.228.181.104	unknown	United States	7018	ATT-INTERNET4US	false
254.126.128.144	unknown	Reserved	unknown	unknown	false
31.193.145.83	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
100.167.204.98	unknown	United States	21928	T-MOBILE-AS21928US	false
121.65.193.191	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
203.23.189.104	unknown	unknown	17914	MULTIBASETECH-AS-APMultibaseTechnologiesPtyLtdAU	false
142.121.109.61	unknown	Canada	577	BACOMCA	false
182.251.40.205	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
249.7.138.185	unknown	Reserved	unknown	unknown	false
58.44.27.66	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
102.40.44.183	unknown	Egypt	8452	TE-ASTE-ASEG	false
165.170.160.55	unknown	United States	5647	ASN-KODAKUS	false
196.177.152.107	unknown	Tunisia	37693	TUNISIANATN	false
187.206.32.243	unknown	Mexico	8151	UninetSAdeCVMX	false
172.255.161.128	unknown	United States	395954	LEASEWEB-USA-LAX-11US	false
31.215.25.216	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
189.218.211.162	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	false
196.17.109.119	unknown	Seychelles	9009	M247GB	false
74.66.112.106	unknown	United States	12271	TWC-12271-NYCUS	false
195.176.251.214	unknown	Switzerland	559	SWITCHPeeringrequestspeeringswitchchEU	false
98.60.86.32	unknown	United States	7922	COMCAST-7922US	false
121.44.190.55	unknown	Australia	4739	INTERNODE-ASInternodePtyLtdAU	false
202.218.0.120	unknown	Japan	4694	IDCFIDCFrontierIncJP	false
117.58.42.55	unknown	China	4782	GSNETDataCommunicationBusinessGroupTW	false
117.69.181.50	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
109.93.37.75	unknown	Serbia	8400	TELEKOM-ASRS	false
83.54.6.155	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
147.195.9.104	unknown	United States	15128	COMWAVE-BGP-01CA	false
8.90.239.74	unknown	United States	3356	LEVEL3US	false
153.158.25.137	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
71.19.80.21	unknown	Canada	14366	MNTNCA	false
92.184.7.87	unknown	France	12479	UNI2-ASES	false
85.136.26.187	unknown	Spain	12357	COMUNITELSPAINES	false
35.149.133.149	unknown	United States	394141	ROCKET-FIBERUS	false
18.81.216.181	unknown	United States	3	MIT-GATEWAYSUS	false
68.219.64.2	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
61.242.114.67	unknown	China	17622	CNCGROUP-GZChinaUnicomGuangzhounetworkCN	false
104.94.61.209	unknown	United States	16625	AKAMAI-ASUS	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	7.871636882566792
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	peYe24ayqp
File size:	26184
MD5:	9bfc4e323b0925534fea18588b776a79
SHA1:	9a6e06578d0f9ebfc65c39c513b4c6ee9015a6b0
SHA256:	1e85e1f64e03c60ea0cdf08ef7227e6153fad2810dff6a58a0c49da88fce3c9b
SHA512:	90e59d30018fafdad426a28fd1cd8e9c8453b34753b8d93233910171c7b8ecdaeec215f60e1b305a414447ef4e86f60ee55b55e7ad13400f62c74c596f2f9d45
SSDEEP:	768:I2G214DFyosXqgvV9o1ndB08FJgGlzDpbuR1JK:I2GdDgosaaO1ndVVJu8
TLSH:	B6C2D088274919E9C2F9C13843B81B6919B40FAAF80ADC8578F8F7529D8E4753057ED9
File Content Preview:	.ELF......................Q....4.........4. ...(......................e...e..................E...E......................UPX!.h.........T...T.......T.......?.E.h4...@b..) ..]....E...GS.U....e5.T3z".J{..m...\|0.L.!Q.....j...]......Yt.//..@...,..N............

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x1051d8
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	2
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
LOAD	0x0	0x100000	0x100000	0x651c	0x651c	4.1678	0x5	R E	0x10000
LOAD	0x18c0	0x4518c0	0x4518c0	0x0	0x0	0.0000	0x6	RW	0x10000

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 14, 2022 03:50:17.375596046 CEST	60988	1312	192.168.2.23	107.172.197.117
May 14, 2022 03:50:17.387319088 CEST	44569	23	192.168.2.23	102.107.118.157
May 14, 2022 03:50:17.387471914 CEST	44569	23	192.168.2.23	223.244.51.45
May 14, 2022 03:50:17.387479067 CEST	44569	23	192.168.2.23	251.185.110.228
May 14, 2022 03:50:17.387486935 CEST	44569	23	192.168.2.23	180.190.143.75
May 14, 2022 03:50:17.387501001 CEST	44569	23	192.168.2.23	32.51.237.157
May 14, 2022 03:50:17.387506008 CEST	44569	23	192.168.2.23	74.81.62.205
May 14, 2022 03:50:17.387521029 CEST	44569	23	192.168.2.23	182.236.84.253
May 14, 2022 03:50:17.387525082 CEST	44569	23	192.168.2.23	251.196.131.93
May 14, 2022 03:50:17.387526989 CEST	44569	23	192.168.2.23	113.62.205.134
May 14, 2022 03:50:17.387530088 CEST	44569	23	192.168.2.23	65.61.105.48
May 14, 2022 03:50:17.387550116 CEST	44569	23	192.168.2.23	89.20.39.97
May 14, 2022 03:50:17.387557030 CEST	44569	23	192.168.2.23	59.13.162.104
May 14, 2022 03:50:17.387567043 CEST	44569	23	192.168.2.23	42.165.196.24
May 14, 2022 03:50:17.387573004 CEST	44569	23	192.168.2.23	41.106.182.17
May 14, 2022 03:50:17.387599945 CEST	44569	23	192.168.2.23	165.86.37.217
May 14, 2022 03:50:17.387602091 CEST	44569	23	192.168.2.23	203.20.140.68
May 14, 2022 03:50:17.387605906 CEST	44569	23	192.168.2.23	210.132.200.29
May 14, 2022 03:50:17.387605906 CEST	44569	23	192.168.2.23	243.131.121.67
May 14, 2022 03:50:17.387615919 CEST	44569	23	192.168.2.23	80.28.47.160
May 14, 2022 03:50:17.387629986 CEST	44569	23	192.168.2.23	249.254.163.117
May 14, 2022 03:50:17.387636900 CEST	44569	23	192.168.2.23	12.142.250.113
May 14, 2022 03:50:17.387675047 CEST	44569	23	192.168.2.23	35.117.75.7
May 14, 2022 03:50:17.387842894 CEST	44569	23	192.168.2.23	16.39.203.168
May 14, 2022 03:50:17.387844086 CEST	44569	23	192.168.2.23	77.221.202.71
May 14, 2022 03:50:17.387849092 CEST	44569	23	192.168.2.23	126.71.140.176
May 14, 2022 03:50:17.387850046 CEST	44569	23	192.168.2.23	73.3.63.49
May 14, 2022 03:50:17.387851000 CEST	44569	23	192.168.2.23	103.19.84.15
May 14, 2022 03:50:17.387856960 CEST	44569	23	192.168.2.23	184.138.5.127
May 14, 2022 03:50:17.387860060 CEST	44569	23	192.168.2.23	149.239.122.147
May 14, 2022 03:50:17.387867928 CEST	44569	23	192.168.2.23	72.253.75.249
May 14, 2022 03:50:17.387871027 CEST	44569	23	192.168.2.23	246.21.12.17
May 14, 2022 03:50:17.387875080 CEST	44569	23	192.168.2.23	62.88.142.52
May 14, 2022 03:50:17.387876034 CEST	44569	23	192.168.2.23	250.6.251.242
May 14, 2022 03:50:17.387881041 CEST	44569	23	192.168.2.23	138.220.204.61
May 14, 2022 03:50:17.387888908 CEST	44569	23	192.168.2.23	168.190.2.78
May 14, 2022 03:50:17.387890100 CEST	44569	23	192.168.2.23	187.165.17.140
May 14, 2022 03:50:17.387898922 CEST	44569	23	192.168.2.23	38.161.174.176
May 14, 2022 03:50:17.387900114 CEST	44569	23	192.168.2.23	142.113.78.26
May 14, 2022 03:50:17.387901068 CEST	44569	23	192.168.2.23	149.73.61.93
May 14, 2022 03:50:17.387902975 CEST	44569	23	192.168.2.23	180.186.166.215
May 14, 2022 03:50:17.387912035 CEST	44569	23	192.168.2.23	169.61.111.91
May 14, 2022 03:50:17.387921095 CEST	44569	23	192.168.2.23	187.217.147.1
May 14, 2022 03:50:17.387926102 CEST	44569	23	192.168.2.23	120.22.9.83
May 14, 2022 03:50:17.387933969 CEST	44569	23	192.168.2.23	108.189.250.24
May 14, 2022 03:50:17.387938023 CEST	44569	23	192.168.2.23	166.84.139.24
May 14, 2022 03:50:17.387940884 CEST	44569	23	192.168.2.23	83.196.76.168
May 14, 2022 03:50:17.387948990 CEST	44569	23	192.168.2.23	111.227.241.33
May 14, 2022 03:50:17.387957096 CEST	44569	23	192.168.2.23	189.140.229.240
May 14, 2022 03:50:17.387960911 CEST	44569	23	192.168.2.23	125.120.45.197
May 14, 2022 03:50:17.387962103 CEST	44569	23	192.168.2.23	175.94.38.106
May 14, 2022 03:50:17.387965918 CEST	44569	23	192.168.2.23	251.37.61.193
May 14, 2022 03:50:17.387969017 CEST	44569	23	192.168.2.23	34.94.159.63
May 14, 2022 03:50:17.387969971 CEST	44569	23	192.168.2.23	173.138.87.37
May 14, 2022 03:50:17.387972116 CEST	44569	23	192.168.2.23	191.230.175.186
May 14, 2022 03:50:17.387981892 CEST	44569	23	192.168.2.23	153.244.182.34
May 14, 2022 03:50:17.387985945 CEST	44569	23	192.168.2.23	45.173.217.162
May 14, 2022 03:50:17.387993097 CEST	44569	23	192.168.2.23	153.89.136.128
May 14, 2022 03:50:17.387995958 CEST	44569	23	192.168.2.23	241.19.230.108
May 14, 2022 03:50:17.388000011 CEST	44569	23	192.168.2.23	72.39.134.99
May 14, 2022 03:50:17.388180971 CEST	44569	23	192.168.2.23	253.25.182.132
May 14, 2022 03:50:17.388180971 CEST	44569	23	192.168.2.23	59.27.168.190
May 14, 2022 03:50:17.388190031 CEST	44569	23	192.168.2.23	120.111.132.45
May 14, 2022 03:50:17.388190031 CEST	44569	23	192.168.2.23	108.94.143.116
May 14, 2022 03:50:17.388205051 CEST	44569	23	192.168.2.23	207.149.190.114
May 14, 2022 03:50:17.388209105 CEST	44569	23	192.168.2.23	61.37.203.179
May 14, 2022 03:50:17.388215065 CEST	44569	23	192.168.2.23	171.9.34.86
May 14, 2022 03:50:17.388219118 CEST	44569	23	192.168.2.23	88.61.99.185
May 14, 2022 03:50:17.388219118 CEST	44569	23	192.168.2.23	93.93.61.129
May 14, 2022 03:50:17.388220072 CEST	44569	23	192.168.2.23	84.202.152.140
May 14, 2022 03:50:17.388225079 CEST	44569	23	192.168.2.23	98.133.133.210
May 14, 2022 03:50:17.388231039 CEST	44569	23	192.168.2.23	246.238.56.149
May 14, 2022 03:50:17.388233900 CEST	44569	23	192.168.2.23	253.235.166.90
May 14, 2022 03:50:17.388241053 CEST	44569	23	192.168.2.23	157.207.26.116
May 14, 2022 03:50:17.388246059 CEST	44569	23	192.168.2.23	102.96.59.14
May 14, 2022 03:50:17.388246059 CEST	44569	23	192.168.2.23	183.208.67.107
May 14, 2022 03:50:17.388247967 CEST	44569	23	192.168.2.23	212.125.147.229
May 14, 2022 03:50:17.388251066 CEST	44569	23	192.168.2.23	17.86.177.160
May 14, 2022 03:50:17.388256073 CEST	44569	23	192.168.2.23	195.29.90.65
May 14, 2022 03:50:17.388264894 CEST	44569	23	192.168.2.23	149.28.133.235
May 14, 2022 03:50:17.388267994 CEST	44569	23	192.168.2.23	35.83.201.235
May 14, 2022 03:50:17.388271093 CEST	44569	23	192.168.2.23	248.36.35.111
May 14, 2022 03:50:17.388273001 CEST	44569	23	192.168.2.23	168.158.216.73
May 14, 2022 03:50:17.388276100 CEST	44569	23	192.168.2.23	177.72.72.253
May 14, 2022 03:50:17.388276100 CEST	44569	23	192.168.2.23	249.98.26.156
May 14, 2022 03:50:17.388279915 CEST	44569	23	192.168.2.23	70.40.222.38
May 14, 2022 03:50:17.388283968 CEST	44569	23	192.168.2.23	170.236.46.167
May 14, 2022 03:50:17.388286114 CEST	44569	23	192.168.2.23	170.83.162.87
May 14, 2022 03:50:17.388288975 CEST	44569	23	192.168.2.23	37.0.130.47
May 14, 2022 03:50:17.388298035 CEST	44569	23	192.168.2.23	1.238.72.187
May 14, 2022 03:50:17.388307095 CEST	44569	23	192.168.2.23	136.127.245.11
May 14, 2022 03:50:17.388314009 CEST	44569	23	192.168.2.23	97.129.35.49
May 14, 2022 03:50:17.388325930 CEST	44569	23	192.168.2.23	152.64.218.118
May 14, 2022 03:50:17.388326883 CEST	44569	23	192.168.2.23	134.237.248.144
May 14, 2022 03:50:17.388341904 CEST	44569	23	192.168.2.23	213.145.40.185
May 14, 2022 03:50:17.388348103 CEST	44569	23	192.168.2.23	100.51.224.207
May 14, 2022 03:50:17.388353109 CEST	44569	23	192.168.2.23	53.110.114.159
May 14, 2022 03:50:17.388356924 CEST	44569	23	192.168.2.23	175.220.7.189
May 14, 2022 03:50:17.388366938 CEST	44569	23	192.168.2.23	47.127.91.240
May 14, 2022 03:50:17.388376951 CEST	44569	23	192.168.2.23	189.104.186.159

