Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
XXJn52htu2

Overview

General Information

Sample Name:XXJn52htu2
Analysis ID:635401
MD5:214bc7a11120145241f962afdb35bab1
SHA1:bc997a8ce1456d17b56bbf3eede98a160d4b42f0
SHA256:ff54b59b11d8a639c26411d069a74c6f9493bcff1226b0c7785f092c489fa7fe
Tags:32armelfmirai
Infos:

Detection

Mirai
Score:68
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample tries to kill multiple processes (SIGKILL)
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.
Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:635401
Start date and time: 27/05/202221:07:462022-05-27 21:07:46 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 42s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:XXJn52htu2
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal68.spre.troj.evad.lin@0/0@0/0
  • Report size exceeded maximum capacity and may have missing network information.
Command:/tmp/XXJn52htu2
PID:6225
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Infected
Standard Error:
  • system is lnxubuntu20
  • XXJn52htu2 (PID: 6225, Parent: 6123, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/XXJn52htu2
  • cleanup
SourceRuleDescriptionAuthorStrings
XXJn52htu2SUSP_ELF_LNX_UPX_Compressed_FileDetects a suspicious ELF binary with UPX compressionFlorian Roth
  • 0x8e60:$s1: PROT_EXEC|PROT_WRITE failed.
  • 0x8ecf:$s2: $Id: UPX
  • 0x8e80:$s3: $Info: This file is packed with the UPX executable packer
SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security
    No Snort rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: XXJn52htu2Virustotal: Detection: 16%Perma Link
    Source: XXJn52htu2ReversingLabs: Detection: 20%

    Networking

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46838
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46842
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46844
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46846
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46850
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46856
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46864
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46868
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46870
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46876
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46888
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46926
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46974
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47016
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47038
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47050
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55896
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47068
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55912
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55920
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47080
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55930
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47096
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55938
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55950
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47108
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55962
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47132
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55978
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55994
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47152
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56002
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47170
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56018
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56028
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47186
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56040
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47206
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56052
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47220
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56058
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56066
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47228
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56072
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47242
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56084
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56094
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56104
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56112
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56120
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56124
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56130
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56132
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56138
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56142
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56148
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39706
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39724
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39742
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39764
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39778
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39784
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39792
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39806
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39814
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39822
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39832
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39840
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39850
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39862
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39876
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39890
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39902
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39916
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39926
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39940
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39950
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39960
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39976
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39982
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39992
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40014
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40028
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40042
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55436
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55444
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55448
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55454
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55478
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55488
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55502
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55592
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55616
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55620
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55624
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55626
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55628
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55634
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55640
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55644
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55648
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55654
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55658
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55662
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55666
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55668
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55676
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55680
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55686
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55690
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55692
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55702
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:39008 -> 45.95.169.139:9372
    Source: /tmp/XXJn52htu2 (PID: 6232)Socket: 0.0.0.0::23Jump to behavior
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 122.0.158.161
    Source: unknownTCP traffic detected without corresponding DNS query: 211.203.136.146
    Source: unknownTCP traffic detected without corresponding DNS query: 199.24.241.161
    Source: unknownTCP traffic detected without corresponding DNS query: 11.81.186.40
    Source: unknownTCP traffic detected without corresponding DNS query: 142.22.63.151
    Source: unknownTCP traffic detected without corresponding DNS query: 201.111.117.161
    Source: unknownTCP traffic detected without corresponding DNS query: 245.70.95.44
    Source: unknownTCP traffic detected without corresponding DNS query: 160.186.70.145
    Source: unknownTCP traffic detected without corresponding DNS query: 87.208.104.49
    Source: unknownTCP traffic detected without corresponding DNS query: 80.118.85.229
    Source: unknownTCP traffic detected without corresponding DNS query: 154.226.177.91
    Source: unknownTCP traffic detected without corresponding DNS query: 139.39.11.170
    Source: unknownTCP traffic detected without corresponding DNS query: 50.119.88.186
    Source: unknownTCP traffic detected without corresponding DNS query: 57.39.122.241
    Source: unknownTCP traffic detected without corresponding DNS query: 179.92.218.233
    Source: unknownTCP traffic detected without corresponding DNS query: 192.2.52.239
    Source: unknownTCP traffic detected without corresponding DNS query: 170.154.44.19
    Source: unknownTCP traffic detected without corresponding DNS query: 208.135.157.183
    Source: unknownTCP traffic detected without corresponding DNS query: 136.231.26.249
    Source: unknownTCP traffic detected without corresponding DNS query: 168.137.3.138
    Source: unknownTCP traffic detected without corresponding DNS query: 84.207.202.190
    Source: unknownTCP traffic detected without corresponding DNS query: 103.180.31.65
    Source: unknownTCP traffic detected without corresponding DNS query: 25.54.253.223
    Source: unknownTCP traffic detected without corresponding DNS query: 145.100.172.71
    Source: unknownTCP traffic detected without corresponding DNS query: 208.197.30.102
    Source: unknownTCP traffic detected without corresponding DNS query: 31.4.175.86
    Source: unknownTCP traffic detected without corresponding DNS query: 66.36.26.208
    Source: unknownTCP traffic detected without corresponding DNS query: 45.176.38.252
    Source: unknownTCP traffic detected without corresponding DNS query: 126.183.46.170
    Source: unknownTCP traffic detected without corresponding DNS query: 55.244.185.231
    Source: unknownTCP traffic detected without corresponding DNS query: 188.71.245.179
    Source: unknownTCP traffic detected without corresponding DNS query: 252.190.207.69
    Source: unknownTCP traffic detected without corresponding DNS query: 30.140.182.234
    Source: unknownTCP traffic detected without corresponding DNS query: 56.164.151.198
    Source: unknownTCP traffic detected without corresponding DNS query: 94.48.255.46
    Source: unknownTCP traffic detected without corresponding DNS query: 95.29.72.147
    Source: unknownTCP traffic detected without corresponding DNS query: 120.244.168.45
    Source: unknownTCP traffic detected without corresponding DNS query: 67.78.56.166
    Source: unknownTCP traffic detected without corresponding DNS query: 134.0.17.139
    Source: unknownTCP traffic detected without corresponding DNS query: 255.243.125.123
    Source: unknownTCP traffic detected without corresponding DNS query: 16.191.64.49
    Source: unknownTCP traffic detected without corresponding DNS query: 57.112.87.60
    Source: unknownTCP traffic detected without corresponding DNS query: 140.125.213.189
    Source: unknownTCP traffic detected without corresponding DNS query: 197.241.3.59
    Source: unknownTCP traffic detected without corresponding DNS query: 31.94.69.168
    Source: unknownTCP traffic detected without corresponding DNS query: 51.55.160.179
    Source: unknownTCP traffic detected without corresponding DNS query: 134.45.19.66
    Source: unknownTCP traffic detected without corresponding DNS query: 220.160.12.84
    Source: unknownTCP traffic detected without corresponding DNS query: 164.81.187.191
    Source: unknownTCP traffic detected without corresponding DNS query: 186.213.159.243
    Source: XXJn52htu2String found in binary or memory: http://upx.sf.net

    System Summary

    barindex
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 658, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 772, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 789, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 904, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1320, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1389, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1463, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1465, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1576, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1809, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1888, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1890, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1983, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 2048, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 2062, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 6044, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 6188, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 6227, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 6237, result: successfulJump to behavior
    Source: LOAD without section mappingsProgram segment: 0x8000
    Source: XXJn52htu2, type: SAMPLEMatched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 658, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 772, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 789, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 904, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1320, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1389, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1463, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1465, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1576, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1809, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1888, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1890, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 1983, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 2048, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 2062, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 6044, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 6188, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 6227, result: successfulJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)SIGKILL sent: pid: 6237, result: successfulJump to behavior
    Source: classification engineClassification label: mal68.spre.troj.evad.lin@0/0@0/0

    Data Obfuscation

    barindex
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/6233/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1582/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2033/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2275/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/3088/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1612/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1579/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1699/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1335/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1698/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2028/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1334/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1576/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2302/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/3236/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2025/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2146/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/910/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/6227/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/912/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/517/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/759/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2307/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/918/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1594/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2285/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2281/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1349/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1623/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/761/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1622/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/884/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1983/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2038/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1344/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1465/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1586/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1463/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2156/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/800/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/801/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/6237/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1629/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1627/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1900/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/3021/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/491/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2294/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2050/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1877/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/772/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1633/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1599/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1632/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/774/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1477/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/654/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/896/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1476/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1872/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2048/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/655/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1475/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2289/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/656/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/777/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/657/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/4466/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/658/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/4467/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/4468/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/4469/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/419/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/936/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1639/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1638/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2208/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2180/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1809/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1494/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1890/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2063/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2062/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1888/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1886/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/420/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1489/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/785/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1642/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/788/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/667/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/789/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1648/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/6155/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/4494/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/4497/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2078/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2077/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2074/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2195/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/670/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/4490/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/2746/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/793/exeJump to behavior
    Source: /tmp/XXJn52htu2 (PID: 6232)File opened: /proc/1656/exeJump to behavior

    Hooking and other Techniques for Hiding and Protection

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46838
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46842
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46844
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46846
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46850
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46856
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46864
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46868
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46870
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46876
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46888
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46926
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46974
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47016
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47038
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47050
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55896
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47068
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55912
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55920
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47080
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55930
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47096
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55938
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55950
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47108
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55962
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47132
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55978
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55994
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47152
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56002
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47170
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56018
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56028
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47186
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56040
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47206
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56052
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47220
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56058
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56066
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47228
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56072
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47242
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56084
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56094
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56104
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56112
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56120
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56124
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56130
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56132
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56138
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56142
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 56148
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39706
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39724
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39742
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39764
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39778
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39784
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39792
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39806
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39814
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39822
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39832
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39840
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39850
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39862
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39876
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39890
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39902
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39916
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39926
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39940
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39950
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39960
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39976
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39982
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39992
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40014
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40028
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40042
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55436
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55444
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55448
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55454
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55478
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55488
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55502
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55592
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55616
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55620
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55624
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55626
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55628
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55634
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55640
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55644
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55648
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55654
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55658
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55662
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55666
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55668
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55676
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55680
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55686
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55690
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55692
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55702
    Source: /tmp/XXJn52htu2 (PID: 6225)Queries kernel information via 'uname': Jump to behavior
    Source: XXJn52htu2, 6225.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6227.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6228.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6235.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6237.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
    Source: XXJn52htu2, 6225.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6227.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6228.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6235.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6237.1.00000000300c4d64.000000006603961e.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/XXJn52htu2SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/XXJn52htu2
    Source: XXJn52htu2, 6225.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6227.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6228.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6235.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6237.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
    Source: XXJn52htu2, 6225.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6227.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6228.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6235.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6237.1.00000000300c4d64.000000006603961e.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP
    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
    Obfuscated Files or Information
    1
    OS Credential Dumping
    11
    Security Software Discovery
    Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel
    Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
    Service Stop
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
    Non-Standard Port
    Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol
    Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files