Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
Nmg21us74I

Overview

General Information

Sample Name:Nmg21us74I
Analysis ID:679506
MD5:01ec15a16805e0b57d0ef42097dca5ec
SHA1:d9ea867164e9ad0c1901b85c8f18174743e1a0b4
SHA256:a3946c00d0daf54a7e99a22e731dbc7977936ef6c9591dd0ae2a45632626b357
Tags:32armelfmirai
Infos:

Detection

Mirai
Score:88
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample deletes itself
Uses known network protocols on non-standard ports
Yara signature match
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:35.0.0 Citrine
Analysis ID:679506
Start date and time: 05/08/202222:22:162022-08-05 22:22:16 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 53s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:Nmg21us74I
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal88.troj.evad.lin@0/0@0/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Runtime Messages

Command:/tmp/Nmg21us74I
PID:6230
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
BEASTMODE-BITCHES@@""""/p
Standard Error:

Process Tree

  • system is lnxubuntu20
  • Nmg21us74I (PID: 6230, Parent: 6123, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Nmg21us74I
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
Nmg21us74IMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
  • 0xeb14:$x1: POST /cdn-cgi/
  • 0xefd0:$s1: LCOGQGPTGP
Nmg21us74IMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
  • 0xeb14:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Nmg21us74IJoeSecurity_Mirai_5Yara detected MiraiJoe Security

    PCAP (Network Traffic)

    SourceRuleDescriptionAuthorStrings
    dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
      • 0xeb14:$x1: POST /cdn-cgi/
      • 0xefd0:$s1: LCOGQGPTGP
      6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmpMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
      • 0xeb14:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
      6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmpJoeSecurity_Mirai_5Yara detected MiraiJoe Security
        6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
        • 0xeb14:$x1: POST /cdn-cgi/
        • 0xefd0:$s1: LCOGQGPTGP
        6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmpMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
        • 0xeb14:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
        Click to see the 7 entries

        Snort Signatures

        ⊘No Snort rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus / Scanner detection for submitted sample
        Source: Nmg21us74IAvira: detected
        Multi AV Scanner detection for submitted file
        Source: Nmg21us74IVirustotal: Detection: 57%Perma Link
        Source: Nmg21us74IReversingLabs: Detection: 67%

        Networking

        barindex
        Uses known network protocols on non-standard ports
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46570
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46574
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46582
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46590
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46596
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46600
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46602
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46604
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46606
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46608
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55188
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55200
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55210
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55226
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55230
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55232
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55234
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55238
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55240
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55242
        Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
        Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
        Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
        Source: global trafficTCP traffic: 192.168.2.23:53692 -> 163.123.143.71:34241
        Source: /tmp/Nmg21us74I (PID: 6230)Socket: 127.0.0.1::42516
        Source: /tmp/Nmg21us74I (PID: 6234)Socket: 0.0.0.0::23
        Source: /tmp/Nmg21us74I (PID: 6234)Socket: 0.0.0.0::0
        Source: /tmp/Nmg21us74I (PID: 6234)Socket: 0.0.0.0::80
        Source: /tmp/Nmg21us74I (PID: 6234)Socket: 0.0.0.0::81
        Source: /tmp/Nmg21us74I (PID: 6234)Socket: 0.0.0.0::8443
        Source: /tmp/Nmg21us74I (PID: 6234)Socket: 0.0.0.0::9009
        Source: /tmp/Nmg21us74I (PID: 6250)Socket: 0.0.0.0::23
        Source: /tmp/Nmg21us74I (PID: 6250)Socket: 0.0.0.0::0
        Source: /tmp/Nmg21us74I (PID: 6250)Socket: 0.0.0.0::80
        Source: /tmp/Nmg21us74I (PID: 6250)Socket: 0.0.0.0::81
        Source: /tmp/Nmg21us74I (PID: 6250)Socket: 0.0.0.0::8443
        Source: /tmp/Nmg21us74I (PID: 6250)Socket: 0.0.0.0::9009
        Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 247.69.125.15
        Source: unknownTCP traffic detected without corresponding DNS query: 89.62.97.13
        Source: unknownTCP traffic detected without corresponding DNS query: 201.64.150.235
        Source: unknownTCP traffic detected without corresponding DNS query: 99.33.248.85
        Source: unknownTCP traffic detected without corresponding DNS query: 201.133.179.101
        Source: unknownTCP traffic detected without corresponding DNS query: 123.213.193.207
        Source: unknownTCP traffic detected without corresponding DNS query: 1.55.165.112
        Source: unknownTCP traffic detected without corresponding DNS query: 24.220.186.101
        Source: unknownTCP traffic detected without corresponding DNS query: 171.190.215.92
        Source: unknownTCP traffic detected without corresponding DNS query: 74.219.179.190
        Source: unknownTCP traffic detected without corresponding DNS query: 68.55.130.165
        Source: unknownTCP traffic detected without corresponding DNS query: 185.134.162.198
        Source: unknownTCP traffic detected without corresponding DNS query: 186.120.206.202
        Source: unknownTCP traffic detected without corresponding DNS query: 77.237.72.112
        Source: unknownTCP traffic detected without corresponding DNS query: 174.100.78.43
        Source: unknownTCP traffic detected without corresponding DNS query: 223.213.17.120
        Source: unknownTCP traffic detected without corresponding DNS query: 115.70.188.226
        Source: unknownTCP traffic detected without corresponding DNS query: 246.88.72.79
        Source: unknownTCP traffic detected without corresponding DNS query: 74.4.255.140
        Source: unknownTCP traffic detected without corresponding DNS query: 102.96.34.54
        Source: unknownTCP traffic detected without corresponding DNS query: 32.126.77.119
        Source: unknownTCP traffic detected without corresponding DNS query: 112.187.57.147
        Source: unknownTCP traffic detected without corresponding DNS query: 203.108.232.50
        Source: unknownTCP traffic detected without corresponding DNS query: 193.38.42.40
        Source: unknownTCP traffic detected without corresponding DNS query: 247.249.136.144
        Source: unknownTCP traffic detected without corresponding DNS query: 92.175.108.39
        Source: unknownTCP traffic detected without corresponding DNS query: 217.67.41.171
        Source: unknownTCP traffic detected without corresponding DNS query: 14.179.207.111
        Source: unknownTCP traffic detected without corresponding DNS query: 40.187.84.210
        Source: unknownTCP traffic detected without corresponding DNS query: 16.28.78.124
        Source: unknownTCP traffic detected without corresponding DNS query: 176.2.125.141
        Source: unknownTCP traffic detected without corresponding DNS query: 46.15.198.202
        Source: unknownTCP traffic detected without corresponding DNS query: 190.75.209.114
        Source: unknownTCP traffic detected without corresponding DNS query: 117.38.60.242
        Source: unknownTCP traffic detected without corresponding DNS query: 167.69.41.250
        Source: unknownTCP traffic detected without corresponding DNS query: 161.24.53.149
        Source: unknownTCP traffic detected without corresponding DNS query: 83.225.24.201
        Source: unknownTCP traffic detected without corresponding DNS query: 176.136.18.174
        Source: unknownTCP traffic detected without corresponding DNS query: 95.2.3.253
        Source: unknownTCP traffic detected without corresponding DNS query: 197.117.13.64
        Source: unknownTCP traffic detected without corresponding DNS query: 117.20.163.155
        Source: unknownTCP traffic detected without corresponding DNS query: 242.36.164.230
        Source: unknownTCP traffic detected without corresponding DNS query: 186.200.170.6
        Source: unknownTCP traffic detected without corresponding DNS query: 94.33.47.97
        Source: unknownTCP traffic detected without corresponding DNS query: 19.183.144.84
        Source: unknownTCP traffic detected without corresponding DNS query: 142.183.217.180
        Source: unknownTCP traffic detected without corresponding DNS query: 65.118.148.19
        Source: unknownTCP traffic detected without corresponding DNS query: 173.151.241.139