System Behavior

Analysis Process: peYe24ayqp PID: 6228, Parent PID: 6125

General

Start time:	03:50:16
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	/tmp/peYe24ayqp
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6230, Parent PID: 6228

General

Start time:	03:50:16
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6326, Parent PID: 6230

General

Start time:	03:53:07
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6329, Parent PID: 6230

General

Start time:	03:53:07
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6334, Parent PID: 6329

General

Start time:	03:53:07
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6344, Parent PID: 6334

General

Start time:	03:53:12
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6345, Parent PID: 6334

General

Start time:	03:53:12
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6336, Parent PID: 6329

General

Start time:	03:53:07
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6338, Parent PID: 6329

General

Start time:	03:53:07
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6231, Parent PID: 6228

General

Start time:	03:50:16
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6232, Parent PID: 6228

General

Start time:	03:50:16
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6236, Parent PID: 6232

General

Start time:	03:50:16
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6327, Parent PID: 6236

General

Start time:	03:53:07
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6331, Parent PID: 6236

General

Start time:	03:53:07
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6238, Parent PID: 6232

General

Start time:	03:50:16
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: peYe24ayqp PID: 6239, Parent PID: 6232

General

Start time:	03:50:16
Start date:	14/05/2022
Path:	/tmp/peYe24ayqp
Arguments:	n/a
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report peYe24ayqp

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

PCAP (Network Traffic)

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: peYe24ayqp PID: 6228, Parent PID: 6125

General

Analysis Process: peYe24ayqp PID: 6230, Parent PID: 6228

General

Analysis Process: peYe24ayqp PID: 6326, Parent PID: 6230

General

Analysis Process: peYe24ayqp PID: 6329, Parent PID: 6230

General

Analysis Process: peYe24ayqp PID: 6334, Parent PID: 6329

General

Analysis Process: peYe24ayqp PID: 6344, Parent PID: 6334

General

Analysis Process: peYe24ayqp PID: 6345, Parent PID: 6334

General

Analysis Process: peYe24ayqp PID: 6336, Parent PID: 6329

General

Analysis Process: peYe24ayqp PID: 6338, Parent PID: 6329

General

Analysis Process: peYe24ayqp PID: 6231, Parent PID: 6228

General

Linux Analysis Report
peYe24ayqp