Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
gMILf8mqrF

Overview

General Information

Sample Name:gMILf8mqrF
Analysis ID:626462
MD5:99c3d6016731dde0f6250297a8b34a0c
SHA1:04d7db19cff22d044a021cdd2437e1c16d933f27
SHA256:b8e66976f2adb09012e4c737a933d0d88c47da185d5003b7c97df2a5aad3c93d
Tags:32elfmirairenesas
Infos:

Detection

Mirai
Score:60
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample tries to kill multiple processes (SIGKILL)
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:626462
Start date and time: 14/05/202203:54:592022-05-14 03:54:59 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 7m 6s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:gMILf8mqrF
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal60.spre.troj.lin@0/0@0/0
  • Report size exceeded maximum capacity and may have missing network information.
Command:/tmp/gMILf8mqrF
PID:6230
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:
  • system is lnxubuntu20
  • gMILf8mqrF (PID: 6230, Parent: 6132, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/gMILf8mqrF
  • cleanup
SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security
    No Snort rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: gMILf8mqrFVirustotal: Detection: 54%Perma Link
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:60988 -> 107.172.197.117:1312
    Source: /tmp/gMILf8mqrF (PID: 6232)Socket: 0.0.0.0::0Jump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)Socket: 0.0.0.0::53413Jump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)Socket: 0.0.0.0::80Jump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)Socket: 0.0.0.0::0Jump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)Socket: 0.0.0.0::53413Jump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)Socket: 0.0.0.0::80Jump to behavior
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 107.172.197.117
    Source: unknownTCP traffic detected without corresponding DNS query: 213.129.154.49
    Source: unknownTCP traffic detected without corresponding DNS query: 216.32.97.63
    Source: unknownTCP traffic detected without corresponding DNS query: 133.189.1.49
    Source: unknownTCP traffic detected without corresponding DNS query: 177.244.92.136
    Source: unknownTCP traffic detected without corresponding DNS query: 182.76.119.167
    Source: unknownTCP traffic detected without corresponding DNS query: 150.237.112.224
    Source: unknownTCP traffic detected without corresponding DNS query: 121.97.30.182
    Source: unknownTCP traffic detected without corresponding DNS query: 12.111.43.198
    Source: unknownTCP traffic detected without corresponding DNS query: 41.248.250.130
    Source: unknownTCP traffic detected without corresponding DNS query: 18.253.183.27
    Source: unknownTCP traffic detected without corresponding DNS query: 39.246.4.58
    Source: unknownTCP traffic detected without corresponding DNS query: 251.190.208.151
    Source: unknownTCP traffic detected without corresponding DNS query: 206.12.190.247
    Source: unknownTCP traffic detected without corresponding DNS query: 220.197.164.9
    Source: unknownTCP traffic detected without corresponding DNS query: 170.5.115.245
    Source: unknownTCP traffic detected without corresponding DNS query: 120.171.23.24
    Source: unknownTCP traffic detected without corresponding DNS query: 98.65.121.73
    Source: unknownTCP traffic detected without corresponding DNS query: 206.3.212.70
    Source: unknownTCP traffic detected without corresponding DNS query: 163.162.159.38
    Source: unknownTCP traffic detected without corresponding DNS query: 135.46.170.2
    Source: unknownTCP traffic detected without corresponding DNS query: 72.205.56.179
    Source: unknownTCP traffic detected without corresponding DNS query: 17.51.219.140
    Source: unknownTCP traffic detected without corresponding DNS query: 161.57.231.34
    Source: unknownTCP traffic detected without corresponding DNS query: 81.161.252.61
    Source: unknownTCP traffic detected without corresponding DNS query: 101.135.169.159
    Source: unknownTCP traffic detected without corresponding DNS query: 201.57.221.109
    Source: unknownTCP traffic detected without corresponding DNS query: 253.247.195.111
    Source: unknownTCP traffic detected without corresponding DNS query: 146.188.121.222
    Source: unknownTCP traffic detected without corresponding DNS query: 178.169.154.103
    Source: unknownTCP traffic detected without corresponding DNS query: 141.250.189.52
    Source: unknownTCP traffic detected without corresponding DNS query: 163.95.207.89
    Source: unknownTCP traffic detected without corresponding DNS query: 82.127.98.89
    Source: unknownTCP traffic detected without corresponding DNS query: 117.229.130.151
    Source: unknownTCP traffic detected without corresponding DNS query: 121.34.81.173
    Source: unknownTCP traffic detected without corresponding DNS query: 203.58.137.169
    Source: unknownTCP traffic detected without corresponding DNS query: 116.224.119.116
    Source: unknownTCP traffic detected without corresponding DNS query: 174.232.112.218
    Source: unknownTCP traffic detected without corresponding DNS query: 18.1.223.36
    Source: unknownTCP traffic detected without corresponding DNS query: 181.219.238.195
    Source: unknownTCP traffic detected without corresponding DNS query: 216.83.77.238
    Source: unknownTCP traffic detected without corresponding DNS query: 61.206.101.69
    Source: unknownTCP traffic detected without corresponding DNS query: 66.139.13.92
    Source: unknownTCP traffic detected without corresponding DNS query: 165.37.167.98
    Source: unknownTCP traffic detected without corresponding DNS query: 70.191.73.229
    Source: unknownTCP traffic detected without corresponding DNS query: 97.115.61.119
    Source: unknownTCP traffic detected without corresponding DNS query: 31.116.247.118
    Source: unknownTCP traffic detected without corresponding DNS query: 243.133.231.121
    Source: unknownTCP traffic detected without corresponding DNS query: 182.245.91.15

