Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
VQemUYjLmL

Overview

General Information

Sample Name:VQemUYjLmL
Analysis ID:626465
MD5:9bf5c9ac9cacd58b0d008938167c3d7d
SHA1:b57f925cbdad949ad41db5c57c0774a2cbf6d282
SHA256:9cae0351a33e4b4c74263920dd8f1fee4e03d14022ff2caf631d367023b53fa8
Tags:32elfintelmirai
Infos:

Detection

Mirai
Score:60
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample contains only a LOAD segment without any section mappings
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:626465
Start date and time: 14/05/202204:00:302022-05-14 04:00:30 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 6m 33s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:VQemUYjLmL
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal60.troj.evad.lin@0/0@0/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Runtime Messages

Command:/tmp/VQemUYjLmL
PID:6227
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for submitted file
    Source: VQemUYjLmLVirustotal: Detection: 40%Perma Link
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:60988 -> 107.172.197.117:1312
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 107.172.197.117
    Source: unknownTCP traffic detected without corresponding DNS query: 106.38.78.67
    Source: unknownTCP traffic detected without corresponding DNS query: 211.29.213.67
    Source: unknownTCP traffic detected without corresponding DNS query: 167.121.231.169
    Source: unknownTCP traffic detected without corresponding DNS query: 164.59.8.64
    Source: unknownTCP traffic detected without corresponding DNS query: 197.249.7.53
    Source: unknownTCP traffic detected without corresponding DNS query: 208.238.100.146
    Source: unknownTCP traffic detected without corresponding DNS query: 78.22.214.152
    Source: unknownTCP traffic detected without corresponding DNS query: 43.104.156.175
    Source: unknownTCP traffic detected without corresponding DNS query: 193.99.120.233
    Source: unknownTCP traffic detected without corresponding DNS query: 146.252.206.10
    Source: unknownTCP traffic detected without corresponding DNS query: 159.122.186.232
    Source: unknownTCP traffic detected without corresponding DNS query: 68.245.215.101
    Source: unknownTCP traffic detected without corresponding DNS query: 79.182.104.166
    Source: unknownTCP traffic detected without corresponding DNS query: 164.13.129.250
    Source: unknownTCP traffic detected without corresponding DNS query: 79.157.164.86
    Source: unknownTCP traffic detected without corresponding DNS query: 154.187.41.100
    Source: unknownTCP traffic detected without corresponding DNS query: 213.9.35.54
    Source: unknownTCP traffic detected without corresponding DNS query: 204.140.249.124
    Source: unknownTCP traffic detected without corresponding DNS query: 73.196.193.46
    Source: unknownTCP traffic detected without corresponding DNS query: 104.45.93.135
    Source: unknownTCP traffic detected without corresponding DNS query: 155.24.153.232
    Source: unknownTCP traffic detected without corresponding DNS query: 37.133.254.246
    Source: unknownTCP traffic detected without corresponding DNS query: 106.211.14.146
    Source: unknownTCP traffic detected without corresponding DNS query: 187.115.98.97
    Source: unknownTCP traffic detected without corresponding DNS query: 89.253.203.20
    Source: unknownTCP traffic detected without corresponding DNS query: 70.111.42.24
    Source: unknownTCP traffic detected without corresponding DNS query: 246.82.17.49
    Source: unknownTCP traffic detected without corresponding DNS query: 19.55.53.44
    Source: unknownTCP traffic detected without corresponding DNS query: 157.244.187.42
    Source: unknownTCP traffic detected without corresponding DNS query: 20.217.196.70
    Source: unknownTCP traffic detected without corresponding DNS query: 74.44.118.39
    Source: unknownTCP traffic detected without corresponding DNS query: 217.233.198.119
    Source: unknownTCP traffic detected without corresponding DNS query: 206.143.61.82
    Source: unknownTCP traffic detected without corresponding DNS query: 255.130.166.23
    Source: unknownTCP traffic detected without corresponding DNS query: 44.60.194.61
    Source: unknownTCP traffic detected without corresponding DNS query: 98.11.9.51
    Source: unknownTCP traffic detected without corresponding DNS query: 145.118.58.45
    Source: unknownTCP traffic detected without corresponding DNS query: 4.120.246.167
    Source: unknownTCP traffic detected without corresponding DNS query: 113.251.32.216
    Source: unknownTCP traffic detected without corresponding DNS query: 48.187.197.152
    Source: unknownTCP traffic detected without corresponding DNS query: 147.148.103.207
    Source: unknownTCP traffic detected without corresponding DNS query: 98.33.188.200
    Source: unknownTCP traffic detected without corresponding DNS query: 218.240.141.96
    Source: unknownTCP traffic detected without corresponding DNS query: 79.72.104.51
    Source: unknownTCP traffic detected without corresponding DNS query: 223.163.13.70
    Source: unknownTCP traffic detected without corresponding DNS query: 111.53.251.142
    Source: unknownTCP traffic detected without corresponding DNS query: 142.137.143.232
    Source: unknownTCP traffic detected without corresponding DNS query: 84.7.45.117
    Source: unknownTCP traffic detected without corresponding DNS query: 198.119.123.156
    Source: VQemUYjLmLString found in binary or memory: http://upx.sf.net
    Source: LOAD without section mappingsProgram segment: 0xc01000
    Source: /tmp/VQemUYjLmL (PID: 6228)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/VQemUYjLmL (PID: 6231)SIGKILL sent: pid: 936, result: successful
    Source: classification engineClassification label: mal60.troj.evad.lin@0/0@0/0

    Data Obfuscation

    barindex
    Sample is packed with UPX
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/6231/exe
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/491/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/793/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/772/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/796/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/774/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/797/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/777/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/799/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/658/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/912/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/759/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/936/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/918/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/1/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/761/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/785/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/884/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/720/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/721/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/788/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/789/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/800/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/801/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/847/fd
    Source: /tmp/VQemUYjLmL (PID: 6231)File opened: /proc/904/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/491/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/793/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/772/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/796/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/774/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/797/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/777/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/799/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/658/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/912/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/759/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/6228/exe
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/936/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/918/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/1/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/761/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/785/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/884/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/720/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/721/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/788/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/789/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/800/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/801/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/847/fd
    Source: /tmp/VQemUYjLmL (PID: 6228)File opened: /proc/904/fd
    Source: VQemUYjLmL, 6227.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6228.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6320.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6329.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6324.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6229.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6319.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6232.1.00000000c7954095.00000000486baebe.rw-.sdmpBinary or memory string: ui686143okhp3gb4p2fdSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/VQemUYjLmL
    Source: VQemUYjLmL, 6227.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6228.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6320.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6329.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6324.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6229.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6319.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6232.1.00000000c7954095.00000000486baebe.rw-.sdmpBinary or memory string: =/tmp/VQemUYjLmL
    Source: VQemUYjLmL, 6227.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6228.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6228.1.000000006ff2a7f9.0000000067604773.rw-.sdmp, VQemUYjLmL, 6320.1.000000006ff2a7f9.0000000067604773.rw-.sdmp, VQemUYjLmL, 6320.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6329.1.000000006ff2a7f9.0000000067604773.rw-.sdmp, VQemUYjLmL, 6329.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6324.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6324.1.000000006ff2a7f9.0000000067604773.rw-.sdmp, VQemUYjLmL, 6229.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6319.1.00000000c7954095.00000000486baebe.rw-.sdmp, VQemUYjLmL, 6319.1.000000006ff2a7f9.0000000067604773.rw-.sdmp, VQemUYjLmL, 6232.1.00000000c7954095.00000000486baebe.rw-.sdmpBinary or memory string: /tmp/VQemUYjLmL

    Stealing of Sensitive Information

    barindex
    Yara detected Mirai
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Yara detected Mirai
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
    Obfuscated Files or Information    		1
    OS Credential Dumping    		1
    Security Software Discovery    		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
    Non-Standard Port    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol    		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

    Malware Configuration

    ⊘No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 626465 Sample: VQemUYjLmL Startdate: 14/05/2022 Architecture: LINUX Score: 60 42 209.31.82.119 XO-AS15US United States 2->42 44 165.163.148.154 WISCNET1-ASUS United States 2->44 46 98 other IPs or domains 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Mirai 2->50 52 Sample is packed with UPX 2->52 10 VQemUYjLmL 2->10         started        signatures3 process4 process5 12 VQemUYjLmL 10->12         started        14 VQemUYjLmL 10->14         started        16 VQemUYjLmL 10->16         started        process6 18 VQemUYjLmL 12->18         started        20 VQemUYjLmL 12->20         started        22 VQemUYjLmL 14->22         started        24 VQemUYjLmL 14->24         started        26 VQemUYjLmL 14->26         started        process7 28 VQemUYjLmL 18->28         started        30 VQemUYjLmL 18->30         started        32 VQemUYjLmL 18->32         started        34 VQemUYjLmL 22->34         started        36 VQemUYjLmL 22->36         started        process8 38 VQemUYjLmL 28->38         started        40 VQemUYjLmL 28->40         started       

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    VQemUYjLmL41%VirustotalBrowse

    Dropped Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Contacted Domains

    ⊘No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.netVQemUYjLmLfalse
      		high

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      92.90.232.168
      		unknownFrance
      		15557LDCOMNETFRfalse
      133.76.4.145
      		unknownJapan2907SINET-ASResearchOrganizationofInformationandSystemsNfalse
      44.14.96.139
      		unknownUnited States
      		7377UCSDUSfalse
      48.114.250.98
      		unknownUnited States
      		2686ATGS-MMD-ASUSfalse
      180.7.246.116
      		unknownJapan4713OCNNTTCommunicationsCorporationJPfalse
      18.54.163.197
      		unknownUnited States
      		3MIT-GATEWAYSUSfalse
      60.226.69.21
      		unknownAustralia
      		1221ASN-TELSTRATelstraCorporationLtdAUfalse
      36.71.246.248
      		unknownIndonesia
      		7713TELKOMNET-AS-APPTTelekomunikasiIndonesiaIDfalse
      219.18.123.206
      		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
      174.183.29.88
      		unknownUnited States
      		7922COMCAST-7922USfalse
      104.167.150.185
      		unknownUnited States
      		54119BOINGO-MDUUSfalse
      129.2.240.5
      		unknownUnited States
      		27UMDNETUSfalse
      180.83.51.239
      		unknownKorea Republic of
      		17858POWERVIS-AS-KRLGPOWERCOMMKRfalse
      83.20.34.90
      		unknownPoland
      		5617TPNETPLfalse
      114.215.215.176
      		unknownChina
      		37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdfalse
      100.237.194.125
      		unknownUnited States
      		21928T-MOBILE-AS21928USfalse
      157.78.204.8
      		unknownJapan4725ODNSoftBankMobileCorpJPfalse
      181.11.124.60
      		unknownArgentina
      		7303TelecomArgentinaSAARfalse
      211.232.248.235
      		unknownKorea Republic of
      		17854CABLELINE-AS-KRTbroadjeonjubroadcastKRfalse
      46.111.148.192
      		unknownRussian Federation
      		2854ROSPRINT-ASRUfalse
      165.163.148.154
      		unknownUnited States
      		2381WISCNET1-ASUSfalse
      172.218.17.202
      		unknownCanada
      		852ASN852CAfalse
      122.117.14.241
      		unknownTaiwan; Republic of China (ROC)
      		3462HINETDataCommunicationBusinessGroupTWfalse
      2.163.240.249
      		unknownGermany
      		3320DTAGInternetserviceprovideroperationsDEfalse
      247.196.142.63
      		unknownReserved
      		unknownunknownfalse
      86.104.240.210
      		unknownIran (ISLAMIC Republic Of)
      		58224TCIIRfalse
      160.172.158.31
      		unknownMorocco
      		6713IAM-ASMAfalse
      72.141.103.237
      		unknownCanada
      		812ROGERS-COMMUNICATIONSCAfalse
      110.114.57.238
      		unknownChina
      		24138CTTNETChinaTieTongTelecommunicationsCorporationCNfalse
      188.22.62.4
      		unknownAustria
      		8447TELEKOM-ATA1TelekomAustriaAGATfalse
      60.181.24.12
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      161.118.143.153
      		unknownJapan13041CESCA-ACESfalse
      122.207.7.246
      		unknownChina
      		4538ERX-CERNET-BKBChinaEducationandResearchNetworkCenterfalse
      169.1.9.95
      		unknownSouth Africa
      		37611AfrihostZAfalse
      32.47.84.117
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      133.86.79.15
      		unknownJapan2907SINET-ASResearchOrganizationofInformationandSystemsNfalse
      167.249.143.193
      		unknownBrazil
      		265191SapucaiaComercioeinformaticaltda-meBRfalse
      12.133.82.82
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      189.59.13.46
      		unknownBrazil
      		18881TELEFONICABRASILSABRfalse
      81.2.167.134
      		unknownGermany
      		48945IFNL-ASGBfalse
      223.39.61.40
      		unknownKorea Republic of
      		9644SKTELECOM-NET-ASSKTelecomKRfalse
      161.162.127.148
      		unknownUnited States
      		263740CorporacionLaceibanetsocietyHNfalse
      47.77.27.116
      		unknownUnited States
      		9500VODAFONE-TRANSIT-ASVodafoneNZLtdNZfalse
      45.75.223.36
      		unknownUnited Kingdom
      		49425DIGITAL-REALTY-UKGBfalse
      173.157.80.169
      		unknownUnited States
      		10507SPCSUSfalse
      243.114.242.13
      		unknownReserved
      		unknownunknownfalse
      111.105.27.172
      		unknownJapan2516KDDIKDDICORPORATIONJPfalse
      165.190.212.86
      		unknownUnited States
      		8122DQNASUSfalse
      63.185.84.28
      		unknownUnited States
      		1239SPRINTLINKUSfalse
      207.48.145.200
      		unknownUnited States
      		3561CENTURYLINK-LEGACY-SAVVISUSfalse
      61.201.19.84
      		unknownJapan4725ODNSoftBankMobileCorpJPfalse
      44.161.29.169
      		unknownUnited States
      		7377UCSDUSfalse
      8.182.167.78
      		unknownSingapore
      		37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdfalse
      87.74.186.30
      		unknownUnited Kingdom
      		25310ASN-CWACCESSGBfalse
      48.170.71.32
      		unknownUnited States
      		2686ATGS-MMD-ASUSfalse
      120.170.161.61
      		unknownIndonesia
      		4761INDOSAT-INP-APINDOSATInternetNetworkProviderIDfalse
      91.34.209.170
      		unknownGermany
      		3320DTAGInternetserviceprovideroperationsDEfalse
      167.97.254.148
      		unknownUnited States
      		2055LSU-1USfalse
      27.220.236.35
      		unknownChina
      		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      162.197.117.219
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      1.74.87.160
      		unknownJapan9605DOCOMONTTDOCOMOINCJPfalse
      97.20.82.172
      		unknownUnited States
      		22394CELLCOUSfalse
      196.94.216.24
      		unknownMorocco
      		6713IAM-ASMAfalse
      110.127.67.241
      		unknownChina
      		134810CMNET-JILIN-AS-APChinaMobileGroupJiLincommunicationscofalse
      245.151.17.52
      		unknownReserved
      		unknownunknownfalse
      5.117.38.89
      		unknownIran (ISLAMIC Republic Of)
      		44244IRANCELL-ASIRfalse
      61.121.4.183
      		unknownJapan2510INFOWEBFUJITSULIMITEDJPfalse
      47.112.150.22
      		unknownChina
      		37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdfalse
      171.90.160.62
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      195.210.114.17
      		unknownUnited Kingdom
      		207088ADOARDGBfalse
      40.187.124.6
      		unknownUnited States
      		4249LILLY-ASUSfalse
      24.125.4.208
      		unknownUnited States
      		7922COMCAST-7922USfalse
      114.128.202.91
      		unknownThailand
      		56046CMNET-JIANGSU-APChinaMobilecommunicationscorporationCNfalse
      91.131.88.159
      		unknownAustria
      		1257TELE2EUfalse
      17.22.101.200
      		unknownUnited States
      		714APPLE-ENGINEERINGUSfalse
      105.44.152.180
      		unknownEgypt
      		37069MOBINILEGfalse
      113.222.205.206
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      211.52.43.39
      		unknownKorea Republic of
      		4766KIXS-AS-KRKoreaTelecomKRfalse
      119.46.20.101
      		unknownThailand
      		7470TRUEINTERNET-AS-APTRUEINTERNETCoLtdTHfalse
      207.10.102.26
      		unknownUnited States
      		7029WINDSTREAMUSfalse
      175.44.144.191
      		unknownChina
      		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      111.71.144.64
      		unknownTaiwan; Republic of China (ROC)
      		17421EMOME-NETMobileBusinessGroupTWfalse
      116.191.43.142
      		unknownChina
      		4847CNIX-APChinaNetworksInter-ExchangeCNfalse
      44.60.240.93
      		unknownUnited States
      		7377UCSDUSfalse
      106.140.171.118
      		unknownJapan2516KDDIKDDICORPORATIONJPfalse
      97.4.220.39
      		unknownUnited States
      		22394CELLCOUSfalse
      4.189.101.243
      		unknownUnited States
      		3356LEVEL3USfalse
      250.57.112.223
      		unknownReserved
      		unknownunknownfalse
      96.224.76.167
      		unknownUnited States
      		701UUNETUSfalse
      207.166.46.247
      		unknownUnited States
      		2152CSUNET-NWUSfalse
      23.164.102.139
      		unknownReserved
      		19382ONCORECAfalse
      63.89.37.130
      		unknownUnited States
      		701UUNETUSfalse
      168.215.26.59
      		unknownUnited States
      		10753LVLT-10753USfalse
      34.194.134.3
      		unknownUnited States
      		14618AMAZON-AESUSfalse
      218.212.188.164
      		unknownSingapore
      		55430STARHUB-NGNBNStarhubLtdSGfalse
      249.17.189.36
      		unknownReserved
      		unknownunknownfalse
      252.66.185.166
      		unknownReserved
      		unknownunknownfalse
      85.9.126.180
      		unknownIran (ISLAMIC Republic Of)
      		49100IR-THR-PTEIRfalse
      209.31.82.119
      		unknownUnited States
      		2828XO-AS15USfalse
      197.87.110.49
      		unknownSouth Africa
      		10474OPTINETZAfalse

