Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
gmjJxVFJKQ

Overview

General Information

Sample Name:gmjJxVFJKQ
Analysis ID:635404
MD5:a8fbc7563fe019ca689573d43d7797f3
SHA1:d9842c2d31a7357d8c92414edbff9e60fce317b2
SHA256:e92cdc162e5091c4916d12d2f4a5f7e7e9ffdb4dae8a18427d81f97ed08edcef
Tags:32elfmipsmirai
Infos:

Detection

Mirai
Score:68
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample tries to kill multiple processes (SIGKILL)
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:635404
Start date and time: 27/05/202221:12:132022-05-27 21:12:13 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 6m 2s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:gmjJxVFJKQ
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal68.spre.troj.evad.lin@0/0@0/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Runtime Messages

Command:/tmp/gmjJxVFJKQ
PID:6223
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Infected
Standard Error:

Process Tree

  • system is lnxubuntu20
  • gmjJxVFJKQ (PID: 6223, Parent: 6125, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/gmjJxVFJKQ
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
gmjJxVFJKQSUSP_ELF_LNX_UPX_Compressed_FileDetects a suspicious ELF binary with UPX compressionFlorian Roth
  • 0x9ee0:$s1: PROT_EXEC|PROT_WRITE failed.
  • 0x9f4f:$s2: $Id: UPX
  • 0x9f00:$s3: $Info: This file is packed with the UPX executable packer

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for submitted file
    Source: gmjJxVFJKQVirustotal: Detection: 23%Perma Link
    Source: gmjJxVFJKQReversingLabs: Detection: 25%

    Networking

    barindex
    Uses known network protocols on non-standard ports
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34194
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34196
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34200
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34216
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34240
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34262
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34270
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34272
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34274
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34276
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34278
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34284
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34290
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34296
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34314
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34336
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34362
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34380
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34384
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34390
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34400
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34406
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34416
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34422
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34428
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34432
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34440
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34444
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:39008 -> 45.95.169.139:9372
    Source: /tmp/gmjJxVFJKQ (PID: 6231)Socket: 0.0.0.0::23
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 218.86.102.45
    Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
    Source: unknownTCP traffic detected without corresponding DNS query: 89.164.70.101
    Source: unknownTCP traffic detected without corresponding DNS query: 217.177.184.187
    Source: unknownTCP traffic detected without corresponding DNS query: 137.203.173.101
    Source: unknownTCP traffic detected without corresponding DNS query: 155.99.22.98
    Source: unknownTCP traffic detected without corresponding DNS query: 46.217.120.146
    Source: unknownTCP traffic detected without corresponding DNS query: 186.170.70.118
    Source: unknownTCP traffic detected without corresponding DNS query: 254.28.163.74
    Source: unknownTCP traffic detected without corresponding DNS query: 245.178.131.122
    Source: unknownTCP traffic detected without corresponding DNS query: 71.50.252.6
    Source: unknownTCP traffic detected without corresponding DNS query: 247.241.101.225
    Source: unknownTCP traffic detected without corresponding DNS query: 169.103.254.33
    Source: unknownTCP traffic detected without corresponding DNS query: 217.149.131.222
    Source: unknownTCP traffic detected without corresponding DNS query: 50.29.87.192
    Source: unknownTCP traffic detected without corresponding DNS query: 154.78.128.153
    Source: unknownTCP traffic detected without corresponding DNS query: 196.71.251.245
    Source: unknownTCP traffic detected without corresponding DNS query: 182.198.255.62
    Source: unknownTCP traffic detected without corresponding DNS query: 194.1.19.128
    Source: unknownTCP traffic detected without corresponding DNS query: 184.80.135.250
    Source: unknownTCP traffic detected without corresponding DNS query: 40.108.39.88
    Source: unknownTCP traffic detected without corresponding DNS query: 58.131.100.205
    Source: unknownTCP traffic detected without corresponding DNS query: 55.22.119.253
    Source: unknownTCP traffic detected without corresponding DNS query: 123.60.253.41
    Source: unknownTCP traffic detected without corresponding DNS query: 24.223.94.97
    Source: unknownTCP traffic detected without corresponding DNS query: 124.255.49.41
    Source: unknownTCP traffic detected without corresponding DNS query: 51.121.140.119
    Source: unknownTCP traffic detected without corresponding DNS query: 174.66.91.90
    Source: unknownTCP traffic detected without corresponding DNS query: 81.127.88.64
    Source: unknownTCP traffic detected without corresponding DNS query: 146.138.186.154
    Source: unknownTCP traffic detected without corresponding DNS query: 153.133.26.3
    Source: unknownTCP traffic detected without corresponding DNS query: 5.246.6.138
    Source: unknownTCP traffic detected without corresponding DNS query: 40.7.92.121
    Source: unknownTCP traffic detected without corresponding DNS query: 168.213.213.48
    Source: unknownTCP traffic detected without corresponding DNS query: 107.58.152.236
    Source: unknownTCP traffic detected without corresponding DNS query: 106.140.190.10
    Source: unknownTCP traffic detected without corresponding DNS query: 45.40.92.114
    Source: unknownTCP traffic detected without corresponding DNS query: 38.118.238.219
    Source: unknownTCP traffic detected without corresponding DNS query: 102.68.131.199
    Source: unknownTCP traffic detected without corresponding DNS query: 153.58.190.192
    Source: unknownTCP traffic detected without corresponding DNS query: 82.23.27.208
    Source: unknownTCP traffic detected without corresponding DNS query: 42.80.232.227
    Source: unknownTCP traffic detected without corresponding DNS query: 58.218.67.178
    Source: unknownTCP traffic detected without corresponding DNS query: 178.186.128.30
    Source: unknownTCP traffic detected without corresponding DNS query: 202.67.70.191
    Source: unknownTCP traffic detected without corresponding DNS query: 107.229.100.210
    Source: unknownTCP traffic detected without corresponding DNS query: 51.169.126.77
    Source: unknownTCP traffic detected without corresponding DNS query: 18.233.116.93
    Source: unknownTCP traffic detected without corresponding DNS query: 17.130.24.122
    Source: gmjJxVFJKQString found in binary or memory: http://upx.sf.net