        System Summary

        barindex
        Malicious sample detected (through community Yara rule)
        Source: Nmg21us74I, type: SAMPLEMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
        Source: Nmg21us74I, type: SAMPLEMatched rule: Detects ELF malware Mirai related Author: Florian Roth
        Source: 6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
        Source: 6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
        Source: 6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
        Source: 6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
        Source: 6252.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
        Source: 6252.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
        Source: 6236.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
        Source: 6236.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
        Source: Nmg21us74I, type: SAMPLEMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
        Source: Nmg21us74I, type: SAMPLEMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
        Source: 6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
        Source: 6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
        Source: 6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
        Source: 6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
        Source: 6252.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
        Source: 6252.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
        Source: 6236.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
        Source: 6236.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: /tmp/Nmg21us74I (PID: 6234)SIGKILL sent: pid: 936, result: successful
        Source: /tmp/Nmg21us74I (PID: 6250)SIGKILL sent: pid: 6234, result: successful
        Source: /tmp/Nmg21us74I (PID: 6250)SIGKILL sent: pid: 936, result: successful
        Source: /tmp/Nmg21us74I (PID: 6250)SIGKILL sent: pid: 759, result: successful
        Source: classification engineClassification label: mal88.troj.evad.lin@0/0@0/0
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/491/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/793/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/772/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/796/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/774/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/797/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/777/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/799/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/658/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/912/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/759/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/936/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/918/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/1/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/761/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/785/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/884/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/720/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/721/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/788/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/789/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/800/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/801/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/847/fd
        Source: /tmp/Nmg21us74I (PID: 6234)File opened: /proc/904/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/6234/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2033/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2033/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1582/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1582/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2275/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2275/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/6191/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/6191/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/3088/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/6190/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/6190/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1612/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1612/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1579/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1579/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1699/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1699/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1335/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1335/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1698/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1698/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2028/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2028/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1334/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1334/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1576/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1576/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2302/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2302/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/3236/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/3236/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2025/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2025/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2146/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2146/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/910/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/912/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/912/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/912/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/759/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/759/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/759/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/517/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2307/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2307/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/918/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/918/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/918/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/6243/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/6244/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1594/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1594/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2285/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2285/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2281/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2281/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1349/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1349/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1623/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1623/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/761/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/761/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/761/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1622/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1622/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/884/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/884/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/884/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1983/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1983/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2038/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/2038/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1586/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1586/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1465/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1465/exe
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1344/fd
        Source: /tmp/Nmg21us74I (PID: 6250)File opened: /proc/1344/exe

        Hooking and other Techniques for Hiding and Protection

        barindex
        Sample deletes itself
        Source: /tmp/Nmg21us74I (PID: 6230)File: /tmp/Nmg21us74IJump to behavior
        Uses known network protocols on non-standard ports
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46570
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46574
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46582
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46590
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46596
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46600
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46602
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46604
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46606
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 46608
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55188
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55200
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55210
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55226
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55230
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55232
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55234
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55238
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55240
        Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 55242
        Source: /tmp/Nmg21us74I (PID: 6230)Queries kernel information via 'uname':
        Source: Nmg21us74I, 6230.1.0000565170586000.00005651706b4000.rw-.sdmp, Nmg21us74I, 6234.1.0000565170586000.00005651706b4000.rw-.sdmp, Nmg21us74I, 6236.1.0000565170586000.00005651706b4000.rw-.sdmp, Nmg21us74I, 6252.1.0000565170586000.00005651706b4000.rw-.sdmpBinary or memory string: YpQV!/etc/qemu-binfmt/arm
        Source: Nmg21us74I, 6230.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp, Nmg21us74I, 6234.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp, Nmg21us74I, 6236.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp, Nmg21us74I, 6252.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmpBinary or memory string: K x86_64/usr/bin/qemu-arm/tmp/Nmg21us74ISUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Nmg21us74I
        Source: Nmg21us74I, 6230.1.0000565170586000.00005651706b4000.rw-.sdmp, Nmg21us74I, 6234.1.0000565170586000.00005651706b4000.rw-.sdmp, Nmg21us74I, 6236.1.0000565170586000.00005651706b4000.rw-.sdmp, Nmg21us74I, 6252.1.0000565170586000.00005651706b4000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: Nmg21us74I, 6230.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp, Nmg21us74I, 6234.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp, Nmg21us74I, 6236.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmp, Nmg21us74I, 6252.1.00007ffdcab61000.00007ffdcab82000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

        Stealing of Sensitive Information

        barindex
        Yara detected Mirai
        Source: Yara matchFile source: dump.pcap, type: PCAP
        Source: Yara matchFile source: Nmg21us74I, type: SAMPLE
        Source: Yara matchFile source: 6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6252.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6236.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY

        Remote Access Functionality

        barindex
        Yara detected Mirai
        Source: Yara matchFile source: dump.pcap, type: PCAP
        Source: Yara matchFile source: Nmg21us74I, type: SAMPLE
        Source: Yara matchFile source: 6234.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6230.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6252.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6236.1.00007f86f4017000.00007f86f4027000.r-x.sdmp, type: MEMORY

        Mitre Att&ck Matrix

        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
        Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
        File Deletion        		1
        OS Credential Dumping        		11
        Security Software Discovery        		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
        Encrypted Channel        		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
        Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
        Non-Standard Port        		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
        Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
        Application Layer Protocol        		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

        Malware Configuration

        ⊘No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 679506 Sample: Nmg21us74I Startdate: 05/08/2022 Architecture: LINUX Score: 88 25 209.92.249.69 WINDSTREAMUS United States 2->25 27 196.135.11.103, 23 Vodafone-EG Egypt 2->27 29 98 other IPs or domains 2->29 31 Malicious sample detected (through community Yara rule) 2->31 33 Antivirus / Scanner detection for submitted sample 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 2 other signatures 2->37 8 Nmg21us74I 2->8         started        signatures3 process4 signatures5 39 Sample deletes itself 8->39 11 Nmg21us74I 8->11         started        13 Nmg21us74I 8->13         started        15 Nmg21us74I 8->15         started        17 Nmg21us74I 8->17         started        process6 process7 19 Nmg21us74I 11->19         started        21 Nmg21us74I 11->21         started        23 Nmg21us74I 11->23         started       

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        Nmg21us74I58%VirustotalBrowse
        Nmg21us74I68%ReversingLabsLinux.Trojan.Mirai
        Nmg21us74I100%AviraLINUX/Mirai.bonb

        Dropped Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        ⊘No Antivirus matches