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      ⊘No created / dropped files found

      Static File Info

      General

      File type:ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped
      Entropy (8bit):7.872106803634582
      TrID:
      • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
      • ELF Executable and Linkable format (generic) (4004/1) 49.84%
      File name:VQemUYjLmL
      File size:24728
      MD5:9bf5c9ac9cacd58b0d008938167c3d7d
      SHA1:b57f925cbdad949ad41db5c57c0774a2cbf6d282
      SHA256:9cae0351a33e4b4c74263920dd8f1fee4e03d14022ff2caf631d367023b53fa8
      SHA512:e595bab9f1fa5f84f3b6bc201f49057846cb947e04fd7f012536db2db15e5a70e43d74a67807b09be6882f0e87e5347b5867228aee5296948c8a99326da19165
      SSDEEP:384:MVDKKQOcRpmYLdn6RBOFRFt5rUFt1diSAlCo3AnupsFNYrk4d1NEZgO8UXWozPLP:w/QOC0Yhn6ROHWFjicwNqFOXnNBxc8cv
      TLSH:A9B2E195E6FB27C3C2D19336E07C994DA2B21AC00746441B2109B64EA3DB60F47FF7A5
      File Content Preview:.ELF.....................g..4...........4. ...(......................_..._...................W...W..................Q.td...............................tUPX!....................Z........?d..ELF.......d.......4.,..4. (.......k.-.#.`...........?..P......d..l

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, little endian
      Version:1 (current)
      Machine:Intel 80386
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - Linux
      ABI Version:0
      Entry Point Address:0xc067a0
      Flags:0x0
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:0
      Section Header Size:40
      Number of Section Headers:0
      Header String Table Index:0

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00xc010000xc010000x5f9b0x5f9b4.55490x5R E0x1000
      LOAD0x7000x80557000x80557000x00x00.00000x6RW 0x1000
      GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

      Network Behavior

      Network Port Distribution

      TCP Packets

      TimestampSource PortDest PortSource IPDest IP
      May 14, 2022 04:01:18.660759926 CEST609881312192.168.2.23107.172.197.117
      May 14, 2022 04:01:18.661009073 CEST5003423192.168.2.23106.38.78.67
      May 14, 2022 04:01:18.661014080 CEST5003423192.168.2.23211.29.213.67
      May 14, 2022 04:01:18.661026955 CEST5003423192.168.2.23167.121.231.169
      May 14, 2022 04:01:18.661075115 CEST5003423192.168.2.23164.59.8.64
      May 14, 2022 04:01:18.661089897 CEST5003423192.168.2.23197.249.7.53
      May 14, 2022 04:01:18.661097050 CEST5003423192.168.2.23208.238.100.146
      May 14, 2022 04:01:18.661099911 CEST5003423192.168.2.2378.22.214.152
      May 14, 2022 04:01:18.661108017 CEST5003423192.168.2.23110.48.139.85
      May 14, 2022 04:01:18.661118031 CEST5003423192.168.2.2343.104.156.175
      May 14, 2022 04:01:18.661129951 CEST5003423192.168.2.23193.99.120.233
      May 14, 2022 04:01:18.661134005 CEST5003423192.168.2.23146.252.206.10
      May 14, 2022 04:01:18.661142111 CEST5003423192.168.2.23159.122.186.232
      May 14, 2022 04:01:18.661142111 CEST5003423192.168.2.23121.253.10.184
      May 14, 2022 04:01:18.661147118 CEST5003423192.168.2.2368.245.215.101
      May 14, 2022 04:01:18.661150932 CEST5003423192.168.2.2379.182.104.166
      May 14, 2022 04:01:18.661154985 CEST5003423192.168.2.23164.13.129.250
      May 14, 2022 04:01:18.661158085 CEST5003423192.168.2.2379.157.164.86
      May 14, 2022 04:01:18.661169052 CEST5003423192.168.2.23154.187.41.100
      May 14, 2022 04:01:18.661173105 CEST5003423192.168.2.23213.9.35.54
      May 14, 2022 04:01:18.661174059 CEST5003423192.168.2.23115.245.110.165
      May 14, 2022 04:01:18.661178112 CEST5003423192.168.2.23204.140.249.124
      May 14, 2022 04:01:18.661180019 CEST5003423192.168.2.2373.196.193.46
      May 14, 2022 04:01:18.661183119 CEST5003423192.168.2.23104.45.93.135
      May 14, 2022 04:01:18.661185026 CEST5003423192.168.2.23155.24.153.232
      May 14, 2022 04:01:18.661190987 CEST5003423192.168.2.2337.133.254.246
      May 14, 2022 04:01:18.661191940 CEST5003423192.168.2.23106.211.14.146
      May 14, 2022 04:01:18.661195040 CEST5003423192.168.2.23187.115.98.97
      May 14, 2022 04:01:18.661199093 CEST5003423192.168.2.2389.253.203.20
      May 14, 2022 04:01:18.661200047 CEST5003423192.168.2.2370.111.42.24
      May 14, 2022 04:01:18.661206007 CEST5003423192.168.2.23246.82.17.49
      May 14, 2022 04:01:18.661211014 CEST5003423192.168.2.2319.55.53.44
      May 14, 2022 04:01:18.661216021 CEST5003423192.168.2.23157.244.187.42
      May 14, 2022 04:01:18.661217928 CEST5003423192.168.2.2320.217.196.70
      May 14, 2022 04:01:18.661225080 CEST5003423192.168.2.2374.44.118.39
      May 14, 2022 04:01:18.661226988 CEST5003423192.168.2.23217.233.198.119
      May 14, 2022 04:01:18.661230087 CEST5003423192.168.2.23206.143.61.82
      May 14, 2022 04:01:18.661231995 CEST5003423192.168.2.23255.130.166.23
      May 14, 2022 04:01:18.661241055 CEST5003423192.168.2.2344.60.194.61
      May 14, 2022 04:01:18.661245108 CEST5003423192.168.2.2398.11.9.51
      May 14, 2022 04:01:18.661259890 CEST5003423192.168.2.23145.118.58.45
      May 14, 2022 04:01:18.661261082 CEST5003423192.168.2.234.120.246.167
      May 14, 2022 04:01:18.661262989 CEST5003423192.168.2.23113.251.32.216
      May 14, 2022 04:01:18.661264896 CEST5003423192.168.2.2348.187.197.152
      May 14, 2022 04:01:18.661272049 CEST5003423192.168.2.23223.139.110.227
      May 14, 2022 04:01:18.661278963 CEST5003423192.168.2.23147.148.103.207
      May 14, 2022 04:01:18.661286116 CEST5003423192.168.2.2398.33.188.200
      May 14, 2022 04:01:18.661335945 CEST5003423192.168.2.23218.240.141.96
      May 14, 2022 04:01:18.661361933 CEST5003423192.168.2.2379.72.104.51
      May 14, 2022 04:01:18.661374092 CEST5003423192.168.2.23223.163.13.70
      May 14, 2022 04:01:18.661390066 CEST5003423192.168.2.23111.53.251.142
      May 14, 2022 04:01:18.661391020 CEST5003423192.168.2.23142.137.143.232
      May 14, 2022 04:01:18.661406040 CEST5003423192.168.2.2384.7.45.117
