Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
shAwKMD85K

Overview

General Information

Sample Name:shAwKMD85K
Analysis ID:635419
MD5:e0c4f532b0a9fda3ee7d800775deb908
SHA1:63f144f5b1f316e34510f15d4f93c3fc41d0b73e
SHA256:aa18cc657da907f749d8bf4aae9867152acc7320f518aa1f9a33bba195e19328
Tags:32elfmirairenesas
Infos:

Detection

Mirai
Score:68
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Sample tries to kill multiple processes (SIGKILL)
Connects to many ports of the same IP (likely port scanning)
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:635419
Start date and time: 27/05/202221:26:322022-05-27 21:26:32 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 53s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:shAwKMD85K
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal68.spre.troj.lin@0/0@0/0
  • Report size exceeded maximum capacity and may have missing network information.
Command:/tmp/shAwKMD85K
PID:6232
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Infected
Standard Error:
  • system is lnxubuntu20
  • shAwKMD85K (PID: 6232, Parent: 6126, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/shAwKMD85K
  • cleanup
SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security
    No Snort rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: shAwKMD85KVirustotal: Detection: 43%Perma Link
    Source: shAwKMD85KReversingLabs: Detection: 41%

    Networking

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57286
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57292
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57300
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57306
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57314
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57320
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57330
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57336
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57342
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57348
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57354
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57360
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57366
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57372
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57376
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57378
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57384
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57386
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57388
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57390
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57392
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57398
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57400
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57402
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57406
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57410
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57428
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57456
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53624
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53634
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53646
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53658
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53686
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53726
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53770
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53800
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53814
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53824
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53832
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53846
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53866
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53888
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53900
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53906
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53916
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53922
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53938
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53946
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53960
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53972
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53982
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53994
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54012
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54032
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54048
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54066
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60628
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60644
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60662
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60682
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60702
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60714
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60724
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60732
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60746
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60756
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60770
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60778
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60792
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60800
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60816
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60834
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60854
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60872
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60890
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60912
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60924
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60936
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60948
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60958
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60968
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60982
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60996
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 32774
    Source: global trafficTCP traffic: 45.95.169.139 ports 17244,9372,2,3,7,9
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:39008 -> 45.95.169.139:9372
    Source: /tmp/shAwKMD85K (PID: 6239)Socket: 0.0.0.0::23Jump to behavior
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 194.156.189.65
    Source: unknownTCP traffic detected without corresponding DNS query: 141.20.85.65
    Source: unknownTCP traffic detected without corresponding DNS query: 194.245.158.69
    Source: unknownTCP traffic detected without corresponding DNS query: 103.96.209.65
    Source: unknownTCP traffic detected without corresponding DNS query: 181.208.1.221
    Source: unknownTCP traffic detected without corresponding DNS query: 114.8.240.128
    Source: unknownTCP traffic detected without corresponding DNS query: 83.35.133.32
    Source: unknownTCP traffic detected without corresponding DNS query: 144.9.72.233
    Source: unknownTCP traffic detected without corresponding DNS query: 181.178.20.236
    Source: unknownTCP traffic detected without corresponding DNS query: 140.195.233.234
    Source: unknownTCP traffic detected without corresponding DNS query: 180.173.150.183
    Source: unknownTCP traffic detected without corresponding DNS query: 28.24.156.119
    Source: unknownTCP traffic detected without corresponding DNS query: 12.241.246.22
    Source: unknownTCP traffic detected without corresponding DNS query: 96.116.137.210
    Source: unknownTCP traffic detected without corresponding DNS query: 152.56.21.23
    Source: unknownTCP traffic detected without corresponding DNS query: 246.186.28.56
    Source: unknownTCP traffic detected without corresponding DNS query: 171.178.159.27
    Source: unknownTCP traffic detected without corresponding DNS query: 220.244.29.31
    Source: unknownTCP traffic detected without corresponding DNS query: 80.99.200.10
    Source: unknownTCP traffic detected without corresponding DNS query: 81.0.246.54
    Source: unknownTCP traffic detected without corresponding DNS query: 62.117.198.20
    Source: unknownTCP traffic detected without corresponding DNS query: 212.14.185.185
    Source: unknownTCP traffic detected without corresponding DNS query: 108.101.134.238
    Source: unknownTCP traffic detected without corresponding DNS query: 196.169.98.41
    Source: unknownTCP traffic detected without corresponding DNS query: 163.6.218.171
    Source: unknownTCP traffic detected without corresponding DNS query: 167.118.252.130
    Source: unknownTCP traffic detected without corresponding DNS query: 244.40.132.89
    Source: unknownTCP traffic detected without corresponding DNS query: 165.67.34.79
    Source: unknownTCP traffic detected without corresponding DNS query: 66.186.117.133
    Source: unknownTCP traffic detected without corresponding DNS query: 121.221.93.12
    Source: unknownTCP traffic detected without corresponding DNS query: 40.182.92.158
    Source: unknownTCP traffic detected without corresponding DNS query: 48.137.15.209
    Source: unknownTCP traffic detected without corresponding DNS query: 71.40.177.108
    Source: unknownTCP traffic detected without corresponding DNS query: 133.102.245.142
    Source: unknownTCP traffic detected without corresponding DNS query: 16.232.69.155
    Source: unknownTCP traffic detected without corresponding DNS query: 51.123.209.80
    Source: unknownTCP traffic detected without corresponding DNS query: 193.109.103.86
    Source: unknownTCP traffic detected without corresponding DNS query: 201.125.108.181
    Source: unknownTCP traffic detected without corresponding DNS query: 132.72.140.4
    Source: unknownTCP traffic detected without corresponding DNS query: 139.27.139.59
    Source: unknownTCP traffic detected without corresponding DNS query: 189.153.132.49
    Source: unknownTCP traffic detected without corresponding DNS query: 116.202.39.34
    Source: unknownTCP traffic detected without corresponding DNS query: 207.254.36.225
    Source: unknownTCP traffic detected without corresponding DNS query: 207.101.157.127
    Source: unknownTCP traffic detected without corresponding DNS query: 118.7.221.236
    Source: unknownTCP traffic detected without corresponding DNS query: 81.39.106.72
    Source: unknownTCP traffic detected without corresponding DNS query: 188.81.96.224
    Source: unknownTCP traffic detected without corresponding DNS query: 39.101.200.132
    Source: unknownTCP traffic detected without corresponding DNS query: 70.4.209.210
    Source: unknownTCP traffic detected without corresponding DNS query: 211.36.92.160

    System Summary

    barindex
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 658, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 772, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 789, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 904, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1320, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1389, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1463, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1465, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1576, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1809, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1888, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1890, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1983, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 2048, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 2062, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 6039, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 6192, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 6234, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 6243, result: successfulJump to behavior
    Source: ELF static info symbol of initial sample.symtab present: no
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 658, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 720, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 759, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 772, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 789, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 800, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 904, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 936, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1320, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1334, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1335, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1389, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1463, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1465, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1576, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1809, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1872, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1888, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1890, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 1983, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 2048, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 2062, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 6039, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 6192, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 6234, result: successfulJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)SIGKILL sent: pid: 6243, result: successfulJump to behavior
    Source: classification engineClassification label: mal68.spre.troj.lin@0/0@0/0
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/6234/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1582/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2033/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2275/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/3088/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/6193/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/6192/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1612/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1579/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1699/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1335/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1698/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2028/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1334/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1576/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2302/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/3236/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2025/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2146/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/910/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/912/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/517/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/759/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2307/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/918/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/6243/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/4465/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1594/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2285/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2281/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1349/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1623/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/761/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1622/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/884/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1983/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2038/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1344/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1465/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1586/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1463/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2156/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/800/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/801/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/6116/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1629/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1627/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1900/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/3021/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/491/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2294/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2050/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1877/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/772/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1633/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1599/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1632/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/774/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1477/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/654/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/896/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1476/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1872/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2048/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/655/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1475/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2289/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/656/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/777/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/657/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/4466/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/658/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/4467/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/4468/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/419/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/936/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1639/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1638/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2208/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2180/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1809/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1494/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1890/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2063/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2062/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1888/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1886/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/420/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1489/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/785/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1642/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/788/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/667/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/789/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/1648/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/6157/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/6310/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/4498/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2078/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2077/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2074/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2195/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/670/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/2746/exeJump to behavior
    Source: /tmp/shAwKMD85K (PID: 6239)File opened: /proc/793/exeJump to behavior

