Linux Analysis Report
gMILf8mqrF

Overview

General Information

Sample Name: gMILf8mqrF
Analysis ID: 626462
MD5: 99c3d6016731dde0f6250297a8b34a0c
SHA1: 04d7db19cff22d044a021cdd2437e1c16d933f27
SHA256: b8e66976f2adb09012e4c737a933d0d88c47da185d5003b7c97df2a5aad3c93d
Tags: 32elfmirairenesas
Infos:

Detection

Mirai
Score: 60
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample tries to kill multiple processes (SIGKILL)
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

AV Detection

barindex
Source: gMILf8mqrF Virustotal: Detection: 54% Perma Link
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:60988 -> 107.172.197.117:1312
Source: /tmp/gMILf8mqrF (PID: 6232) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) Socket: 0.0.0.0::53413 Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) Socket: 0.0.0.0::80 Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) Socket: 0.0.0.0::53413 Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) Socket: 0.0.0.0::80 Jump to behavior
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 107.172.197.117
Source: unknown TCP traffic detected without corresponding DNS query: 213.129.154.49
Source: unknown TCP traffic detected without corresponding DNS query: 216.32.97.63
Source: unknown TCP traffic detected without corresponding DNS query: 133.189.1.49
Source: unknown TCP traffic detected without corresponding DNS query: 177.244.92.136
Source: unknown TCP traffic detected without corresponding DNS query: 182.76.119.167
Source: unknown TCP traffic detected without corresponding DNS query: 150.237.112.224
Source: unknown TCP traffic detected without corresponding DNS query: 121.97.30.182
Source: unknown TCP traffic detected without corresponding DNS query: 12.111.43.198
Source: unknown TCP traffic detected without corresponding DNS query: 41.248.250.130
Source: unknown TCP traffic detected without corresponding DNS query: 18.253.183.27
Source: unknown TCP traffic detected without corresponding DNS query: 39.246.4.58
Source: unknown TCP traffic detected without corresponding DNS query: 251.190.208.151
Source: unknown TCP traffic detected without corresponding DNS query: 206.12.190.247
Source: unknown TCP traffic detected without corresponding DNS query: 220.197.164.9
Source: unknown TCP traffic detected without corresponding DNS query: 170.5.115.245
Source: unknown TCP traffic detected without corresponding DNS query: 120.171.23.24
Source: unknown TCP traffic detected without corresponding DNS query: 98.65.121.73
Source: unknown TCP traffic detected without corresponding DNS query: 206.3.212.70
Source: unknown TCP traffic detected without corresponding DNS query: 163.162.159.38
Source: unknown TCP traffic detected without corresponding DNS query: 135.46.170.2
Source: unknown TCP traffic detected without corresponding DNS query: 72.205.56.179
Source: unknown TCP traffic detected without corresponding DNS query: 17.51.219.140
Source: unknown TCP traffic detected without corresponding DNS query: 161.57.231.34
Source: unknown TCP traffic detected without corresponding DNS query: 81.161.252.61
Source: unknown TCP traffic detected without corresponding DNS query: 101.135.169.159
Source: unknown TCP traffic detected without corresponding DNS query: 201.57.221.109
Source: unknown TCP traffic detected without corresponding DNS query: 253.247.195.111
Source: unknown TCP traffic detected without corresponding DNS query: 146.188.121.222
Source: unknown TCP traffic detected without corresponding DNS query: 178.169.154.103
Source: unknown TCP traffic detected without corresponding DNS query: 141.250.189.52
Source: unknown TCP traffic detected without corresponding DNS query: 163.95.207.89
Source: unknown TCP traffic detected without corresponding DNS query: 82.127.98.89
Source: unknown TCP traffic detected without corresponding DNS query: 117.229.130.151
Source: unknown TCP traffic detected without corresponding DNS query: 121.34.81.173
Source: unknown TCP traffic detected without corresponding DNS query: 203.58.137.169
Source: unknown TCP traffic detected without corresponding DNS query: 116.224.119.116
Source: unknown TCP traffic detected without corresponding DNS query: 174.232.112.218
Source: unknown TCP traffic detected without corresponding DNS query: 18.1.223.36
Source: unknown TCP traffic detected without corresponding DNS query: 181.219.238.195
Source: unknown TCP traffic detected without corresponding DNS query: 216.83.77.238
Source: unknown TCP traffic detected without corresponding DNS query: 61.206.101.69
Source: unknown TCP traffic detected without corresponding DNS query: 66.139.13.92
Source: unknown TCP traffic detected without corresponding DNS query: 165.37.167.98
Source: unknown TCP traffic detected without corresponding DNS query: 70.191.73.229
Source: unknown TCP traffic detected without corresponding DNS query: 97.115.61.119
Source: unknown TCP traffic detected without corresponding DNS query: 31.116.247.118
Source: unknown TCP traffic detected without corresponding DNS query: 243.133.231.121
Source: unknown TCP traffic detected without corresponding DNS query: 182.245.91.15

System Summary

barindex
Source: /tmp/gMILf8mqrF (PID: 6232) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 847, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 1860, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2097, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2180, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2208, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2275, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2281, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2285, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2289, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2294, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 6232, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 6240, result: successful Jump to behavior
Source: ELF static info symbol of initial sample .symtab present: no
Source: /tmp/gMILf8mqrF (PID: 6232) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 720, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 759, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 788, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 800, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 847, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 884, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 1334, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 1335, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 1860, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 1872, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2096, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2097, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2102, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2180, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2208, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2275, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2281, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2285, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2289, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 2294, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 6232, result: successful Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) SIGKILL sent: pid: 6240, result: successful Jump to behavior
Source: classification engine Classification label: mal60.spre.troj.lin@0/0@0/0
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/491/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/793/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/772/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/796/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/774/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/797/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/777/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/799/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/658/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/912/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/759/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/936/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/918/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/1/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/761/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/785/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/884/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/720/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/721/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/788/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/789/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/800/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/801/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/847/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6232) File opened: /proc/904/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/6232/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/6112/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/2275/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/3088/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/6195/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/6194/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/2302/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/3236/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/2146/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/910/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/912/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/912/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/912/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/759/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/759/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/759/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/517/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/2307/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/918/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/918/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/918/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/6240/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/6245/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/2285/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/2281/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/761/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/761/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/761/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/884/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/884/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/884/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1860/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/2156/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/800/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/800/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/800/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/801/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/801/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/801/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1629/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1627/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/3021/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/491/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/491/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/491/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/2294/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/2050/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/772/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/772/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/772/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1633/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/1632/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/774/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/774/exe Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6238) File opened: /proc/774/fd Jump to behavior
Source: /tmp/gMILf8mqrF (PID: 6230) Queries kernel information via 'uname': Jump to behavior
Source: gMILf8mqrF, 6336.1.00000000b54aaeaa.00000000c0fa3b07.rw-.sdmp Binary or memory string: U/sh4/0 /proc/491/fd/69!/proc/777/fd/22/sh4/pro1/proc/2242/exe/sh4/0!/proc/491/fd/70!/proc/777/fd/19/sh4/pro1/usr/bin/vmtoolsdh4/0!/proc/491/fd/71!/proc/777/fd/18/sh4/pro1@uN
Source: gMILf8mqrF, 6230.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6232.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6233.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6336.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6336.1.00000000b54aaeaa.00000000c0fa3b07.rw-.sdmp, gMILf8mqrF, 6239.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6240.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: gMILf8mqrF, 6336.1.00000000b54aaeaa.00000000c0fa3b07.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: gMILf8mqrF, 6230.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6232.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6233.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6336.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6239.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6240.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: gMILf8mqrF, 6230.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6232.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6233.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6336.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6239.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6240.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4
Source: gMILf8mqrF, 6230.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6232.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6233.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6336.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6239.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6240.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/gMILf8mqrFSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/gMILf8mqrF
Source: gMILf8mqrF, 6336.1.00000000b54aaeaa.00000000c0fa3b07.rw-.sdmp Binary or memory string: U/sh4/ro10 /usr/bin/qemu-sh4!/proc/797/fd/341

Stealing of Sensitive Information

barindex
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality

barindex
Source: Yara match File source: dump.pcap, type: PCAP
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs