Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
HAEskA4vLV

Overview

General Information

Sample Name:HAEskA4vLV
Analysis ID:635398
MD5:445ea153f39e7868760107609a343b28
SHA1:1ab794165df55bdd9a4a6d1e7023b550fa29e277
SHA256:3c9c1a3e7f02d9a27f946c3edc5c45554e8884262833b6c648a98880070ac017
Tags:32elfmiraimotorola
Infos:

Detection

Mirai
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Sample tries to kill multiple processes (SIGKILL)
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:635398
Start date and time: 27/05/202221:03:122022-05-27 21:03:12 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 48s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:HAEskA4vLV
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal64.spre.troj.lin@0/0@0/0
  • Report size exceeded maximum capacity and may have missing network information.
Command:/tmp/HAEskA4vLV
PID:6233
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Infected
Standard Error:
  • system is lnxubuntu20
  • HAEskA4vLV (PID: 6233, Parent: 6135, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/HAEskA4vLV
  • cleanup
SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security
    No Snort rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: HAEskA4vLVVirustotal: Detection: 36%Perma Link
    Source: HAEskA4vLVReversingLabs: Detection: 35%

    Networking

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39316
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39336
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39346
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39358
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39366
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39374
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39384
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39400
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39410
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39422
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39432
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39444
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39452
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39462
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39476
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39484
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39490
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39500
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39512
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39522
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39542
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39574
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39612
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39618
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39630
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39640
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39646
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39654
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55824
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55832
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55840
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55856
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55866
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55878
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55892
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55910
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55930
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55950
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55966
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55988
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56000
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56014
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56024
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56038
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56050
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56062
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56074
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56090
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56100
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56116
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56126
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56136
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56164
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56190
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56210
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56232
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39644
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39654
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39662
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39670
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39676
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39686
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39692
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39704
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39710
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39720
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39726
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39734
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39740
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39746
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39754
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39762
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39768
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39776
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39788
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39796
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39800
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39812
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39818
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39826
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39834
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39842
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39852
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39872
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:39008 -> 45.95.169.139:9372
    Source: /tmp/HAEskA4vLV (PID: 6240)Socket: 0.0.0.0::23Jump to behavior
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 123.43.150.226
    Source: unknownTCP traffic detected without corresponding DNS query: 161.68.125.226
    Source: unknownTCP traffic detected without corresponding DNS query: 125.109.2.184
    Source: unknownTCP traffic detected without corresponding DNS query: 147.72.218.64
    Source: unknownTCP traffic detected without corresponding DNS query: 153.136.79.200
    Source: unknownTCP traffic detected without corresponding DNS query: 175.51.249.226
    Source: unknownTCP traffic detected without corresponding DNS query: 244.234.189.116
    Source: unknownTCP traffic detected without corresponding DNS query: 168.89.84.214
    Source: unknownTCP traffic detected without corresponding DNS query: 37.102.70.142
    Source: unknownTCP traffic detected without corresponding DNS query: 164.54.60.38
    Source: unknownTCP traffic detected without corresponding DNS query: 1.162.25.61
    Source: unknownTCP traffic detected without corresponding DNS query: 30.42.105.152
    Source: unknownTCP traffic detected without corresponding DNS query: 28.32.112.98
    Source: unknownTCP traffic detected without corresponding DNS query: 217.75.12.96
    Source: unknownTCP traffic detected without corresponding DNS query: 162.26.234.95
    Source: unknownTCP traffic detected without corresponding DNS query: 88.35.159.179
    Source: unknownTCP traffic detected without corresponding DNS query: 34.114.156.77
    Source: unknownTCP traffic detected without corresponding DNS query: 37.41.27.250
    Source: unknownTCP traffic detected without corresponding DNS query: 150.179.145.197
    Source: unknownTCP traffic detected without corresponding DNS query: 157.123.169.144
    Source: unknownTCP traffic detected without corresponding DNS query: 56.128.239.81
    Source: unknownTCP traffic detected without corresponding DNS query: 251.68.14.81
    Source: unknownTCP traffic detected without corresponding DNS query: 125.58.65.238
    Source: unknownTCP traffic detected without corresponding DNS query: 92.153.105.152
    Source: unknownTCP traffic detected without corresponding DNS query: 59.196.92.105
    Source: unknownTCP traffic detected without corresponding DNS query: 135.76.38.36
    Source: unknownTCP traffic detected without corresponding DNS query: 249.81.154.45
    Source: unknownTCP traffic detected without corresponding DNS query: 117.23.90.49
    Source: unknownTCP traffic detected without corresponding DNS query: 133.228.234.160
    Source: unknownTCP traffic detected without corresponding DNS query: 75.165.246.91
    Source: unknownTCP traffic detected without corresponding DNS query: 27.19.47.184
    Source: unknownTCP traffic detected without corresponding DNS query: 157.206.9.121
    Source: unknownTCP traffic detected without corresponding DNS query: 64.40.59.241
    Source: unknownTCP traffic detected without corresponding DNS query: 113.98.35.245
    Source: unknownTCP traffic detected without corresponding DNS query: 212.22.5.3
    Source: unknownTCP traffic detected without corresponding DNS query: 124.168.38.125
    Source: unknownTCP traffic detected without corresponding DNS query: 147.26.117.6
    Source: unknownTCP traffic detected without corresponding DNS query: 7.211.199.25
    Source: unknownTCP traffic detected without corresponding DNS query: 80.251.228.219
    Source: unknownTCP traffic detected without corresponding DNS query: 120.154.25.31
    Source: unknownTCP traffic detected without corresponding DNS query: 218.192.13.212
    Source: unknownTCP traffic detected without corresponding DNS query: 22.14.73.178
    Source: unknownTCP traffic detected without corresponding DNS query: 114.44.189.102
    Source: unknownTCP traffic detected without corresponding DNS query: 221.144.154.6
    Source: unknownTCP traffic detected without corresponding DNS query: 35.73.108.210
    Source: unknownTCP traffic detected without corresponding DNS query: 200.168.53.146
    Source: unknownTCP traffic detected without corresponding DNS query: 24.170.236.217
    Source: unknownTCP traffic detected without corresponding DNS query: 220.36.79.120