    Hooking and other Techniques for Hiding and Protection

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57286
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57292
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57300
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57306
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57314
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57320
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57330
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57336
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57342
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57348
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57354
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57360
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57366
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57372
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57376
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57378
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57384
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57386
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57388
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57390
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57392
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57398
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57400
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57402
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57406
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57410
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57428
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 57456
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53624
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53634
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53646
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53658
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53686
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53726
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53770
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53800
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53814
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53824
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53832
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53846
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53866
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53888
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53900
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53906
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53916
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53922
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53938
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53946
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53960
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53972
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53982
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 53994
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54012
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54032
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54048
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 54066
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60628
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60644
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60662
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60682
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60702
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60714
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60724
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60732
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60746
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60756
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60770
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60778
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60792
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60800
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60816
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60834
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60854
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60872
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60890
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60912
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60924
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60936
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60948
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60958
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60968
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60982
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 60996
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 32774
    Source: /tmp/shAwKMD85K (PID: 6232)Queries kernel information via 'uname': Jump to behavior
    Source: shAwKMD85K, 6232.1.00000000a1b01e61.00000000e0dd4486.rw-.sdmp, shAwKMD85K, 6234.1.00000000a1b01e61.00000000e0dd4486.rw-.sdmp, shAwKMD85K, 6310.1.00000000a1b01e61.00000000e0dd4486.rw-.sdmp, shAwKMD85K, 6235.1.00000000a1b01e61.00000000e0dd4486.rw-.sdmp, shAwKMD85K, 6241.1.00000000a1b01e61.00000000e0dd4486.rw-.sdmp, shAwKMD85K, 6243.1.00000000a1b01e61.00000000e0dd4486.rw-.sdmpBinary or memory string: r}x86_64/usr/bin/qemu-sh4/tmp/shAwKMD85KSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/shAwKMD85K
    Source: shAwKMD85K, 6232.1.00000000a1b01e61.00000000e0dd4486.rw-.sdmp, shAwKMD85K, 6234.1.00000000a1b01e61.00000000e0dd4486.rw-.sdmp, shAwKMD85K, 6310.1.00000000a1b01e61.00000000e0dd4486.rw-.sdmp, shAwKMD85K, 6235.1.00000000a1b01e61.00000000e0dd4486.rw-.sdmp, shAwKMD85K, 6241.1.00000000a1b01e61.00000000e0dd4486.rw-.sdmp, shAwKMD85K, 6243.1.00000000a1b01e61.00000000e0dd4486.rw-.sdmpBinary or memory string: /usr/bin/qemu-sh4
    Source: shAwKMD85K, 6232.1.00000000d75652a9.000000006ca34ec5.rw-.sdmp, shAwKMD85K, 6234.1.00000000d75652a9.000000006ca34ec5.rw-.sdmp, shAwKMD85K, 6310.1.00000000d75652a9.000000006ca34ec5.rw-.sdmp, shAwKMD85K, 6235.1.00000000d75652a9.000000006ca34ec5.rw-.sdmp, shAwKMD85K, 6241.1.00000000d75652a9.000000006ca34ec5.rw-.sdmp, shAwKMD85K, 6243.1.00000000d75652a9.000000006ca34ec5.rw-.sdmpBinary or memory string: U5!/etc/qemu-binfmt/sh4
    Source: shAwKMD85K, 6232.1.00000000d75652a9.000000006ca34ec5.rw-.sdmp, shAwKMD85K, 6234.1.00000000d75652a9.000000006ca34ec5.rw-.sdmp, shAwKMD85K, 6310.1.00000000d75652a9.000000006ca34ec5.rw-.sdmp, shAwKMD85K, 6235.1.00000000d75652a9.000000006ca34ec5.rw-.sdmp, shAwKMD85K, 6241.1.00000000d75652a9.000000006ca34ec5.rw-.sdmp, shAwKMD85K, 6243.1.00000000d75652a9.000000006ca34ec5.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sh4

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP
    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
    OS Credential Dumping
    11
    Security Software Discovery
    Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel
    Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
    Service Stop
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
    Non-Standard Port
    Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol
    Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    No configs have been found