    System Summary

    barindex
    Sample tries to kill multiple processes (SIGKILL)
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 658, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 720, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 759, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 772, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 789, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 800, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 904, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1320, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1334, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1335, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1389, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1463, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1465, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1576, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1809, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1872, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1888, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1890, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1983, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 2048, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 2062, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 6045, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 6192, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 6225, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 6235, result: successful
    Source: LOAD without section mappingsProgram segment: 0x100000
    Source: gmjJxVFJKQ, type: SAMPLEMatched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 658, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 720, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 759, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 772, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 789, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 800, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 904, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1320, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1334, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1335, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1389, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1463, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1465, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1576, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1809, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1872, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1888, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1890, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 1983, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 2048, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 2062, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 6045, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 6192, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 6225, result: successful
    Source: /tmp/gmjJxVFJKQ (PID: 6231)SIGKILL sent: pid: 6235, result: successful
    Source: classification engineClassification label: mal68.spre.troj.evad.lin@0/0@0/0

    Data Obfuscation

    barindex
    Sample is packed with UPX
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/6235/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1582/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2033/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2275/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/3088/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/6193/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/6192/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1612/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1579/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1699/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1335/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1698/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2028/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1334/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1576/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2302/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/3236/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2025/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2146/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/910/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/912/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/517/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/759/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2307/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/918/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1594/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2285/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2281/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1349/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1623/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/761/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1622/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/884/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1983/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2038/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1344/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1465/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1586/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1463/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2156/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/800/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/801/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1629/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1627/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1900/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/3021/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/491/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2294/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2050/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1877/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/772/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1633/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1599/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1632/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/774/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1477/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/654/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/896/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1476/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1872/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2048/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/655/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1475/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2289/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/656/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/777/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/657/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/4466/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/658/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/4467/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/4500/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/4468/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/4469/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/4502/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/419/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/936/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1639/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1638/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2208/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2180/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1809/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1494/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1890/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2063/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2062/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1888/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1886/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/420/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1489/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/785/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1642/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/788/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/667/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/789/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/1648/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/4492/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/6157/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2078/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2077/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2074/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2195/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/670/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/4490/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/2746/exe
    Source: /tmp/gmjJxVFJKQ (PID: 6231)File opened: /proc/793/exe

    Hooking and other Techniques for Hiding and Protection

    barindex
    Uses known network protocols on non-standard ports
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34194
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34196
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34200
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34216
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34240
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34262
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34270
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34272
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34274
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34276
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34278
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34284
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34290
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34296
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34314
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34336
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34362
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34380
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34384
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34390
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34400
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34406
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34416
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34422
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34428
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34432
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34440
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34444
    Source: /tmp/gmjJxVFJKQ (PID: 6223)Queries kernel information via 'uname':
    Source: gmjJxVFJKQ, 6223.1.0000000001028965.00000000829b0766.rw-.sdmp, gmjJxVFJKQ, 6225.1.0000000001028965.00000000829b0766.rw-.sdmp, gmjJxVFJKQ, 6226.1.0000000001028965.00000000829b0766.rw-.sdmp, gmjJxVFJKQ, 6233.1.0000000001028965.00000000829b0766.rw-.sdmp, gmjJxVFJKQ, 6235.1.0000000001028965.00000000829b0766.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
    Source: gmjJxVFJKQ, 6223.1.0000000043b059e0.00000000b73dc09b.rw-.sdmp, gmjJxVFJKQ, 6225.1.0000000043b059e0.00000000b73dc09b.rw-.sdmp, gmjJxVFJKQ, 6226.1.0000000043b059e0.00000000b73dc09b.rw-.sdmp, gmjJxVFJKQ, 6233.1.0000000043b059e0.00000000b73dc09b.rw-.sdmp, gmjJxVFJKQ, 6235.1.0000000043b059e0.00000000b73dc09b.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/gmjJxVFJKQSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/gmjJxVFJKQ
    Source: gmjJxVFJKQ, 6223.1.0000000001028965.00000000829b0766.rw-.sdmp, gmjJxVFJKQ, 6225.1.0000000001028965.00000000829b0766.rw-.sdmp, gmjJxVFJKQ, 6226.1.0000000001028965.00000000829b0766.rw-.sdmp, gmjJxVFJKQ, 6233.1.0000000001028965.00000000829b0766.rw-.sdmp, gmjJxVFJKQ, 6235.1.0000000001028965.00000000829b0766.rw-.sdmpBinary or memory string: &V!/etc/qemu-binfmt/mipsel
    Source: gmjJxVFJKQ, 6223.1.0000000043b059e0.00000000b73dc09b.rw-.sdmp, gmjJxVFJKQ, 6225.1.0000000043b059e0.00000000b73dc09b.rw-.sdmp, gmjJxVFJKQ, 6226.1.0000000043b059e0.00000000b73dc09b.rw-.sdmp, gmjJxVFJKQ, 6233.1.0000000043b059e0.00000000b73dc09b.rw-.sdmp, gmjJxVFJKQ, 6235.1.0000000043b059e0.00000000b73dc09b.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

    Stealing of Sensitive Information

    barindex
    Yara detected Mirai
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Yara detected Mirai
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
    Obfuscated Files or Information    		1
    OS Credential Dumping    		11
    Security Software Discovery    		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
    Service Stop
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
    Non-Standard Port    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol    		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

    Malware Configuration

    ⊘No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 635404 Sample: gmjJxVFJKQ Startdate: 27/05/2022 Architecture: LINUX Score: 68 22 70.46.105.145 WINDSTREAMUS United States 2->22 24 207.142.100.93, 23 WEBHOST-ASN1US United States 2->24 26 98 other IPs or domains 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 Yara detected Mirai 2->30 32 Uses known network protocols on non-standard ports 2->32 34 Sample is packed with UPX 2->34 9 gmjJxVFJKQ 2->9         started        signatures3 process4 process5 11 gmjJxVFJKQ 9->11         started        13 gmjJxVFJKQ 9->13         started        process6 15 gmjJxVFJKQ 11->15         started        18 gmjJxVFJKQ 11->18         started        signatures7 36 Sample tries to kill multiple processes (SIGKILL) 15->36 20 gmjJxVFJKQ 18->20         started        process8

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    gmjJxVFJKQ23%VirustotalBrowse
    gmjJxVFJKQ25%ReversingLabsLinux.Trojan.Mirai

    Dropped Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Contacted Domains

    ⊘No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.netgmjJxVFJKQfalse
      		high

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      179.181.176.98
      		unknownBrazil
      		10429TELEFONICABRASILSABRfalse
      83.6.123.68
      		unknownPoland
      		5617TPNETPLfalse
      212.117.245.240
      		unknownEuropean Union
      		3561CENTURYLINK-LEGACY-SAVVISUSfalse
      39.208.21.158
      		unknownIndonesia
      		23693TELKOMSEL-ASN-IDPTTelekomunikasiSelularIDfalse
      129.152.120.162
      		unknownUnited States
      		7160NETDYNAMICSUSfalse
      78.134.1.110
      		unknownItaly
      		35612NGI-ASITfalse
      200.11.55.186
      		unknownPeru
      		6147TelefonicadelPeruSAAPEfalse
      158.250.44.138
      		unknownRussian Federation
      		2683RADIO-MSURADIO-MSUEUfalse
      76.197.217.4
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      173.45.39.91
      		unknownUnited States
      		33597ATLANTIC-METRO-COMMUNICATIONS-II-INCUSfalse
      129.154.158.48
      		unknownUnited States
      		7160NETDYNAMICSUSfalse
      70.46.105.145
      		unknownUnited States
      		7029WINDSTREAMUSfalse
      156.43.93.37
      		unknownUnited Kingdom
      		3549LVLT-3549USfalse
      11.15.144.105
      		unknownUnited States
      		3356LEVEL3USfalse
      63.34.86.17
      		unknownUnited States
      		16509AMAZON-02USfalse
      52.118.189.55
      		unknownUnited States
      		36351SOFTLAYERUSfalse
      115.76.201.180
      		unknownViet Nam
      		7552VIETEL-AS-APViettelGroupVNfalse
      207.142.100.93
      		unknownUnited States
      		27229WEBHOST-ASN1USfalse
      152.133.192.199
      		unknownUnited States
      		29992VA-TMP-COREUSfalse
      204.176.239.90
      		unknownUnited States
      		701UUNETUSfalse
      114.8.69.141
      		unknownIndonesia
      		56046CMNET-JIANGSU-APChinaMobilecommunicationscorporationCNfalse
      181.13.216.197
      		unknownArgentina
      		7303TelecomArgentinaSAARfalse
      30.36.127.176
      		unknownUnited States
      		7922COMCAST-7922USfalse
      112.114.205.160
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      149.148.16.109
      		unknownAustria
      		2494MUWNETMUWNETAutonomousSystemATfalse
      31.60.104.188
      		unknownPoland
      		5617TPNETPLfalse
      22.200.27.214
      		unknownUnited States
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
      43.64.131.238
      		unknownJapan4249LILLY-ASUSfalse
      96.209.51.126
      		unknownUnited States
      		7922COMCAST-7922USfalse
      125.144.13.186
      		unknownKorea Republic of
      		4766KIXS-AS-KRKoreaTelecomKRfalse
      3.143.238.175
      		unknownUnited States
      		16509AMAZON-02USfalse
      193.43.44.10
      		unknownItaly
      		3269ASN-IBSNAZITfalse
      211.133.52.222
      		unknownJapan2510INFOWEBFUJITSULIMITEDJPfalse
      108.197.70.158
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      144.185.40.170
      		unknownUnited States
      		19773MOTOROLAUSfalse
      104.150.9.208
      		unknownUnited States
      		1832SMUUSfalse
      81.137.94.161
      		unknownUnited Kingdom
      		2856BT-UK-ASBTnetUKRegionalnetworkGBfalse
      22.12.154.202
      		unknownUnited States
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
      151.99.155.238
      		unknownItaly
      		3269ASN-IBSNAZITfalse
      31.219.177.128
      		unknownUnited Arab Emirates
      		8966ETISALAT-ASPOBox1150DubaiUAEfalse
      137.145.59.136
      		unknownUnited States
      		2152CSUNET-NWUSfalse
      23.200.128.157
      		unknownUnited States
      		14638LCPRLUSfalse
      39.176.217.227
      		unknownChina
      		9808CMNET-GDGuangdongMobileCommunicationCoLtdCNfalse
      218.2.240.61
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      181.152.79.162
      		unknownColombia
      		26611COMCELSACOfalse
      78.119.70.105
      		unknownFrance
      		8228CEGETEL-ASFRfalse
      130.125.217.205
      		unknownSwitzerland
      		559SWITCHPeeringrequestspeeringswitchchEUfalse
      18.230.73.245
      		unknownUnited States
      		16509AMAZON-02USfalse
      73.160.78.147
      		unknownUnited States
      		7922COMCAST-7922USfalse
      151.171.24.143
      		unknownUnited States
      		3257GTT-BACKBONEGTTDEfalse
      31.89.219.233
      		unknownUnited Kingdom
      		12576EELtdGBfalse
      128.30.226.157
      		unknownUnited States
      		3MIT-GATEWAYSUSfalse
      183.57.192.37
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      151.255.85.241
      		unknownSaudi Arabia
      		39451MELBOURNE-ASGBfalse
      39.163.166.11
      		unknownChina
      		24445CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCNfalse
      197.252.128.197
      		unknownSudan
      		15706SudatelSDfalse
      105.114.236.209
      		unknownNigeria
      		36873VNL1-ASNGfalse
      29.146.52.83
      		unknownUnited States
      		7922COMCAST-7922USfalse
      252.118.26.52
      		unknownReserved
      		unknownunknownfalse
      145.55.14.173
      		unknownUnited Kingdom
      		1103SURFNET-NLSURFnetTheNetherlandsNLfalse
      29.52.115.242
      		unknownUnited States
      		7922COMCAST-7922USfalse
      210.85.166.50
      		unknownTaiwan; Republic of China (ROC)
      		7482APOL-ASAsiaPacificOn-lineServiceIncTWfalse
      19.76.79.167
      		unknownUnited States
      		3MIT-GATEWAYSUSfalse
      184.95.51.79
      		unknownUnited States
      		20454SSASN2USfalse
      58.105.224.126
      		unknownAustralia
      		4804MPX-ASMicroplexPTYLTDAUfalse
      70.34.47.217
      		unknownUnited States
      		15830EQUINIX-CONNECT-EMEAGBfalse
      81.225.146.229
      		unknownSweden
      		3301TELIANET-SWEDENTeliaCompanySEfalse
      58.32.178.207
      		unknownChina
      		4812CHINANET-SH-APChinaTelecomGroupCNfalse
      188.121.44.111
      		unknownGermany
      		21501GODADDY-AMSDEfalse
      106.96.40.205
      		unknownKorea Republic of
      		17853LGTELECOM-AS-KRLGTELECOMKRfalse
      242.161.53.186
      		unknownReserved
      		unknownunknownfalse
      181.250.206.235
      		unknownColombia
      		26611COMCELSACOfalse
      18.176.199.11
      		unknownUnited States
      		16509AMAZON-02USfalse
      142.5.110.66
      		unknownCanada
      		46606UNIFIEDLAYER-AS-1USfalse
      114.235.99.95
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      162.139.66.206
      		unknownCanada
      		40341Q9-AS-CAL2CAfalse
      48.16.103.185
      		unknownUnited States
      		2686ATGS-MMD-ASUSfalse
      205.6.160.185
      		unknownUnited States
      		2914NTT-COMMUNICATIONS-2914USfalse
      63.153.51.35
      		unknownUnited States
      		209CENTURYLINK-US-LEGACY-QWESTUSfalse
      90.29.33.106
      		unknownFrance
      		3215FranceTelecom-OrangeFRfalse
      212.58.250.50
      		unknownUnited Kingdom
      		2818BBCBBCInternetServicesUKGBfalse
      42.215.246.135
      		unknownChina
      		4249LILLY-ASUSfalse
      161.253.110.135
      		unknownUnited States
      		11039GWUUSfalse
      171.204.130.148
      		unknownUnited States
      		10794BANKAMERICAUSfalse
      104.144.232.233
      		unknownCanada
      		55286SERVER-MANIACAfalse
      183.105.106.47
      		unknownKorea Republic of
      		4766KIXS-AS-KRKoreaTelecomKRfalse
      158.218.168.105
      		unknownUnited Kingdom
      		2907SINET-ASResearchOrganizationofInformationandSystemsNfalse
      36.119.225.165
      		unknownChina
      		4847CNIX-APChinaNetworksInter-ExchangeCNfalse
      220.165.128.130
      		unknownChina
      		134765CHINANET-YUNNAN-IDC1CHINANETYunnanprovinceIDC1networkfalse
      56.227.65.101
      		unknownUnited States
      		2686ATGS-MMD-ASUSfalse
      109.126.35.19
      		unknownRussian Federation
      		42038VLADLINK-ASRUfalse
      159.38.64.36
      		unknownSweden
      		19399SLLNETEUfalse
      223.96.74.95
      		unknownChina
      		24444CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompanyfalse
      252.33.149.249
      		unknownReserved
      		unknownunknownfalse
      57.217.232.34
      		unknownBelgium
      		2686ATGS-MMD-ASUSfalse
      31.226.76.24
      		unknownGermany
      		3320DTAGInternetserviceprovideroperationsDEfalse
      139.35.103.114
      		unknownUnited States
      		9905LINKNET-ID-APLinknetASNIDfalse
      83.76.95.50
      		unknownSwitzerland
      		3303SWISSCOMSwisscomSwitzerlandLtdCHfalse
      110.113.89.16
      		unknownChina
      		24138CTTNETChinaTieTongTelecommunicationsCorporationCNfalse
      19.133.219.65
      		unknownUnited States
      		3MIT-GATEWAYSUSfalse

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      ⊘No created / dropped files found

      Static File Info

      General

      File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
      Entropy (8bit):7.940559496820084
      TrID:
      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
      File name:gmjJxVFJKQ
      File size:42928
      MD5:a8fbc7563fe019ca689573d43d7797f3
      SHA1:d9842c2d31a7357d8c92414edbff9e60fce317b2
      SHA256:e92cdc162e5091c4916d12d2f4a5f7e7e9ffdb4dae8a18427d81f97ed08edcef
      SHA512:f0ebf55bd633efbaeba15d1c37cbb77f4c0be09c20f70638d05baa484c81204f90440a37f518c745d735d8fdeae8a5b67bd52cf44acf7d987fd2b5703501b9a4
      SSDEEP:768:vL2P9rDZe1V1zzXCgDugq7qovNFPmvKk4ywL7Eug+xwWD:vL2PdV6jzzXCgkPF9mSRywvzF
      TLSH:7F13F15640FDB4CFCCCEAD7A132819E5EE08588966EB135D6B04C589E8A8B5FF05E4B0
      File Content Preview:.ELF....................0...4...........4. ...(.....................m...m...............\...\.F.\.F..................._|UPX!d.......p...p.......U..........?.E.h;....#......b.L#3..b.6RMN.....u..F..)..R.n......bg.F.q+h...z..U%..\...C,...o.\.................

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, little endian
      Version:1 (current)
      Machine:MIPS R3000
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - System V
      ABI Version:0
      Entry Point Address:0x109330
      Flags:0x1007
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:2
      Section Header Offset:0
      Section Header Size:40
      Number of Section Headers:0
      Header String Table Index:0

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x1000000x1000000xa66d0xa66d4.14730x5R E0x10000
      LOAD0xd5c0x460d5c0x460d5c0x00x00.00000x6RW 0x10000

      Network Behavior

      Network Port Distribution

      TCP Packets

      TimestampSource PortDest PortSource IPDest IP
      May 27, 2022 21:12:59.991355896 CEST42836443192.168.2.2391.189.91.43
      May 27, 2022 21:13:00.012146950 CEST2338478218.86.102.45192.168.2.23
      May 27, 2022 21:13:00.012408018 CEST3847823192.168.2.23218.86.102.45
      May 27, 2022 21:13:00.759363890 CEST4251680192.168.2.23109.202.202.202
      May 27, 2022 21:13:01.085675955 CEST735323192.168.2.2389.164.70.101
      May 27, 2022 21:13:01.085737944 CEST735323192.168.2.23217.177.184.187
      May 27, 2022 21:13:01.085741043 CEST735323192.168.2.23137.203.173.101
      May 27, 2022 21:13:01.085748911 CEST735323192.168.2.23155.99.22.98
      May 27, 2022 21:13:01.085768938 CEST735323192.168.2.2346.217.120.146
      May 27, 2022 21:13:01.085782051 CEST735323192.168.2.23186.170.70.118
      May 27, 2022 21:13:01.085783958 CEST735323192.168.2.23254.28.163.74
      May 27, 2022 21:13:01.085796118 CEST735323192.168.2.23245.178.131.122
      May 27, 2022 21:13:01.085804939 CEST735323192.168.2.2371.50.252.6
      May 27, 2022 21:13:01.085817099 CEST735323192.168.2.23247.241.101.225
      May 27, 2022 21:13:01.085824013 CEST735323192.168.2.23169.103.254.33
      May 27, 2022 21:13:01.085825920 CEST735323192.168.2.23217.149.131.222
      May 27, 2022 21:13:01.085870981 CEST735323192.168.2.23110.3.129.125
      May 27, 2022 21:13:01.085874081 CEST735323192.168.2.2350.29.87.192
      May 27, 2022 21:13:01.085875034 CEST735323192.168.2.23154.78.128.153
      May 27, 2022 21:13:01.085886002 CEST735323192.168.2.23210.53.3.255
      May 27, 2022 21:13:01.085896015 CEST735323192.168.2.23196.71.251.245
      May 27, 2022 21:13:01.085900068 CEST735323192.168.2.2399.149.110.188
      May 27, 2022 21:13:01.085906029 CEST735323192.168.2.23182.198.255.62
      May 27, 2022 21:13:01.085911036 CEST735323192.168.2.23194.1.19.128
      May 27, 2022 21:13:01.085923910 CEST735323192.168.2.23184.80.135.250
      May 27, 2022 21:13:01.085931063 CEST735323192.168.2.2340.108.39.88
      May 27, 2022 21:13:01.085932016 CEST735323192.168.2.2358.131.100.205
      May 27, 2022 21:13:01.085944891 CEST735323192.168.2.2355.22.119.253
      May 27, 2022 21:13:01.085951090 CEST735323192.168.2.23123.60.253.41
      May 27, 2022 21:13:01.085956097 CEST735323192.168.2.2324.223.94.97
      May 27, 2022 21:13:01.085968018 CEST735323192.168.2.23124.255.49.41
      May 27, 2022 21:13:01.085968971 CEST735323192.168.2.2351.121.140.119
      May 27, 2022 21:13:01.085975885 CEST735323192.168.2.23174.66.91.90
      May 27, 2022 21:13:01.085975885 CEST735323192.168.2.2381.127.88.64
      May 27, 2022 21:13:01.085980892 CEST735323192.168.2.23146.138.186.154
      May 27, 2022 21:13:01.085983038 CEST735323192.168.2.23153.133.26.3
      May 27, 2022 21:13:01.085995913 CEST735323192.168.2.235.246.6.138
      May 27, 2022 21:13:01.086018085 CEST735323192.168.2.2340.7.92.121
      May 27, 2022 21:13:01.086026907 CEST735323192.168.2.23168.213.213.48
      May 27, 2022 21:13:01.086033106 CEST735323192.168.2.23107.58.152.236
      May 27, 2022 21:13:01.086039066 CEST735323192.168.2.23106.140.190.10
      May 27, 2022 21:13:01.086051941 CEST735323192.168.2.2345.40.92.114
      May 27, 2022 21:13:01.086055994 CEST735323192.168.2.2338.118.238.219
      May 27, 2022 21:13:01.086070061 CEST735323192.168.2.23102.68.131.199
      May 27, 2022 21:13:01.086078882 CEST735323192.168.2.23215.59.110.33
      May 27, 2022 21:13:01.086081028 CEST735323192.168.2.23153.58.190.192
      May 27, 2022 21:13:01.086097956 CEST735323192.168.2.2382.23.27.208
      May 27, 2022 21:13:01.086100101 CEST735323192.168.2.2342.80.232.227
      May 27, 2022 21:13:01.086105108 CEST735323192.168.2.2358.218.67.178
      May 27, 2022 21:13:01.086132050 CEST735323192.168.2.23178.186.128.30
      May 27, 2022 21:13:01.086150885 CEST735323192.168.2.23202.67.70.191
      May 27, 2022 21:13:01.086159945 CEST735323192.168.2.23107.229.100.210
      May 27, 2022 21:13:01.086170912 CEST735323192.168.2.2351.169.126.77
      May 27, 2022 21:13:01.086174011 CEST735323192.168.2.2318.233.116.93
      May 27, 2022 21:13:01.086189985 CEST735323192.168.2.2317.130.24.122
      May 27, 2022 21:13:01.086196899 CEST735323192.168.2.2377.130.190.88
      May 27, 2022 21:13:01.086208105 CEST735323192.168.2.2366.110.3.152
      May 27, 2022 21:13:01.086219072 CEST735323192.168.2.23135.92.132.80
      May 27, 2022 21:13:01.086229086 CEST735323192.168.2.23139.163.10.94
      May 27, 2022 21:13:01.086240053 CEST735323192.168.2.23211.144.109.240
      May 27, 2022 21:13:01.086245060 CEST735323192.168.2.2387.201.40.227
      May 27, 2022 21:13:01.086257935 CEST735323192.168.2.2375.5.125.1
      May 27, 2022 21:13:01.086261988 CEST735323192.168.2.2374.211.7.229
      May 27, 2022 21:13:01.086273909 CEST735323192.168.2.2393.30.208.198
      May 27, 2022 21:13:01.086282969 CEST735323192.168.2.2380.227.83.91
      May 27, 2022 21:13:01.086292028 CEST735323192.168.2.23139.254.139.66
      May 27, 2022 21:13:01.086303949 CEST735323192.168.2.23252.157.80.169
      May 27, 2022 21:13:01.086307049 CEST735323192.168.2.2322.51.245.201
      May 27, 2022 21:13:01.086325884 CEST735323192.168.2.233.188.157.111
      May 27, 2022 21:13:01.086329937 CEST735323192.168.2.2321.218.233.212
      May 27, 2022 21:13:01.086344957 CEST735323192.168.2.2321.106.144.219
      May 27, 2022 21:13:01.086357117 CEST735323192.168.2.23120.16.203.227
      May 27, 2022 21:13:01.086361885 CEST735323192.168.2.23189.249.182.99
      May 27, 2022 21:13:01.086365938 CEST735323192.168.2.23150.53.27.251
      May 27, 2022 21:13:01.086378098 CEST735323192.168.2.2361.214.93.221
      May 27, 2022 21:13:01.086381912 CEST735323192.168.2.238.152.12.250
      May 27, 2022 21:13:01.086390972 CEST735323192.168.2.23241.131.80.85
      May 27, 2022 21:13:01.086397886 CEST735323192.168.2.23120.117.6.222
      May 27, 2022 21:13:01.086404085 CEST735323192.168.2.23107.17.226.19
      May 27, 2022 21:13:01.086415052 CEST735323192.168.2.232.117.88.29
      May 27, 2022 21:13:01.086417913 CEST735323192.168.2.2369.254.0.62
      May 27, 2022 21:13:01.086431026 CEST735323192.168.2.23139.248.155.211
      May 27, 2022 21:13:01.086436033 CEST735323192.168.2.2334.252.159.129
      May 27, 2022 21:13:01.086443901 CEST735323192.168.2.2333.124.189.43
      May 27, 2022 21:13:01.086447001 CEST735323192.168.2.23133.211.138.75
      May 27, 2022 21:13:01.086461067 CEST735323192.168.2.23104.31.148.216
      May 27, 2022 21:13:01.086467028 CEST735323192.168.2.23129.220.77.162
      May 27, 2022 21:13:01.086474895 CEST735323192.168.2.2396.154.170.131
      May 27, 2022 21:13:01.086477041 CEST735323192.168.2.2399.30.55.193
      May 27, 2022 21:13:01.086479902 CEST735323192.168.2.23204.94.155.0
      May 27, 2022 21:13:01.086492062 CEST735323192.168.2.23108.75.254.231
      May 27, 2022 21:13:01.086503983 CEST735323192.168.2.2339.59.56.71
      May 27, 2022 21:13:01.086513042 CEST735323192.168.2.23113.162.159.208
      May 27, 2022 21:13:01.086525917 CEST735323192.168.2.23188.83.74.176
      May 27, 2022 21:13:01.086528063 CEST735323192.168.2.2394.197.220.33
      May 27, 2022 21:13:01.086541891 CEST735323192.168.2.2342.98.37.152
      May 27, 2022 21:13:01.086545944 CEST735323192.168.2.238.230.154.184
      May 27, 2022 21:13:01.086551905 CEST735323192.168.2.2318.149.188.241
      May 27, 2022 21:13:01.086563110 CEST735323192.168.2.23107.248.160.184
      May 27, 2022 21:13:01.086568117 CEST735323192.168.2.2313.232.222.51

      System Behavior

      General

      Start time:21:12:59
      Start date:27/05/2022
      Path:/tmp/gmjJxVFJKQ
      Arguments:/tmp/gmjJxVFJKQ
      File size:5773336 bytes
      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

      General

      Start time:21:13:00
      Start date:27/05/2022
      Path:/tmp/gmjJxVFJKQ
      Arguments:n/a
      File size:5773336 bytes
      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

      General

      Start time:21:13:00
      Start date:27/05/2022
      Path:/tmp/gmjJxVFJKQ
      Arguments:n/a
      File size:5773336 bytes
      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

      General

      Start time:21:13:00
      Start date:27/05/2022
      Path:/tmp/gmjJxVFJKQ
      Arguments:n/a
      File size:5773336 bytes
      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

      General

      Start time:21:13:00
      Start date:27/05/2022
      Path:/tmp/gmjJxVFJKQ
      Arguments:n/a
      File size:5773336 bytes
      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

      General

      Start time:21:13:00
      Start date:27/05/2022
      Path:/tmp/gmjJxVFJKQ
      Arguments:n/a
      File size:5773336 bytes
      MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9