      May 14, 2022 04:01:18.661415100 CEST5003423192.168.2.23198.119.123.156
      May 14, 2022 04:01:18.661418915 CEST5003423192.168.2.23246.106.183.100
      May 14, 2022 04:01:18.661420107 CEST5003423192.168.2.23218.206.47.55
      May 14, 2022 04:01:18.661425114 CEST5003423192.168.2.23184.97.187.63
      May 14, 2022 04:01:18.661431074 CEST5003423192.168.2.23115.192.88.44
      May 14, 2022 04:01:18.661437035 CEST5003423192.168.2.23108.75.103.26
      May 14, 2022 04:01:18.661482096 CEST5003423192.168.2.23205.174.122.236
      May 14, 2022 04:01:18.661489010 CEST5003423192.168.2.23165.194.250.39
      May 14, 2022 04:01:18.661501884 CEST5003423192.168.2.234.0.1.1
      May 14, 2022 04:01:18.661546946 CEST5003423192.168.2.23199.77.107.245
      May 14, 2022 04:01:18.661551952 CEST5003423192.168.2.23159.150.204.244
      May 14, 2022 04:01:18.661578894 CEST5003423192.168.2.23142.116.223.189
      May 14, 2022 04:01:18.661592960 CEST5003423192.168.2.23175.113.59.34
      May 14, 2022 04:01:18.661612988 CEST5003423192.168.2.2320.216.136.247
      May 14, 2022 04:01:18.661617994 CEST5003423192.168.2.23158.163.230.18
      May 14, 2022 04:01:18.661633015 CEST5003423192.168.2.23110.238.93.208
      May 14, 2022 04:01:18.661643982 CEST5003423192.168.2.23210.96.252.168
      May 14, 2022 04:01:18.661653996 CEST5003423192.168.2.239.88.234.199
      May 14, 2022 04:01:18.661665916 CEST5003423192.168.2.23204.73.90.8
      May 14, 2022 04:01:18.661670923 CEST5003423192.168.2.23210.146.245.207
      May 14, 2022 04:01:18.661674023 CEST5003423192.168.2.2348.236.103.100
      May 14, 2022 04:01:18.661679983 CEST5003423192.168.2.23170.109.3.232
      May 14, 2022 04:01:18.661684036 CEST5003423192.168.2.2338.99.109.156
      May 14, 2022 04:01:18.661685944 CEST5003423192.168.2.23156.134.103.198
      May 14, 2022 04:01:18.661689997 CEST5003423192.168.2.23145.146.116.157
      May 14, 2022 04:01:18.661695957 CEST5003423192.168.2.2383.21.176.55
      May 14, 2022 04:01:18.661722898 CEST5003423192.168.2.2334.84.98.132
      May 14, 2022 04:01:18.661726952 CEST5003423192.168.2.2366.44.185.171
      May 14, 2022 04:01:18.661731005 CEST5003423192.168.2.2393.117.187.201
      May 14, 2022 04:01:18.661746025 CEST5003423192.168.2.23146.160.121.118
      May 14, 2022 04:01:18.661751032 CEST5003423192.168.2.2398.57.6.10
      May 14, 2022 04:01:18.661756992 CEST5003423192.168.2.23180.129.17.21
      May 14, 2022 04:01:18.661758900 CEST5003423192.168.2.23253.203.243.227
      May 14, 2022 04:01:18.661757946 CEST5003423192.168.2.2395.215.147.34
      May 14, 2022 04:01:18.661775112 CEST5003423192.168.2.2320.93.189.168
      May 14, 2022 04:01:18.661776066 CEST5003423192.168.2.2335.78.220.215
      May 14, 2022 04:01:18.661777973 CEST5003423192.168.2.23138.8.243.149
      May 14, 2022 04:01:18.661778927 CEST5003423192.168.2.2364.59.137.5
      May 14, 2022 04:01:18.661792994 CEST5003423192.168.2.2337.37.201.7
      May 14, 2022 04:01:18.661793947 CEST5003423192.168.2.2365.132.55.18
      May 14, 2022 04:01:18.661807060 CEST5003423192.168.2.2335.73.89.165
      May 14, 2022 04:01:18.661818981 CEST5003423192.168.2.23191.37.218.4
      May 14, 2022 04:01:18.661828995 CEST5003423192.168.2.23192.105.230.111
      May 14, 2022 04:01:18.661835909 CEST5003423192.168.2.23190.213.101.171
      May 14, 2022 04:01:18.661840916 CEST5003423192.168.2.2358.49.50.45
      May 14, 2022 04:01:18.661843061 CEST5003423192.168.2.23126.90.50.139
      May 14, 2022 04:01:18.661848068 CEST5003423192.168.2.2374.189.173.84

      System Behavior

      General

      Start time:04:01:17
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:/tmp/VQemUYjLmL
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:01:17
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:04:09
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:04:09
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:04:09
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:04:14
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:04:14
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:04:09
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:04:09
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:01:17
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:01:17
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:01:17
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:04:09
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:04:09
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:01:17
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d

      General

      Start time:04:01:17
      Start date:14/05/2022
      Path:/tmp/VQemUYjLmL
      Arguments:n/a
      File size:24728 bytes
      MD5 hash:9bf5c9ac9cacd58b0d008938167c3d7d