    System Summary

    barindex
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 658, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 772, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 789, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 904, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1320, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1389, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1463, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1465, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1576, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1809, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1888, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1890, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1983, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 2048, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 2062, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 6197, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 6235, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 6244, result: successfulJump to behavior
    Source: ELF static info symbol of initial sample.symtab present: no
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 658, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 772, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 789, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 904, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1320, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1389, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1463, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1465, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1576, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1809, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1888, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1890, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 1983, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 2048, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 2062, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 6197, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 6235, result: successfulJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)SIGKILL sent: pid: 6244, result: successfulJump to behavior
    Source: classification engineClassification label: mal64.spre.troj.lin@0/0@0/0
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/6197/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/6198/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/6235/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1582/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2033/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2275/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/3088/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1612/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1579/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1699/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1335/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1698/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2028/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1334/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1576/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2302/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/3236/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2025/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2146/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/910/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/912/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/517/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/759/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2307/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/918/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/6244/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/6125/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1594/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2285/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2281/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1349/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1623/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/761/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1622/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/884/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1983/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2038/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1344/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1465/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1586/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1463/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2156/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/800/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/801/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1629/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1627/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1900/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/4471/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/4472/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/4473/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/4474/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/3021/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/491/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2294/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2050/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1877/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/772/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1633/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1599/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1632/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/774/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1477/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/654/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/896/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1476/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1872/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2048/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/655/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1475/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2289/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/656/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/777/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/657/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/658/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/4346/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/4347/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/4348/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/419/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/936/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1639/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/4349/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1638/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/4504/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2208/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2180/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1809/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1494/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1890/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2063/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2062/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1888/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1886/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/420/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1489/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/785/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1642/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/788/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/667/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/789/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/1648/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/4495/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2078/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2077/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2074/exeJump to behavior
    Source: /tmp/HAEskA4vLV (PID: 6240)File opened: /proc/2195/exeJump to behavior

    Hooking and other Techniques for Hiding and Protection

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39316
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39336
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39346
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39358
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39366
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39374
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39384
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39400
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39410
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39422
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39432
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39444
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39452
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39462
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39476
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39484
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39490
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39500
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39512
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39522
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39542
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39574
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39612
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39618
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39630
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39640
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39646
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39654
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55824
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55832
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55840
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55856
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55866
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55878
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55892
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55910
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55930
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55950
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55966
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55988
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56000
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56014
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56024
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56038
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56050
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56062
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56074
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56090
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56100
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56116
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56126
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56136
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56164
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56190
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56210
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56232
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39644
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39654
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39662
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39670
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39676
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39686
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39692
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39704
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39710
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39720
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39726
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39734
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39740
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39746
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39754
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39762
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39768
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39776
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39788
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39796
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39800
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39812
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39818
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39826
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39834
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39842
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39852
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39872
    Source: /tmp/HAEskA4vLV (PID: 6233)Queries kernel information via 'uname': Jump to behavior
    Source: HAEskA4vLV, 6233.1.0000000036321392.00000000d8f33923.rw-.sdmp, HAEskA4vLV, 6235.1.0000000036321392.00000000d8f33923.rw-.sdmp, HAEskA4vLV, 6236.1.0000000036321392.00000000d8f33923.rw-.sdmp, HAEskA4vLV, 6242.1.0000000036321392.00000000d8f33923.rw-.sdmp, HAEskA4vLV, 6244.1.0000000036321392.00000000d8f33923.rw-.sdmpBinary or memory string: Ex86_64/usr/bin/qemu-m68k/tmp/HAEskA4vLVSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/HAEskA4vLV
    Source: HAEskA4vLV, 6233.1.0000000036321392.00000000d8f33923.rw-.sdmp, HAEskA4vLV, 6235.1.0000000036321392.00000000d8f33923.rw-.sdmp, HAEskA4vLV, 6236.1.0000000036321392.00000000d8f33923.rw-.sdmp, HAEskA4vLV, 6242.1.0000000036321392.00000000d8f33923.rw-.sdmp, HAEskA4vLV, 6244.1.0000000036321392.00000000d8f33923.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
    Source: HAEskA4vLV, 6233.1.0000000013d2ed51.00000000c3b4415c.rw-.sdmp, HAEskA4vLV, 6235.1.0000000013d2ed51.0000000015bd653d.rw-.sdmp, HAEskA4vLV, 6236.1.0000000013d2ed51.0000000015bd653d.rw-.sdmp, HAEskA4vLV, 6242.1.0000000013d2ed51.0000000015bd653d.rw-.sdmp, HAEskA4vLV, 6244.1.0000000013d2ed51.0000000015bd653d.rw-.sdmpBinary or memory string: -V!/etc/qemu-binfmt/m68k
    Source: HAEskA4vLV, 6233.1.0000000013d2ed51.00000000c3b4415c.rw-.sdmp, HAEskA4vLV, 6235.1.0000000013d2ed51.0000000015bd653d.rw-.sdmp, HAEskA4vLV, 6236.1.0000000013d2ed51.0000000015bd653d.rw-.sdmp, HAEskA4vLV, 6242.1.0000000013d2ed51.0000000015bd653d.rw-.sdmp, HAEskA4vLV, 6244.1.0000000013d2ed51.0000000015bd653d.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP
    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
    OS Credential Dumping
    11
    Security Software Discovery
    Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel
    Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
    Service Stop
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
    Non-Standard Port
    Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol
    Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    No configs have been found