Edit tour

Linux Analysis Report
XXJn52htu2

Overview

General Information

Sample Name:	XXJn52htu2
Analysis ID:	635401
MD5:	214bc7a11120145241f962afdb35bab1
SHA1:	bc997a8ce1456d17b56bbf3eede98a160d4b42f0
SHA256:	ff54b59b11d8a639c26411d069a74c6f9493bcff1226b0c7785f092c489fa7fe
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Uses known network protocols on non-standard ports

Sample tries to kill multiple processes (SIGKILL)

Sample contains only a LOAD segment without any section mappings

Yara signature match

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	635401
Start date and time: 27/05/202221:07:46	2022-05-27 21:07:46 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 42s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	XXJn52htu2
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal68.spre.troj.evad.lin@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100

Runtime Messages

Command:	/tmp/XXJn52htu2
PID:	6225
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Infected
Standard Error:

Process Tree

system is lnxubuntu20

XXJn52htu2 (PID: 6225, Parent: 6123, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/XXJn52htu2

XXJn52htu2 New Fork (PID: 6227, Parent: 6225)

XXJn52htu2 New Fork (PID: 6228, Parent: 6225)

XXJn52htu2 New Fork (PID: 6232, Parent: 6228)

XXJn52htu2 New Fork (PID: 6235, Parent: 6228)

XXJn52htu2 New Fork (PID: 6237, Parent: 6235)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
XXJn52htu2	SUSP_ELF_LNX_UPX_Compressed_File	Detects a suspicious ELF binary with UPX compression	Florian Roth	0x8e60:$s1: PROT_EXEC\|PROT_WRITE failed. 0x8ecf:$s2: $Id: UPX 0x8e80:$s3: $Info: This file is packed with the UPX executable packer

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: XXJn52htu2	Virustotal: Detection: 16%			Perma Link
Source: XXJn52htu2	ReversingLabs: Detection: 20%

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46838
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46842
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46844
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46846
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46850
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46856
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46864
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46868
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46870
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46876
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46888
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46926
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46974
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47016
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47038
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47050
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55896
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47068
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55912
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55920
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47080
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55930
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47096
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55938
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55950
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47108
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55962
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47132
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55978
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55994
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47152
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56002
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47170
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56018
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56028
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47186
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56040
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47206
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56052
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47220
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56058
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56066
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47228
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56072
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47242
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56084
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56094
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56104
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56112
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56120
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56124
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56130
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56132
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56138
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56142
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56148
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39706
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39724
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39742
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39764
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39778
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39784
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39792
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39806
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39814
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39822
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39832
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39840
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39850
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39862
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39876
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39890
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39902
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39916
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39926
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39940
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39950
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39960
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39976
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39982
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39992
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40014
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40028
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40042
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55436
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55444
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55448
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55454
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55478
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55488
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55502
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55592
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55616
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55620
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55624
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55626
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55628
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55634
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55640
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55644
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55648
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55654
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55658
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55662
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55666
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55668
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55676
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55680
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55686
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55690
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55692
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55702

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:39008 -> 45.95.169.139:9372

Source: /tmp/XXJn52htu2 (PID: 6232)

Socket: 0.0.0.0::23

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 122.0.158.161
Source: unknown	TCP traffic detected without corresponding DNS query: 211.203.136.146
Source: unknown	TCP traffic detected without corresponding DNS query: 199.24.241.161
Source: unknown	TCP traffic detected without corresponding DNS query: 11.81.186.40
Source: unknown	TCP traffic detected without corresponding DNS query: 142.22.63.151
Source: unknown	TCP traffic detected without corresponding DNS query: 201.111.117.161
Source: unknown	TCP traffic detected without corresponding DNS query: 245.70.95.44
Source: unknown	TCP traffic detected without corresponding DNS query: 160.186.70.145
Source: unknown	TCP traffic detected without corresponding DNS query: 87.208.104.49
Source: unknown	TCP traffic detected without corresponding DNS query: 80.118.85.229
Source: unknown	TCP traffic detected without corresponding DNS query: 154.226.177.91
Source: unknown	TCP traffic detected without corresponding DNS query: 139.39.11.170
Source: unknown	TCP traffic detected without corresponding DNS query: 50.119.88.186
Source: unknown	TCP traffic detected without corresponding DNS query: 57.39.122.241
Source: unknown	TCP traffic detected without corresponding DNS query: 179.92.218.233
Source: unknown	TCP traffic detected without corresponding DNS query: 192.2.52.239
Source: unknown	TCP traffic detected without corresponding DNS query: 170.154.44.19
Source: unknown	TCP traffic detected without corresponding DNS query: 208.135.157.183
Source: unknown	TCP traffic detected without corresponding DNS query: 136.231.26.249
Source: unknown	TCP traffic detected without corresponding DNS query: 168.137.3.138
Source: unknown	TCP traffic detected without corresponding DNS query: 84.207.202.190
Source: unknown	TCP traffic detected without corresponding DNS query: 103.180.31.65
Source: unknown	TCP traffic detected without corresponding DNS query: 25.54.253.223
Source: unknown	TCP traffic detected without corresponding DNS query: 145.100.172.71
Source: unknown	TCP traffic detected without corresponding DNS query: 208.197.30.102
Source: unknown	TCP traffic detected without corresponding DNS query: 31.4.175.86
Source: unknown	TCP traffic detected without corresponding DNS query: 66.36.26.208
Source: unknown	TCP traffic detected without corresponding DNS query: 45.176.38.252
Source: unknown	TCP traffic detected without corresponding DNS query: 126.183.46.170
Source: unknown	TCP traffic detected without corresponding DNS query: 55.244.185.231
Source: unknown	TCP traffic detected without corresponding DNS query: 188.71.245.179
Source: unknown	TCP traffic detected without corresponding DNS query: 252.190.207.69
Source: unknown	TCP traffic detected without corresponding DNS query: 30.140.182.234
Source: unknown	TCP traffic detected without corresponding DNS query: 56.164.151.198
Source: unknown	TCP traffic detected without corresponding DNS query: 94.48.255.46
Source: unknown	TCP traffic detected without corresponding DNS query: 95.29.72.147
Source: unknown	TCP traffic detected without corresponding DNS query: 120.244.168.45
Source: unknown	TCP traffic detected without corresponding DNS query: 67.78.56.166
Source: unknown	TCP traffic detected without corresponding DNS query: 134.0.17.139
Source: unknown	TCP traffic detected without corresponding DNS query: 255.243.125.123
Source: unknown	TCP traffic detected without corresponding DNS query: 16.191.64.49
Source: unknown	TCP traffic detected without corresponding DNS query: 57.112.87.60
Source: unknown	TCP traffic detected without corresponding DNS query: 140.125.213.189
Source: unknown	TCP traffic detected without corresponding DNS query: 197.241.3.59
Source: unknown	TCP traffic detected without corresponding DNS query: 31.94.69.168
Source: unknown	TCP traffic detected without corresponding DNS query: 51.55.160.179
Source: unknown	TCP traffic detected without corresponding DNS query: 134.45.19.66
Source: unknown	TCP traffic detected without corresponding DNS query: 220.160.12.84
Source: unknown	TCP traffic detected without corresponding DNS query: 164.81.187.191
Source: unknown	TCP traffic detected without corresponding DNS query: 186.213.159.243

Source: XXJn52htu2

String found in binary or memory: http://upx.sf.net

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 658, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 720, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 759, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 772, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 789, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 800, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 904, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1320, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1334, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1335, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1389, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1463, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1465, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1576, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1809, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1872, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1888, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1890, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1983, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 2048, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 2062, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 6044, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 6188, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 6227, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 6237, result: successful

Source: LOAD without section mappings

Program segment: 0x8000

Source: XXJn52htu2, type: SAMPLE

Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4

Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 658, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 720, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 759, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 772, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 789, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 800, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 904, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1320, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1334, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1335, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1389, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1463, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1465, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1576, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1809, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1872, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1888, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1890, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 1983, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 2048, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 2062, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 6044, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 6188, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 6227, result: successful
Source: /tmp/XXJn52htu2 (PID: 6232)	SIGKILL sent: pid: 6237, result: successful

Source: classification engine

Classification label: mal68.spre.troj.evad.lin@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/6233/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1582/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2033/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2275/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/3088/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1612/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1579/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1699/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1335/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1698/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2028/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1334/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1576/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2302/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/3236/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2025/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2146/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/910/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/6227/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/912/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/517/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/759/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2307/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/918/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1594/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2285/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2281/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1349/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1623/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/761/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1622/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/884/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1983/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2038/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1344/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1465/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1586/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1463/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2156/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/800/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/801/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/6237/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1629/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1627/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1900/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/3021/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/491/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2294/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2050/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1877/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/772/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1633/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1599/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1632/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/774/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1477/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/654/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/896/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1476/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1872/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2048/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/655/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1475/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2289/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/656/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/777/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/657/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/4466/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/658/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/4467/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/4468/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/4469/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/419/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/936/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1639/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1638/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2208/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2180/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1809/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1494/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1890/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2063/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2062/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1888/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1886/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/420/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1489/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/785/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1642/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/788/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/667/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/789/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1648/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/6155/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/4494/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/4497/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2078/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2077/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2074/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2195/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/670/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/4490/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/2746/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/793/exe
Source: /tmp/XXJn52htu2 (PID: 6232)	File opened: /proc/1656/exe

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46838
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46842
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46844
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46846
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46850
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46856
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46864
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46868
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46870
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46876
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46888
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46926
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46974
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47016
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47038
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47050
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55896
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47068
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55912
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55920
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47080
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55930
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47096
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55938
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55950
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47108
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55962
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47132
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55978
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55994
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47152
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56002
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47170
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56018
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56028
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47186
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56040
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47206
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56052
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47220
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56058
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56066
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47228
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56072
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47242
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56084
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56094
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56104
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56112
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56120
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56124
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56130
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56132
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56138
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56142
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56148
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39706
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39724
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39742
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39764
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39778
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39784
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39792
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39806
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39814
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39822
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39832
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39840
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39850
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39862
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39876
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39890
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39902
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39916
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39926
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39940
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39950
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39960
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39976
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39982
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39992
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40014
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40028
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40042
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55436
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55444
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55448
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55454
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55478
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55488
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55502
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55592
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55616
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55620
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55624
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55626
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55628
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55634
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55640
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55644
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55648
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55654
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55658
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55662
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55666
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55668
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55676
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55680
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55686
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55690
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55692
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55702

Source: /tmp/XXJn52htu2 (PID: 6225)

Queries kernel information via 'uname':

Source: XXJn52htu2, 6225.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6227.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6228.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6235.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6237.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: XXJn52htu2, 6225.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6227.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6228.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6235.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6237.1.00000000300c4d64.000000006603961e.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/XXJn52htu2SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/XXJn52htu2
Source: XXJn52htu2, 6225.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6227.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6228.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6235.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp, XXJn52htu2, 6237.1.00000000b3c9309f.0000000091d7eb6b.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: XXJn52htu2, 6225.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6227.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6228.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6235.1.00000000300c4d64.000000006603961e.rw-.sdmp, XXJn52htu2, 6237.1.00000000300c4d64.000000006603961e.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Service Stop
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
XXJn52htu2	17%	Virustotal		Browse
XXJn52htu2	20%	ReversingLabs	Linux.Trojan.Mirai

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	XXJn52htu2	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
51.223.227.122	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
50.240.247.180	unknown	United States	7922	COMCAST-7922US	false
119.49.253.58	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
208.122.171.23	unknown	United States	46476	TTUHSCUS	false
246.246.200.243	unknown	Reserved	unknown	unknown	false
206.126.23.139	unknown	United States	23265	POCKETINETUS	false
181.136.190.145	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	false
98.252.105.154	unknown	United States	7922	COMCAST-7922US	false
203.85.146.105	unknown	Hong Kong	4058	CITICTEL-CPC-AS4058CITICTelecomInternationalCPCLimited	false
186.49.156.123	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	false
185.21.137.210	unknown	Iraq	209565	ALSARDFIBERIQ	false
243.14.153.5	unknown	Reserved	unknown	unknown	false
88.214.61.218	unknown	Bosnia and Herzegowina	47959	TELINEABA	false
48.151.193.96	unknown	United States	2686	ATGS-MMD-ASUS	false
209.86.139.209	unknown	United States	7029	WINDSTREAMUS	false
71.207.148.144	unknown	United States	7922	COMCAST-7922US	false
124.2.228.15	unknown	Korea Republic of	18302	SKG_NW-AS-KRSKTelecomKR	false
192.70.138.77	unknown	United States	2200	FR-RENATERReseauNationaldetelecommunicationspourlaTec	false
55.26.142.22	unknown	United States	319	DNIC-ASBLK-00306-00371US	false
138.207.110.63	unknown	United States	396368	TETHERVIEWUS	false
69.42.86.136	unknown	United States	27257	WEBAIR-INTERNETUS	false
131.109.171.204	unknown	United States	14464	RINETUS	false
208.29.80.111	unknown	United States	1239	SPRINTLINKUS	false
200.6.57.233	unknown	Curacao	11081	UnitedTelecommunicationServicesUTSCW	false
46.208.236.8	unknown	United Kingdom	6871	PLUSNETUKInternetServiceProviderGB	false
73.215.212.60	unknown	United States	7922	COMCAST-7922US	false
198.11.206.99	unknown	United States	36351	SOFTLAYERUS	false
151.32.206.187	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
117.161.54.243	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
222.13.19.27	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
110.244.101.149	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
52.246.95.187	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
217.165.155.168	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
21.75.220.138	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
78.64.186.144	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
212.143.81.73	unknown	Israel	1680	NV-ASNCELLCOMltdIL	false
176.29.233.108	unknown	Jordan	20773	GODADDYDE	false
139.63.130.160	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
195.82.203.156	unknown	Denmark	9158	TELENOR_DANMARK_ASDK	false
7.103.157.233	unknown	United States	3356	LEVEL3US	false
101.209.22.32	unknown	India	58519	CHINATELECOM-CTCLOUDCloudComputingCorporationCN	false
73.90.89.90	unknown	United States	7922	COMCAST-7922US	false
197.26.6.244	unknown	Tunisia	37492	ORANGE-TN	false
60.168.15.60	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
161.32.117.152	unknown	United States	14340	SALESFORCEUS	false
191.104.108.95	unknown	Colombia	61317	ASDETUKhttpwwwheficedcomGB	false
111.55.29.14	unknown	China	56042	CMNET-SHANXI-APChinaMobilecommunicationscorporationCN	false
98.61.107.114	unknown	United States	7922	COMCAST-7922US	false
245.240.114.75	unknown	Reserved	unknown	unknown	false
190.117.210.173	unknown	Peru	12252	AmericaMovilPeruSACPE	false
46.217.76.226	unknown	Macedonia	6821	MT-AS-OWNbulOrceNikolovbbMK	false
79.179.215.246	unknown	Israel	8551	BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL	false
202.249.239.93	unknown	Japan	2506	SUPERCSINTTWESTCHUGOKUCORPORATIONJP	false
114.55.242.143	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
48.142.166.161	unknown	United States	2686	ATGS-MMD-ASUS	false
108.77.188.45	unknown	United States	7018	ATT-INTERNET4US	false
151.86.44.179	unknown	Italy	8217	ASN-ENIIT	false
27.161.81.28	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
28.169.115.88	unknown	United States	7922	COMCAST-7922US	false
73.43.54.233	unknown	United States	7922	COMCAST-7922US	false
183.87.69.237	unknown	India	45194	SIPL-ASSysconInfowayPvtLtdIN	false
240.240.180.215	unknown	Reserved	unknown	unknown	false
153.10.223.13	unknown	United States	22063	UNASSIGNED	false
128.222.21.6	unknown	United States	5723	JHUUS	false
88.10.111.96	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
138.83.39.54	unknown	United States	58611	CDU-AS-APCharlesDarwinUniversityAU	false
212.203.107.179	unknown	Switzerland	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
1.31.84.172	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
223.23.20.175	unknown	Taiwan; Republic of China (ROC)	17709	APTAsiaPacificTelecomTW	false
246.92.208.130	unknown	Reserved	unknown	unknown	false
92.162.65.172	unknown	France	3215	FranceTelecom-OrangeFR	false
59.73.212.81	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
32.88.158.219	unknown	United States	2686	ATGS-MMD-ASUS	false
112.192.74.37	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
203.14.225.221	unknown	Australia	7546	DREAMTILT-APDreamtiltServiceProviderGladstoneAU	false
39.148.239.5	unknown	China	24445	CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN	false
86.160.170.246	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
203.108.203.190	unknown	Australia	703	UUNETUS	false
161.39.253.184	unknown	United States	33039	EDMC-INTERNETUS	false
99.189.112.208	unknown	United States	7018	ATT-INTERNET4US	false
42.30.66.54	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
49.93.214.49	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
136.45.143.198	unknown	United States	16591	GOOGLE-FIBERUS	false
194.195.203.136	unknown	Germany	6659	NEXINTO-DE	false
86.33.220.221	unknown	Austria	5089	NTLGB	false
157.141.165.146	unknown	United States	27064	DNIC-ASBLK-27032-27159US	false
163.49.121.212	unknown	Japan	2497	IIJInternetInitiativeJapanIncJP	false
12.215.219.28	unknown	United States	7018	ATT-INTERNET4US	false
188.194.192.24	unknown	Germany	31334	KABELDEUTSCHLAND-ASDE	false
175.94.80.103	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
180.131.146.88	unknown	Indonesia	45719	NAWALA-AS-IDNawalaProject-DNSFilteringProjectID	false
252.70.145.142	unknown	Reserved	unknown	unknown	false
24.167.176.22	unknown	United States	11426	TWC-11426-CAROLINASUS	false
42.12.204.143	unknown	Korea Republic of	4249	LILLY-ASUS	false
28.108.249.218	unknown	United States	7922	COMCAST-7922US	false
190.39.145.49	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	false
188.0.171.238	unknown	Russian Federation	49724	VAINAHTELECOM-ASRU	false
46.242.31.24	unknown	Russian Federation	42610	NCNET-ASRU	false
130.200.191.155	unknown	United States	137	ASGARRConsortiumGARREU	false
153.206.128.250	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	7.966088580361416
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	XXJn52htu2
File size:	38440
MD5:	214bc7a11120145241f962afdb35bab1
SHA1:	bc997a8ce1456d17b56bbf3eede98a160d4b42f0
SHA256:	ff54b59b11d8a639c26411d069a74c6f9493bcff1226b0c7785f092c489fa7fe
SHA512:	a587cbd681ee8f5a280c68092db35721572398a10dd43d3b418e7a7a3008fee3b628ffecf1f58f7b02ee94c285784ebb2c73947820414cba32ae72c6ebebd6ce
SSDEEP:	768:kufCsecOTPyhmevGNpBJy2OZAXsGOjtoR5JwEzus3UozV:NCtcKBevGNpPy2OZAXsGKOR5JwuTzV
TLSH:	FC03F224DB827D12CE705B35E616CB46E7F51AE4E4E9B37C2691E098E0C391E4D3530A
File Content Preview:	.ELF...a..........(.........4...........4. ...(.....................?...?...........................................Q.td................................UPX!.........:...:......S..........?.E.h;.}...^..........e..G....I..u.].r...fqk.w..j6.7...c;.....N....f

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x10390
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0x953f	0x953f	4.0189	0x5	R E	0x8000
LOAD	0x1c00	0x29c00	0x29c00	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 21:08:31.995589972 CEST	34874	23	192.168.2.23	122.0.158.161
May 27, 2022 21:08:31.995644093 CEST	34874	23	192.168.2.23	211.203.136.146
May 27, 2022 21:08:31.995647907 CEST	34874	23	192.168.2.23	199.24.241.161
May 27, 2022 21:08:31.995676041 CEST	34874	23	192.168.2.23	11.81.186.40
May 27, 2022 21:08:31.995692968 CEST	34874	23	192.168.2.23	142.22.63.151
May 27, 2022 21:08:31.995698929 CEST	34874	23	192.168.2.23	201.111.117.161
May 27, 2022 21:08:31.995704889 CEST	34874	23	192.168.2.23	245.70.95.44
May 27, 2022 21:08:31.995707989 CEST	34874	23	192.168.2.23	160.186.70.145
May 27, 2022 21:08:31.995712996 CEST	34874	23	192.168.2.23	87.208.104.49
May 27, 2022 21:08:31.995748043 CEST	34874	23	192.168.2.23	80.118.85.229
May 27, 2022 21:08:31.995755911 CEST	34874	23	192.168.2.23	154.226.177.91
May 27, 2022 21:08:31.995762110 CEST	34874	23	192.168.2.23	139.39.11.170
May 27, 2022 21:08:31.995767117 CEST	34874	23	192.168.2.23	50.119.88.186
May 27, 2022 21:08:31.995775938 CEST	34874	23	192.168.2.23	57.39.122.241
May 27, 2022 21:08:31.995794058 CEST	34874	23	192.168.2.23	179.92.218.233
May 27, 2022 21:08:31.995811939 CEST	34874	23	192.168.2.23	192.2.52.239
May 27, 2022 21:08:31.995814085 CEST	34874	23	192.168.2.23	170.154.44.19
May 27, 2022 21:08:31.995820045 CEST	34874	23	192.168.2.23	208.135.157.183
May 27, 2022 21:08:31.995830059 CEST	34874	23	192.168.2.23	136.231.26.249
May 27, 2022 21:08:31.995872021 CEST	34874	23	192.168.2.23	168.137.3.138
May 27, 2022 21:08:31.995877981 CEST	34874	23	192.168.2.23	84.207.202.190
May 27, 2022 21:08:31.995879889 CEST	34874	23	192.168.2.23	103.180.31.65
May 27, 2022 21:08:31.995881081 CEST	34874	23	192.168.2.23	25.54.253.223
May 27, 2022 21:08:31.995887995 CEST	34874	23	192.168.2.23	145.100.172.71
May 27, 2022 21:08:31.995889902 CEST	34874	23	192.168.2.23	208.197.30.102
May 27, 2022 21:08:31.995896101 CEST	34874	23	192.168.2.23	31.4.175.86
May 27, 2022 21:08:31.995897055 CEST	34874	23	192.168.2.23	10.45.214.198
May 27, 2022 21:08:31.995897055 CEST	34874	23	192.168.2.23	66.36.26.208
May 27, 2022 21:08:31.995898008 CEST	34874	23	192.168.2.23	45.176.38.252
May 27, 2022 21:08:31.995898962 CEST	34874	23	192.168.2.23	126.183.46.170
May 27, 2022 21:08:31.995901108 CEST	34874	23	192.168.2.23	55.244.185.231
May 27, 2022 21:08:31.995902061 CEST	34874	23	192.168.2.23	188.71.245.179
May 27, 2022 21:08:31.995924950 CEST	34874	23	192.168.2.23	252.190.207.69
May 27, 2022 21:08:31.995924950 CEST	34874	23	192.168.2.23	30.140.182.234
May 27, 2022 21:08:31.995930910 CEST	34874	23	192.168.2.23	56.164.151.198
May 27, 2022 21:08:31.995934963 CEST	34874	23	192.168.2.23	94.48.255.46
May 27, 2022 21:08:31.995944023 CEST	34874	23	192.168.2.23	95.29.72.147
May 27, 2022 21:08:31.995945930 CEST	34874	23	192.168.2.23	120.244.168.45
May 27, 2022 21:08:31.995950937 CEST	34874	23	192.168.2.23	67.78.56.166
May 27, 2022 21:08:31.995955944 CEST	34874	23	192.168.2.23	134.0.17.139
May 27, 2022 21:08:31.995958090 CEST	34874	23	192.168.2.23	255.243.125.123
May 27, 2022 21:08:31.995960951 CEST	34874	23	192.168.2.23	16.191.64.49
May 27, 2022 21:08:31.995960951 CEST	34874	23	192.168.2.23	57.112.87.60
May 27, 2022 21:08:31.995961905 CEST	34874	23	192.168.2.23	140.125.213.189
May 27, 2022 21:08:31.995965004 CEST	34874	23	192.168.2.23	197.241.3.59
May 27, 2022 21:08:31.995969057 CEST	34874	23	192.168.2.23	31.94.69.168
May 27, 2022 21:08:31.995970011 CEST	34874	23	192.168.2.23	51.55.160.179
May 27, 2022 21:08:31.995974064 CEST	34874	23	192.168.2.23	134.45.19.66
May 27, 2022 21:08:31.995976925 CEST	34874	23	192.168.2.23	67.225.10.106
May 27, 2022 21:08:31.995986938 CEST	34874	23	192.168.2.23	220.160.12.84
May 27, 2022 21:08:31.995990992 CEST	34874	23	192.168.2.23	164.81.187.191
May 27, 2022 21:08:31.995995045 CEST	34874	23	192.168.2.23	186.213.159.243
May 27, 2022 21:08:31.995996952 CEST	34874	23	192.168.2.23	92.204.52.0
May 27, 2022 21:08:31.996001005 CEST	34874	23	192.168.2.23	41.251.221.49
May 27, 2022 21:08:31.996004105 CEST	34874	23	192.168.2.23	240.230.121.93
May 27, 2022 21:08:31.996006966 CEST	34874	23	192.168.2.23	31.57.62.100
May 27, 2022 21:08:31.996006966 CEST	34874	23	192.168.2.23	211.103.254.239
May 27, 2022 21:08:31.996010065 CEST	34874	23	192.168.2.23	1.175.25.160
May 27, 2022 21:08:31.996016979 CEST	34874	23	192.168.2.23	190.19.194.43
May 27, 2022 21:08:31.996018887 CEST	34874	23	192.168.2.23	11.79.51.32
May 27, 2022 21:08:31.996031046 CEST	34874	23	192.168.2.23	212.130.172.12
May 27, 2022 21:08:31.996032000 CEST	34874	23	192.168.2.23	60.154.88.153
May 27, 2022 21:08:31.996036053 CEST	34874	23	192.168.2.23	97.102.25.153
May 27, 2022 21:08:31.996037960 CEST	34874	23	192.168.2.23	137.22.200.227
May 27, 2022 21:08:31.996047020 CEST	34874	23	192.168.2.23	119.70.217.183
May 27, 2022 21:08:31.996051073 CEST	34874	23	192.168.2.23	71.69.166.204
May 27, 2022 21:08:31.996054888 CEST	34874	23	192.168.2.23	186.117.45.157
May 27, 2022 21:08:31.996062040 CEST	34874	23	192.168.2.23	196.87.243.25
May 27, 2022 21:08:31.996063948 CEST	34874	23	192.168.2.23	48.126.61.204
May 27, 2022 21:08:31.996068954 CEST	34874	23	192.168.2.23	102.167.15.79
May 27, 2022 21:08:31.996073961 CEST	34874	23	192.168.2.23	80.28.1.74
May 27, 2022 21:08:31.996076107 CEST	34874	23	192.168.2.23	210.120.111.45
May 27, 2022 21:08:31.996077061 CEST	34874	23	192.168.2.23	91.63.61.107
May 27, 2022 21:08:31.996087074 CEST	34874	23	192.168.2.23	249.5.55.13
May 27, 2022 21:08:31.996087074 CEST	34874	23	192.168.2.23	159.83.123.23
May 27, 2022 21:08:31.996088028 CEST	34874	23	192.168.2.23	207.116.76.134
May 27, 2022 21:08:31.996089935 CEST	34874	23	192.168.2.23	250.230.53.169
May 27, 2022 21:08:31.996090889 CEST	34874	23	192.168.2.23	142.91.172.153
May 27, 2022 21:08:31.996093988 CEST	34874	23	192.168.2.23	252.14.156.197
May 27, 2022 21:08:31.996098995 CEST	34874	23	192.168.2.23	251.127.181.114
May 27, 2022 21:08:31.996105909 CEST	34874	23	192.168.2.23	216.241.2.134
May 27, 2022 21:08:31.996110916 CEST	34874	23	192.168.2.23	47.66.86.95
May 27, 2022 21:08:31.996112108 CEST	34874	23	192.168.2.23	249.90.225.220
May 27, 2022 21:08:31.996112108 CEST	34874	23	192.168.2.23	151.30.33.68
May 27, 2022 21:08:31.996117115 CEST	34874	23	192.168.2.23	79.172.60.56
May 27, 2022 21:08:31.996117115 CEST	34874	23	192.168.2.23	246.133.188.32
May 27, 2022 21:08:31.996125937 CEST	34874	23	192.168.2.23	101.112.101.194
May 27, 2022 21:08:31.996126890 CEST	34874	23	192.168.2.23	94.114.78.31
May 27, 2022 21:08:31.996125937 CEST	34874	23	192.168.2.23	200.4.233.211
May 27, 2022 21:08:31.996129990 CEST	34874	23	192.168.2.23	152.59.188.65
May 27, 2022 21:08:31.996140003 CEST	34874	23	192.168.2.23	204.141.107.138
May 27, 2022 21:08:31.996140957 CEST	34874	23	192.168.2.23	75.204.75.198
May 27, 2022 21:08:31.996143103 CEST	34874	23	192.168.2.23	193.244.231.209
May 27, 2022 21:08:31.996145964 CEST	34874	23	192.168.2.23	131.183.75.133
May 27, 2022 21:08:31.996154070 CEST	34874	23	192.168.2.23	21.223.230.132
May 27, 2022 21:08:31.996159077 CEST	34874	23	192.168.2.23	12.109.157.213
May 27, 2022 21:08:31.996164083 CEST	34874	23	192.168.2.23	27.35.52.251
May 27, 2022 21:08:31.996169090 CEST	34874	23	192.168.2.23	15.77.59.2
May 27, 2022 21:08:31.996175051 CEST	34874	23	192.168.2.23	187.40.85.198
May 27, 2022 21:08:31.996180058 CEST	34874	23	192.168.2.23	136.172.232.118

System Behavior

Analysis Process: XXJn52htu2 PID: 6225, Parent PID: 6123

General

Start time:	21:08:30
Start date:	27/05/2022
Path:	/tmp/XXJn52htu2
Arguments:	/tmp/XXJn52htu2
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: XXJn52htu2 PID: 6227, Parent PID: 6225

General

Start time:	21:08:31
Start date:	27/05/2022
Path:	/tmp/XXJn52htu2
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: XXJn52htu2 PID: 6228, Parent PID: 6225

General

Start time:	21:08:31
Start date:	27/05/2022
Path:	/tmp/XXJn52htu2
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: XXJn52htu2 PID: 6232, Parent PID: 6228

General

Start time:	21:08:31
Start date:	27/05/2022
Path:	/tmp/XXJn52htu2
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: XXJn52htu2 PID: 6235, Parent PID: 6228

General

Start time:	21:08:31
Start date:	27/05/2022
Path:	/tmp/XXJn52htu2
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: XXJn52htu2 PID: 6237, Parent PID: 6235

General

Start time:	21:08:31
Start date:	27/05/2022
Path:	/tmp/XXJn52htu2
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	API monitoring, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report XXJn52htu2

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: XXJn52htu2 PID: 6225, Parent PID: 6123

General

Analysis Process: XXJn52htu2 PID: 6227, Parent PID: 6225

General

Analysis Process: XXJn52htu2 PID: 6228, Parent PID: 6225

General

Analysis Process: XXJn52htu2 PID: 6232, Parent PID: 6228

General

Analysis Process: XXJn52htu2 PID: 6235, Parent PID: 6228

General

Analysis Process: XXJn52htu2 PID: 6237, Parent PID: 6235

General

Linux Analysis Report
XXJn52htu2