Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
0vFX7VXc9U

Overview

General Information

Sample Name:0vFX7VXc9U
Analysis ID:626466
MD5:5d6cccddcb88cb4daefbc964e23de098
SHA1:18e29b4aaad7d49a2b2adba64387494c6590c8dc
SHA256:1dfc810854844288a6f5c6b1e8dc25059bcff19c5585773956e568eaa4794970
Tags:32armelfmirai
Infos:

Detection

Mirai
Score:68
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample tries to kill multiple processes (SIGKILL)
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.
Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:626466
Start date and time: 14/05/202204:00:302022-05-14 04:00:30 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 19s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:0vFX7VXc9U
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal68.spre.troj.evad.lin@0/0@0/0
  • Report size exceeded maximum capacity and may have missing network information.
Command:/tmp/0vFX7VXc9U
PID:6229
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:
  • system is lnxubuntu20
  • 0vFX7VXc9U (PID: 6229, Parent: 6122, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/0vFX7VXc9U
  • cleanup
SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security
    No Snort rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: 0vFX7VXc9UVirustotal: Detection: 40%Perma Link

    Networking

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54612
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54616
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54618
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54622
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54632
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54640
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54648
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54650
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54654
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54656
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:60988 -> 107.172.197.117:1312
    Source: /tmp/0vFX7VXc9U (PID: 6231)Socket: 0.0.0.0::0Jump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)Socket: 0.0.0.0::53413Jump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)Socket: 0.0.0.0::80Jump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)Socket: 0.0.0.0::37215Jump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)Socket: 0.0.0.0::0Jump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)Socket: 0.0.0.0::53413Jump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)Socket: 0.0.0.0::80Jump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)Socket: 0.0.0.0::37215Jump to behavior
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 107.172.197.117
    Source: unknownTCP traffic detected without corresponding DNS query: 75.153.213.149
    Source: unknownTCP traffic detected without corresponding DNS query: 44.100.148.162
    Source: unknownTCP traffic detected without corresponding DNS query: 153.161.78.149
    Source: unknownTCP traffic detected without corresponding DNS query: 124.122.52.227
    Source: unknownTCP traffic detected without corresponding DNS query: 200.20.122.95
    Source: unknownTCP traffic detected without corresponding DNS query: 209.74.247.155
    Source: unknownTCP traffic detected without corresponding DNS query: 174.71.198.101
    Source: unknownTCP traffic detected without corresponding DNS query: 117.236.55.110
    Source: unknownTCP traffic detected without corresponding DNS query: 37.106.71.233
    Source: unknownTCP traffic detected without corresponding DNS query: 222.47.177.148
    Source: unknownTCP traffic detected without corresponding DNS query: 125.144.106.185
    Source: unknownTCP traffic detected without corresponding DNS query: 206.15.179.149
    Source: unknownTCP traffic detected without corresponding DNS query: 254.27.202.193
    Source: unknownTCP traffic detected without corresponding DNS query: 201.103.134.232
    Source: unknownTCP traffic detected without corresponding DNS query: 219.78.219.232
    Source: unknownTCP traffic detected without corresponding DNS query: 67.141.187.33
    Source: unknownTCP traffic detected without corresponding DNS query: 104.195.123.176
    Source: unknownTCP traffic detected without corresponding DNS query: 120.108.63.223
    Source: unknownTCP traffic detected without corresponding DNS query: 48.186.3.119
    Source: unknownTCP traffic detected without corresponding DNS query: 80.133.177.198
    Source: unknownTCP traffic detected without corresponding DNS query: 182.248.186.183
    Source: unknownTCP traffic detected without corresponding DNS query: 71.218.165.185
    Source: unknownTCP traffic detected without corresponding DNS query: 179.129.198.114
    Source: unknownTCP traffic detected without corresponding DNS query: 59.240.120.127
    Source: unknownTCP traffic detected without corresponding DNS query: 67.6.248.156
    Source: unknownTCP traffic detected without corresponding DNS query: 171.64.241.180
    Source: unknownTCP traffic detected without corresponding DNS query: 75.151.87.145
    Source: unknownTCP traffic detected without corresponding DNS query: 196.183.155.18
    Source: unknownTCP traffic detected without corresponding DNS query: 193.188.234.47
    Source: unknownTCP traffic detected without corresponding DNS query: 185.135.188.9
    Source: unknownTCP traffic detected without corresponding DNS query: 179.213.133.164
    Source: unknownTCP traffic detected without corresponding DNS query: 179.242.15.168
    Source: unknownTCP traffic detected without corresponding DNS query: 198.16.2.230
    Source: unknownTCP traffic detected without corresponding DNS query: 191.27.73.58
    Source: unknownTCP traffic detected without corresponding DNS query: 41.235.202.130
    Source: unknownTCP traffic detected without corresponding DNS query: 58.241.84.58
    Source: unknownTCP traffic detected without corresponding DNS query: 169.228.22.89
    Source: unknownTCP traffic detected without corresponding DNS query: 79.197.67.24
    Source: unknownTCP traffic detected without corresponding DNS query: 32.171.233.252
    Source: unknownTCP traffic detected without corresponding DNS query: 53.169.86.102
    Source: unknownTCP traffic detected without corresponding DNS query: 149.13.99.100
    Source: unknownTCP traffic detected without corresponding DNS query: 115.192.179.28
    Source: unknownTCP traffic detected without corresponding DNS query: 255.194.67.22
    Source: unknownTCP traffic detected without corresponding DNS query: 220.114.89.247
    Source: unknownTCP traffic detected without corresponding DNS query: 213.233.2.165
    Source: unknownTCP traffic detected without corresponding DNS query: 32.215.205.156
    Source: unknownTCP traffic detected without corresponding DNS query: 106.217.38.243
    Source: unknownTCP traffic detected without corresponding DNS query: 213.149.54.237
    Source: 0vFX7VXc9UString found in binary or memory: http://upx.sf.net

    System Summary

    barindex
    Source: /tmp/0vFX7VXc9U (PID: 6231)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 6231, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 788, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 847, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 884, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1860, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2096, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2097, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2102, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2180, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2208, result: successfulJump to behavior
    Source: LOAD without section mappingsProgram segment: 0x8000
    Source: /tmp/0vFX7VXc9U (PID: 6231)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 6231, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 788, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 847, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 884, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1860, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2096, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2097, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2102, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2180, result: successfulJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)SIGKILL sent: pid: 2208, result: successfulJump to behavior
    Source: classification engineClassification label: mal68.spre.troj.evad.lin@0/0@0/0

    Data Obfuscation

    barindex
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/491/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/793/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/772/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/796/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/774/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/797/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/777/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/799/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/658/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/912/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/759/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/936/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/918/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/1/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/761/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/785/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/884/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/720/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/721/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/788/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/789/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/800/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/801/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/847/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6231)File opened: /proc/904/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/6231/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2033/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2033/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1582/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1582/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2275/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1612/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1612/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1579/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1579/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1699/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1699/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1335/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1335/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1698/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1698/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2028/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2028/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1334/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1334/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1576/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1576/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2302/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/3236/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2025/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2025/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2146/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2146/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/910/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/912/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/912/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/912/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/759/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/759/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/759/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/517/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2307/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/918/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/918/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/918/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1594/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1594/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2285/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2281/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1349/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1349/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1623/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1623/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/761/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/761/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/761/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1622/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1622/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/884/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/884/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/884/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1983/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1983/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2038/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2038/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1586/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1586/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1465/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1465/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1344/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1344/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1860/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1860/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1463/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/1463/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2156/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/2156/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/800/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/800/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/800/exeJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/801/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/801/fdJump to behavior
    Source: /tmp/0vFX7VXc9U (PID: 6237)File opened: /proc/801/exeJump to behavior

    Hooking and other Techniques for Hiding and Protection

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54612
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54616
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54618
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54622
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54632
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54640
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54648
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54650
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54654
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54656
    Source: /tmp/0vFX7VXc9U (PID: 6229)Queries kernel information via 'uname': Jump to behavior
    Source: 0vFX7VXc9U, 6229.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6231.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6233.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6239.1.00000000631ea211.00000000c91328e8.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
    Source: 0vFX7VXc9U, 6229.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6231.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6233.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6239.1.0000000037e28d0d.00000000d1298c36.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/0vFX7VXc9USUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/0vFX7VXc9U
    Source: 0vFX7VXc9U, 6229.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6231.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6233.1.00000000631ea211.00000000c91328e8.rw-.sdmp, 0vFX7VXc9U, 6239.1.00000000631ea211.00000000c91328e8.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
    Source: 0vFX7VXc9U, 6229.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6231.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6233.1.0000000037e28d0d.00000000d1298c36.rw-.sdmp, 0vFX7VXc9U, 6239.1.0000000037e28d0d.00000000d1298c36.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP
    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
    Obfuscated Files or Information
    1
    OS Credential Dumping
    11
    Security Software Discovery
    Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel
    Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
    Service Stop
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
    Non-Standard Port
    Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol
    Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 626466 Sample: 0vFX7VXc9U Startdate: 14/05/2022 Architecture: LINUX Score: 68 24 5.19.186.80, 23 ZTELECOM-ASRU Russian Federation 2->24 26 40.131.167.165 WINDSTREAMUS United States 2->26 28 98 other IPs or domains 2->28 32 Multi AV Scanner detection for submitted file 2->32 34 Yara detected Mirai 2->34 36 Uses known network protocols on non-standard ports 2->36 38 Sample is packed with UPX 2->38 8 0vFX7VXc9U 2->8         started        signatures3 process4 process5 10 0vFX7VXc9U 8->10         started        12 0vFX7VXc9U 8->12         started        15 0vFX7VXc9U 8->15         started        signatures6 17 0vFX7VXc9U 10->17         started        20 0vFX7VXc9U 10->20         started        22 0vFX7VXc9U 10->22         started        40 Sample tries to kill multiple processes (SIGKILL) 12->40 process7 signatures8 30 Sample tries to kill multiple processes (SIGKILL) 17->30