    System Summary

    barindex
    Source: /tmp/gMILf8mqrF (PID: 6232)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 788, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 847, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 884, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 1860, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2096, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2097, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2102, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2180, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2208, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2275, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2281, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2285, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2289, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2294, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 6232, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 6240, result: successfulJump to behavior
    Source: ELF static info symbol of initial sample.symtab present: no
    Source: /tmp/gMILf8mqrF (PID: 6232)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 788, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 847, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 884, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 1860, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2096, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2097, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2102, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2180, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2208, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2275, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2281, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2285, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2289, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 2294, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 6232, result: successfulJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)SIGKILL sent: pid: 6240, result: successfulJump to behavior
    Source: classification engineClassification label: mal60.spre.troj.lin@0/0@0/0
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/491/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/793/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/772/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/796/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/774/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/797/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/777/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/799/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/658/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/912/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/759/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/936/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/918/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/1/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/761/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/785/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/884/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/720/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/721/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/788/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/789/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/800/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/801/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/847/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6232)File opened: /proc/904/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/6232/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/6112/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1582/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/2033/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/2275/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/3088/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/6195/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/6194/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1612/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1579/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1699/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1335/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1698/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/2028/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1334/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1576/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/2302/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/3236/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/2025/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/2146/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/910/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/912/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/912/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/912/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/759/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/759/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/759/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/517/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/2307/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/918/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/918/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/918/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/6240/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/6245/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1594/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/2285/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/2281/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1349/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1623/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/761/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/761/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/761/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1622/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/884/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/884/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/884/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1983/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/2038/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1344/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1465/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1586/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1860/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1463/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/2156/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/800/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/800/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/800/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/801/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/801/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/801/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1629/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1627/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1900/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/3021/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/491/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/491/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/491/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/2294/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/2050/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1877/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/772/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/772/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/772/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1633/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1599/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/1632/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/774/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/774/exeJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6238)File opened: /proc/774/fdJump to behavior
    Source: /tmp/gMILf8mqrF (PID: 6230)Queries kernel information via 'uname': Jump to behavior
    Source: gMILf8mqrF, 6336.1.00000000b54aaeaa.00000000c0fa3b07.rw-.sdmpBinary or memory string: U/sh4/0 /proc/491/fd/69!/proc/777/fd/22/sh4/pro1/proc/2242/exe/sh4/0!/proc/491/fd/70!/proc/777/fd/19/sh4/pro1/usr/bin/vmtoolsdh4/0!/proc/491/fd/71!/proc/777/fd/18/sh4/pro1@uN
    Source: gMILf8mqrF, 6230.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6232.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6233.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6336.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6336.1.00000000b54aaeaa.00000000c0fa3b07.rw-.sdmp, gMILf8mqrF, 6239.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6240.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmpBinary or memory string: /usr/bin/qemu-sh4
    Source: gMILf8mqrF, 6336.1.00000000b54aaeaa.00000000c0fa3b07.rw-.sdmpBinary or memory string: /usr/bin/vmtoolsd
    Source: gMILf8mqrF, 6230.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6232.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6233.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6336.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6239.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6240.1.0000000004094d85.00000000b54aaeaa.rw-.sdmpBinary or memory string: U5!/etc/qemu-binfmt/sh4
    Source: gMILf8mqrF, 6230.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6232.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6233.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6336.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6239.1.0000000004094d85.00000000b54aaeaa.rw-.sdmp, gMILf8mqrF, 6240.1.0000000004094d85.00000000b54aaeaa.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sh4
    Source: gMILf8mqrF, 6230.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6232.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6233.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6336.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6239.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmp, gMILf8mqrF, 6240.1.000000006bf7d72d.000000003bdfd3eb.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-sh4/tmp/gMILf8mqrFSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/gMILf8mqrF
    Source: gMILf8mqrF, 6336.1.00000000b54aaeaa.00000000c0fa3b07.rw-.sdmpBinary or memory string: U/sh4/ro10 /usr/bin/qemu-sh4!/proc/797/fd/341

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP
    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
    OS Credential Dumping
    11
    Security Software Discovery
    Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel
    Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
    Service Stop
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
    Non-Standard Port
    Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol
    Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet