Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
SBNGwWC7Wb

Overview

General Information

Sample Name:SBNGwWC7Wb
Analysis ID:635393
MD5:275c6e393dcacee32b9ddd8bb4ad8196
SHA1:64a8605d5f69142a08385b359d3a6fd73120880d
SHA256:bb0fea23f67c783d1b0d3f8f92e1fd91f1c5d85f7782bc135f0269057e2ab4c3
Tags:32elfmipsmirai
Infos:

Detection

Mirai
Score:68
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample tries to kill multiple processes (SIGKILL)
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.
Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:635393
Start date and time: 27/05/202220:58:412022-05-27 20:58:41 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 6m 12s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:SBNGwWC7Wb
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal68.spre.troj.evad.lin@0/0@0/0
  • Report size exceeded maximum capacity and may have missing network information.
Command:/tmp/SBNGwWC7Wb
PID:6224
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Infected
Standard Error:
  • system is lnxubuntu20
  • SBNGwWC7Wb (PID: 6224, Parent: 6122, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/SBNGwWC7Wb
  • cleanup
SourceRuleDescriptionAuthorStrings
SBNGwWC7WbSUSP_ELF_LNX_UPX_Compressed_FileDetects a suspicious ELF binary with UPX compressionFlorian Roth
  • 0x9cf0:$s1: PROT_EXEC|PROT_WRITE failed.
  • 0x9d5f:$s2: $Id: UPX
  • 0x9d10:$s3: $Info: This file is packed with the UPX executable packer
SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security
    No Snort rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: SBNGwWC7WbVirustotal: Detection: 21%Perma Link
    Source: SBNGwWC7WbReversingLabs: Detection: 25%

    Networking

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38050
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38054
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38056
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38062
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38064
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38066
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38072
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38076
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38078
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38080
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38082
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38088
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38092
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38096
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38100
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38104
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38110
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38112
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38120
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38124
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38128
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38174
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38218
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38242
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38260
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38266
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38282
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38304
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48138
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48146
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48156
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48164
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48176
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48188
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48214
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48230
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48250
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48270
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48288
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48312
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48330
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48350
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48368
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48396
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48420
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48458
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48480
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48502
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48524
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48550
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36132
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48568
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36152
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36170
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48594
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36196
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48626
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36222
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48652
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36246
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48684
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36274
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48718
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36302
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36318
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36328
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36346
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36360
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36382
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36402
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36424
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36474
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36514
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36526
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36534
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36542
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36546
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36554
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36568
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36588
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36608
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36636
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36662
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:39008 -> 45.95.169.139:9372
    Source: /tmp/SBNGwWC7Wb (PID: 6234)Socket: 0.0.0.0::23Jump to behavior
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
    Source: unknownTCP traffic detected without corresponding DNS query: 63.71.236.63
    Source: unknownTCP traffic detected without corresponding DNS query: 114.11.7.63
    Source: unknownTCP traffic detected without corresponding DNS query: 139.141.47.182
    Source: unknownTCP traffic detected without corresponding DNS query: 95.124.131.63
    Source: unknownTCP traffic detected without corresponding DNS query: 213.120.200.66
    Source: unknownTCP traffic detected without corresponding DNS query: 166.43.190.18
    Source: unknownTCP traffic detected without corresponding DNS query: 38.53.114.202
    Source: unknownTCP traffic detected without corresponding DNS query: 11.232.197.117
    Source: unknownTCP traffic detected without corresponding DNS query: 96.168.229.181
    Source: unknownTCP traffic detected without corresponding DNS query: 137.11.225.229
    Source: unknownTCP traffic detected without corresponding DNS query: 23.32.199.1
    Source: unknownTCP traffic detected without corresponding DNS query: 242.149.47.248
    Source: unknownTCP traffic detected without corresponding DNS query: 252.85.7.122
    Source: unknownTCP traffic detected without corresponding DNS query: 47.234.140.22
    Source: unknownTCP traffic detected without corresponding DNS query: 173.94.178.226
    Source: unknownTCP traffic detected without corresponding DNS query: 52.139.163.1
    Source: unknownTCP traffic detected without corresponding DNS query: 43.120.4.1
    Source: unknownTCP traffic detected without corresponding DNS query: 195.141.98.39
    Source: unknownTCP traffic detected without corresponding DNS query: 44.155.181.185
    Source: unknownTCP traffic detected without corresponding DNS query: 248.164.162.83
    Source: unknownTCP traffic detected without corresponding DNS query: 251.88.185.91
    Source: unknownTCP traffic detected without corresponding DNS query: 119.86.111.240
    Source: unknownTCP traffic detected without corresponding DNS query: 251.53.225.130
    Source: unknownTCP traffic detected without corresponding DNS query: 96.65.139.164
    Source: unknownTCP traffic detected without corresponding DNS query: 102.51.242.244
    Source: unknownTCP traffic detected without corresponding DNS query: 249.0.64.154
    Source: unknownTCP traffic detected without corresponding DNS query: 21.27.160.173
    Source: unknownTCP traffic detected without corresponding DNS query: 143.72.214.224
    Source: unknownTCP traffic detected without corresponding DNS query: 139.247.185.140
    Source: unknownTCP traffic detected without corresponding DNS query: 3.79.46.235
    Source: unknownTCP traffic detected without corresponding DNS query: 129.249.147.96
    Source: unknownTCP traffic detected without corresponding DNS query: 123.212.21.227
    Source: unknownTCP traffic detected without corresponding DNS query: 90.240.50.9
    Source: unknownTCP traffic detected without corresponding DNS query: 60.106.246.77
    Source: unknownTCP traffic detected without corresponding DNS query: 8.168.135.183
    Source: unknownTCP traffic detected without corresponding DNS query: 143.70.171.206
    Source: unknownTCP traffic detected without corresponding DNS query: 80.204.106.229
    Source: unknownTCP traffic detected without corresponding DNS query: 3.63.126.132
    Source: unknownTCP traffic detected without corresponding DNS query: 159.6.169.8
    Source: unknownTCP traffic detected without corresponding DNS query: 161.83.96.126
    Source: unknownTCP traffic detected without corresponding DNS query: 140.65.55.67
    Source: unknownTCP traffic detected without corresponding DNS query: 23.150.236.123
    Source: unknownTCP traffic detected without corresponding DNS query: 28.116.95.220
    Source: unknownTCP traffic detected without corresponding DNS query: 53.3.91.208
    Source: unknownTCP traffic detected without corresponding DNS query: 196.192.149.130
    Source: unknownTCP traffic detected without corresponding DNS query: 141.71.20.212
    Source: unknownTCP traffic detected without corresponding DNS query: 132.41.22.128
    Source: unknownTCP traffic detected without corresponding DNS query: 11.178.47.154
    Source: SBNGwWC7WbString found in binary or memory: http://upx.sf.net

    System Summary

    barindex
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 658, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 772, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 789, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 904, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1320, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1389, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1463, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1465, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1576, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1809, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1888, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1890, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1983, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 2048, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 2062, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 6042, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 6187, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 6226, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 6238, result: successfulJump to behavior
    Source: LOAD without section mappingsProgram segment: 0x100000
    Source: SBNGwWC7Wb, type: SAMPLEMatched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 658, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 772, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 789, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 904, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1320, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1389, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1463, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1465, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1576, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1809, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1888, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1890, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 1983, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 2048, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 2062, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 6042, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 6187, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 6226, result: successfulJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)SIGKILL sent: pid: 6238, result: successfulJump to behavior
    Source: classification engineClassification label: mal68.spre.troj.evad.lin@0/0@0/0

    Data Obfuscation

    barindex
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1582/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2033/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2275/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/3088/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1612/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1579/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1699/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1335/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1698/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2028/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1334/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1576/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2302/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/3236/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2025/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2146/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/910/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/6226/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/912/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/517/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/759/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2307/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/918/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/6240/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1594/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2285/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2281/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1349/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1623/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/761/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1622/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/884/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1983/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2038/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1344/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1465/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1586/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1463/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2156/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/800/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/6238/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/801/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1629/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1627/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1900/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/3021/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/491/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2294/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2050/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1877/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/772/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1633/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1599/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1632/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/774/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1477/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/654/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/896/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1476/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1872/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2048/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/655/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1475/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2289/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/656/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/777/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/657/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/4466/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/658/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/4467/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/4468/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/4469/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/419/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/936/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1639/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1638/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2208/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2180/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1809/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1494/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1890/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2063/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2062/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1888/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1886/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/420/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1489/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/785/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1642/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/788/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/667/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/789/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1648/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/6152/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/4495/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/6159/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/4498/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2078/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2077/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2074/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2195/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/670/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/2746/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/793/exeJump to behavior
    Source: /tmp/SBNGwWC7Wb (PID: 6234)File opened: /proc/1656/exeJump to behavior

    Hooking and other Techniques for Hiding and Protection

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38050
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38054
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38056
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38062
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38064
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38066
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38072
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38076
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38078
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38080
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38082
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38088
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38092
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38096
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38100
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38104
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38110
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38112
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38120
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38124
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38128
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38174
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38218
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38242
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38260
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38266
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38282
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 38304
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48138
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48146
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48156
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48164
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48176
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48188
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48214
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48230
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48250
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48270
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48288
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48312
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48330
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48350
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48368
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48396
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48420
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48458
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48480
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48502
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48524
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48550
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36132
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48568
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36152
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36170
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48594
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36196
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48626
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36222
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48652
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36246
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48684
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36274
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 48718
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36302
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36318
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36328
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36346
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36360
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36382
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36402
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36424
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36474
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36514
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36526
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36534
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36542
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36546
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36554
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36568
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36588
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36608
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36636
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36662
    Source: /tmp/SBNGwWC7Wb (PID: 6224)Queries kernel information via 'uname': Jump to behavior
    Source: SBNGwWC7Wb, 6224.1.00000000e275f183.00000000a359d085.rw-.sdmp, SBNGwWC7Wb, 6226.1.00000000e275f183.00000000a359d085.rw-.sdmp, SBNGwWC7Wb, 6227.1.00000000e275f183.00000000a359d085.rw-.sdmp, SBNGwWC7Wb, 6236.1.00000000e275f183.00000000a359d085.rw-.sdmp, SBNGwWC7Wb, 6238.1.00000000e275f183.00000000a359d085.rw-.sdmpBinary or memory string: V!/etc/qemu-binfmt/mips
    Source: SBNGwWC7Wb, 6224.1.00000000e275f183.00000000a359d085.rw-.sdmp, SBNGwWC7Wb, 6226.1.00000000e275f183.00000000a359d085.rw-.sdmp, SBNGwWC7Wb, 6227.1.00000000e275f183.00000000a359d085.rw-.sdmp, SBNGwWC7Wb, 6236.1.00000000e275f183.00000000a359d085.rw-.sdmp, SBNGwWC7Wb, 6238.1.00000000e275f183.00000000a359d085.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
    Source: SBNGwWC7Wb, 6224.1.00000000d4b4c6bb.00000000a7343375.rw-.sdmp, SBNGwWC7Wb, 6226.1.00000000d4b4c6bb.00000000a7343375.rw-.sdmp, SBNGwWC7Wb, 6227.1.00000000d4b4c6bb.00000000a7343375.rw-.sdmp, SBNGwWC7Wb, 6236.1.00000000d4b4c6bb.00000000a7343375.rw-.sdmp, SBNGwWC7Wb, 6238.1.00000000d4b4c6bb.00000000a7343375.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips
    Source: SBNGwWC7Wb, 6224.1.00000000d4b4c6bb.00000000a7343375.rw-.sdmp, SBNGwWC7Wb, 6226.1.00000000d4b4c6bb.00000000a7343375.rw-.sdmp, SBNGwWC7Wb, 6227.1.00000000d4b4c6bb.00000000a7343375.rw-.sdmp, SBNGwWC7Wb, 6236.1.00000000d4b4c6bb.00000000a7343375.rw-.sdmp, SBNGwWC7Wb, 6238.1.00000000d4b4c6bb.00000000a7343375.rw-.sdmpBinary or memory string: r#x86_64/usr/bin/qemu-mips/tmp/SBNGwWC7WbSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SBNGwWC7Wb

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP
    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
    Obfuscated Files or Information
    1
    OS Credential Dumping
    11
    Security Software Discovery
    Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel
    Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
    Service Stop
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
    Non-Standard Port
    Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol
    Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet