Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
5zKnElN0F2

Overview

General Information

Sample Name:5zKnElN0F2
Analysis ID:635411
MD5:d74bf4db8e2e43cbdc9c527ec15356b0
SHA1:5de6b4e1a4b1f896ec6b3b6b473c8afb4d6f40a1
SHA256:c0b3f4b9a9a57965c0429b5199e634012e223a4617a13a89dc5e2508085e5575
Tags:32elfmiraipowerpc
Infos:

Detection

Mirai
Score:68
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample tries to kill multiple processes (SIGKILL)
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:635411
Start date and time: 27/05/202221:16:422022-05-27 21:16:42 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 6m 3s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:5zKnElN0F2
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal68.spre.troj.evad.lin@0/0@0/0
  • Report size exceeded maximum capacity and may have missing network information.
  • VT rate limit hit for: 5zKnElN0F2
Command:/tmp/5zKnElN0F2
PID:6225
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Infected
Standard Error:
  • system is lnxubuntu20
  • 5zKnElN0F2 (PID: 6225, Parent: 6126, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/5zKnElN0F2
  • cleanup
SourceRuleDescriptionAuthorStrings
5zKnElN0F2SUSP_ELF_LNX_UPX_Compressed_FileDetects a suspicious ELF binary with UPX compressionFlorian Roth
  • 0x9154:$s1: PROT_EXEC|PROT_WRITE failed.
  • 0x91c3:$s2: $Id: UPX
  • 0x9174:$s3: $Info: This file is packed with the UPX executable packer
SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security
    No Snort rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: 5zKnElN0F2ReversingLabs: Detection: 30%

    Networking

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50378
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50380
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50382
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50384
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50388
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50392
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50396
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50400
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50402
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50414
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50420
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50422
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50426
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50430
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50434
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50436
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50444
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50448
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50456
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50462
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50466
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50468
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50474
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50478
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50482
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50488
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50492
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50494
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54182
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54188
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54194
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54200
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54206
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54212
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54218
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54222
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54228
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54232
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54238
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54244
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54250
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54258
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54262
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54274
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54276
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54288
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54306
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54332
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54352
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54366
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54384
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54408
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54436
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54460
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54474
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54486
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57128
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57136
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57140
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57142
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57146
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57156
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:39008 -> 45.95.169.139:9372
    Source: /tmp/5zKnElN0F2 (PID: 6233)Socket: 0.0.0.0::23Jump to behavior
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 249.169.15.40
    Source: unknownTCP traffic detected without corresponding DNS query: 104.199.228.40
    Source: unknownTCP traffic detected without corresponding DNS query: 20.56.144.190
    Source: unknownTCP traffic detected without corresponding DNS query: 103.176.96.40
    Source: unknownTCP traffic detected without corresponding DNS query: 29.151.218.80
    Source: unknownTCP traffic detected without corresponding DNS query: 192.5.233.79
    Source: unknownTCP traffic detected without corresponding DNS query: 203.254.91.17
    Source: unknownTCP traffic detected without corresponding DNS query: 197.68.217.22
    Source: unknownTCP traffic detected without corresponding DNS query: 172.136.171.162
    Source: unknownTCP traffic detected without corresponding DNS query: 84.169.157.116
    Source: unknownTCP traffic detected without corresponding DNS query: 70.83.239.117
    Source: unknownTCP traffic detected without corresponding DNS query: 189.56.57.181
    Source: unknownTCP traffic detected without corresponding DNS query: 147.145.145.36
    Source: unknownTCP traffic detected without corresponding DNS query: 124.80.238.203
    Source: unknownTCP traffic detected without corresponding DNS query: 82.36.65.251
    Source: unknownTCP traffic detected without corresponding DNS query: 201.154.224.153
    Source: unknownTCP traffic detected without corresponding DNS query: 204.218.135.134
    Source: unknownTCP traffic detected without corresponding DNS query: 126.67.223.153
    Source: unknownTCP traffic detected without corresponding DNS query: 94.128.230.229
    Source: unknownTCP traffic detected without corresponding DNS query: 240.228.179.208
    Source: unknownTCP traffic detected without corresponding DNS query: 16.182.131.136
    Source: unknownTCP traffic detected without corresponding DNS query: 44.65.107.245
    Source: unknownTCP traffic detected without corresponding DNS query: 75.106.47.86
    Source: unknownTCP traffic detected without corresponding DNS query: 137.127.90.198
    Source: unknownTCP traffic detected without corresponding DNS query: 108.135.179.99
    Source: unknownTCP traffic detected without corresponding DNS query: 252.151.202.166
    Source: unknownTCP traffic detected without corresponding DNS query: 142.27.4.128
    Source: unknownTCP traffic detected without corresponding DNS query: 32.150.0.9
    Source: unknownTCP traffic detected without corresponding DNS query: 178.182.189.196
    Source: unknownTCP traffic detected without corresponding DNS query: 247.142.150.14
    Source: unknownTCP traffic detected without corresponding DNS query: 95.80.50.226
    Source: unknownTCP traffic detected without corresponding DNS query: 145.119.160.167
    Source: unknownTCP traffic detected without corresponding DNS query: 126.53.28.195
    Source: unknownTCP traffic detected without corresponding DNS query: 60.37.188.179
    Source: unknownTCP traffic detected without corresponding DNS query: 53.12.116.174
    Source: unknownTCP traffic detected without corresponding DNS query: 8.47.163.205
    Source: unknownTCP traffic detected without corresponding DNS query: 151.232.166.68
    Source: unknownTCP traffic detected without corresponding DNS query: 254.203.17.44
    Source: unknownTCP traffic detected without corresponding DNS query: 163.138.31.255
    Source: unknownTCP traffic detected without corresponding DNS query: 204.211.151.168
    Source: unknownTCP traffic detected without corresponding DNS query: 46.84.226.86
    Source: unknownTCP traffic detected without corresponding DNS query: 82.73.227.91
    Source: unknownTCP traffic detected without corresponding DNS query: 109.62.224.105
    Source: unknownTCP traffic detected without corresponding DNS query: 217.116.246.176
    Source: unknownTCP traffic detected without corresponding DNS query: 212.139.142.36
    Source: unknownTCP traffic detected without corresponding DNS query: 245.8.37.2
    Source: unknownTCP traffic detected without corresponding DNS query: 249.52.26.203
    Source: unknownTCP traffic detected without corresponding DNS query: 187.217.81.167
    Source: unknownTCP traffic detected without corresponding DNS query: 76.117.182.151
    Source: 5zKnElN0F2String found in binary or memory: http://upx.sf.net

    System Summary

    barindex
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 658, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 772, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 789, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 904, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1320, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1389, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1463, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1465, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1576, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1809, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1888, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1890, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1983, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 2048, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 2062, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 6045, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 6189, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 6227, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 6238, result: successfulJump to behavior
    Source: LOAD without section mappingsProgram segment: 0x100000
    Source: 5zKnElN0F2, type: SAMPLEMatched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, reference = Internal Research, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 658, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 772, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 789, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 904, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1320, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1389, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1463, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1465, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1576, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1809, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1888, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1890, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 1983, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 2048, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 2062, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 6045, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 6189, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 6227, result: successfulJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)SIGKILL sent: pid: 6238, result: successfulJump to behavior
    Source: classification engineClassification label: mal68.spre.troj.evad.lin@0/0@0/0

    Data Obfuscation

    barindex
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/6235/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1582/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2033/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2275/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/3088/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/6194/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1612/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1579/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1699/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1335/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1698/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2028/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1334/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1576/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2302/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/3236/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2025/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2146/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/910/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/6227/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/912/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/517/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/759/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2307/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/918/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1594/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2285/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2281/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1349/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1623/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/761/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1622/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/884/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1983/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2038/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1344/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1465/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1586/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1463/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2156/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/800/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/6238/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/801/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1629/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1627/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1900/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/3021/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/491/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2294/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2050/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1877/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/772/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1633/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1599/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1632/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/774/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1477/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/654/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/896/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1476/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1872/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2048/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/655/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1475/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2289/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/656/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/777/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/657/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/4466/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/658/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/4467/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/4468/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/4469/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/4502/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/419/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/936/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1639/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1638/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2208/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2180/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1809/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1494/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1890/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2063/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2062/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1888/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1886/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/420/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1489/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/785/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1642/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/788/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/667/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/789/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/1648/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/4495/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/6156/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/4498/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2078/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2077/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2074/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2195/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/670/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/4490/exeJump to behavior
    Source: /tmp/5zKnElN0F2 (PID: 6233)File opened: /proc/2746/exeJump to behavior

    Hooking and other Techniques for Hiding and Protection

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50378
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50380
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50382
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50384
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50388
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50392
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50396
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50400
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50402
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50414
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50420
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50422
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50426
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50430
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50434
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50436
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50444
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50448
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50456
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50462
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50466
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50468
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50474
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50478
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50482
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50488
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50492
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 50494
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54182
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54188
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54194
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54200
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54206
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54212
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54218
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54222
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54228
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54232
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54238
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54244
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54250
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54258
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54262
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54274
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54276
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54288
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54306
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54332
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54352
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54366
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54384
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54408
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54436
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54460
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54474
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54486
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57128
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57136
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57140
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57142
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57146
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57156
    Source: /tmp/5zKnElN0F2 (PID: 6225)Queries kernel information via 'uname': Jump to behavior
    Source: 5zKnElN0F2, 6225.1.00000000e3b31b61.00000000feb11032.rw-.sdmp, 5zKnElN0F2, 6227.1.00000000e3b31b61.00000000feb11032.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
    Source: 5zKnElN0F2, 6225.1.00000000258270c1.0000000060d5cb64.rw-.sdmp, 5zKnElN0F2, 6227.1.00000000258270c1.0000000060d5cb64.rw-.sdmp, 5zKnElN0F2, 6229.1.00000000258270c1.0000000060d5cb64.rw-.sdmp, 5zKnElN0F2, 6236.1.00000000258270c1.0000000060d5cb64.rw-.sdmp, 5zKnElN0F2, 6238.1.00000000258270c1.0000000060d5cb64.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-ppc/tmp/5zKnElN0F2SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/5zKnElN0F2
    Source: 5zKnElN0F2, 6229.1.00000000e3b31b61.00000000feb11032.rw-.sdmp, 5zKnElN0F2, 6236.1.00000000e3b31b61.00000000feb11032.rw-.sdmp, 5zKnElN0F2, 6238.1.00000000e3b31b61.00000000feb11032.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
    Source: 5zKnElN0F2, 6225.1.00000000e3b31b61.00000000feb11032.rw-.sdmp, 5zKnElN0F2, 6227.1.00000000e3b31b61.00000000feb11032.rw-.sdmp, 5zKnElN0F2, 6229.1.00000000e3b31b61.00000000feb11032.rw-.sdmp, 5zKnElN0F2, 6236.1.00000000e3b31b61.00000000feb11032.rw-.sdmp, 5zKnElN0F2, 6238.1.00000000e3b31b61.00000000feb11032.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
    Source: 5zKnElN0F2, 6225.1.00000000258270c1.0000000060d5cb64.rw-.sdmp, 5zKnElN0F2, 6227.1.00000000258270c1.0000000060d5cb64.rw-.sdmp, 5zKnElN0F2, 6229.1.00000000258270c1.0000000060d5cb64.rw-.sdmp, 5zKnElN0F2, 6236.1.00000000258270c1.0000000060d5cb64.rw-.sdmp, 5zKnElN0F2, 6238.1.00000000258270c1.0000000060d5cb64.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP
    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
    Obfuscated Files or Information
    1
    OS Credential Dumping
    11
    Security Software Discovery
    Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel
    Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
    Service Stop
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
    Non-Standard Port
    Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol
    Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    No configs have been found