        Domains and IPs

        Contacted Domains

        ⊘No contacted domains info

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        105.22.224.11
        		unknownMauritius
        		37100SEACOM-ASMUfalse
        245.116.1.135
        		unknownReserved
        		unknownunknownfalse
        222.233.103.170
        		unknownKorea Republic of
        		9318SKB-ASSKBroadbandCoLtdKRfalse
        246.9.2.21
        		unknownReserved
        		unknownunknownfalse
        157.3.239.204
        		unknownJapan7671MCNETNTTSmartConnectCorporationJPfalse
        108.178.45.135
        		unknownUnited States
        		32475SINGLEHOP-LLCUSfalse
        18.229.102.137
        		unknownUnited States
        		16509AMAZON-02USfalse
        32.160.66.218
        		unknownUnited States
        		2686ATGS-MMD-ASUSfalse
        53.16.36.106
        		unknownGermany
        		31399DAIMLER-ASITIGNGlobalNetworkDEfalse
        76.28.59.66
        		unknownUnited States
        		7922COMCAST-7922USfalse
        121.92.158.157
        		unknownJapan2510INFOWEBFUJITSULIMITEDJPfalse
        223.201.67.26
        		unknownChina
        		4782GSNETDataCommunicationBusinessGroupTWfalse
        246.109.35.181
        		unknownReserved
        		unknownunknownfalse
        141.52.191.37
        		unknownGermany
        		34878KITKarlsruheInstituteofTechnologyDEfalse
        77.69.178.110
        		unknownBahrain
        		5416InternetServiceProviderBHfalse
        133.192.104.39
        		unknownJapan2516KDDIKDDICORPORATIONJPfalse
        32.48.63.177
        		unknownUnited States
        		7018ATT-INTERNET4USfalse
        75.36.168.76
        		unknownUnited States
        		7018ATT-INTERNET4USfalse
        100.173.129.169
        		unknownUnited States
        		21928T-MOBILE-AS21928USfalse
        141.227.0.199
        		unknownFrance
        		21070TOTALFRfalse
        120.169.246.82
        		unknownIndonesia
        		4761INDOSAT-INP-APINDOSATInternetNetworkProviderIDfalse
        209.92.249.69
        		unknownUnited States
        		7029WINDSTREAMUSfalse
        54.140.144.36
        		unknownUnited States
        		14618AMAZON-AESUSfalse
        111.231.40.22
        		unknownChina
        		45090CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompafalse
        254.106.28.224
        		unknownReserved
        		unknownunknownfalse
        166.117.52.131
        		unknownUnited States
        		58681NSWPOLSERV-AS-APNewSouthWalesPoliceAUfalse
        196.135.11.103
        		unknownEgypt
        		36935Vodafone-EGfalse
        104.80.152.99
        		unknownUnited States
        		16625AKAMAI-ASUSfalse
        98.173.208.29
        		unknownUnited States
        		22773ASN-CXA-ALL-CCI-22773-RDCUSfalse
        179.53.118.76
        		unknownDominican Republic
        		6400CompaniaDominicanadeTelefonosSADOfalse
        90.192.140.251
        		unknownUnited Kingdom
        		5607BSKYB-BROADBAND-ASGBfalse
        16.11.95.214
        		unknownUnited States
        		unknownunknownfalse
        186.178.15.174
        		unknownEcuador
        		28006CORPORACIONNACIONALDETELECOMUNICACIONES-CNTEPECfalse
        13.71.171.245
        		unknownUnited States
        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        94.146.159.116
        		unknownDenmark
        		9158TELENOR_DANMARK_ASDKfalse
        118.150.116.140
        		unknownTaiwan; Republic of China (ROC)
        		18419DADA-AS-TWDaDaBroadbandLTDTWfalse
        170.131.82.35
        		unknownUnited States
        		13954STAPLESUSfalse
        89.248.107.35
        		unknownSpain
        		48348CLOUDBUILDERSESfalse
        197.53.119.202
        		unknownEgypt
        		8452TE-ASTE-ASEGfalse
        57.5.138.225
        		unknownBelgium
        		2686ATGS-MMD-ASUSfalse
        191.153.57.180
        		unknownColombia
        		26611COMCELSACOfalse
        93.123.76.73
        		unknownBulgaria
        		43561NET1-ASBGfalse
        208.41.137.69
        		unknownUnited States
        		4565MEGAPATH2-USfalse
        197.161.195.3
        		unknownEgypt
        		24863LINKdotNET-ASEGfalse
        220.65.188.96
        		unknownKorea Republic of
        		9316DACOM-PUBNETPLUS-AS-KRDACOM-PUBNETPLUSKRfalse
        81.211.32.43
        		unknownRussian Federation
        		3216SOVAM-ASRUfalse
        117.142.30.125
        		unknownChina
        		56040CMNET-GUANGDONG-APChinaMobilecommunicationscorporationfalse
        203.54.162.175
        		unknownAustralia
        		1221ASN-TELSTRATelstraCorporationLtdAUfalse
        88.125.239.228
        		unknownFrance
        		12322PROXADFRfalse
        210.84.92.204
        		unknownAustralia
        		703UUNETUSfalse
        73.233.169.114
        		unknownUnited States
        		7922COMCAST-7922USfalse
        51.14.10.117
        		unknownUnited Kingdom
        		2856BT-UK-ASBTnetUKRegionalnetworkGBfalse
        124.28.140.227
        		unknownKorea Republic of
        		23578NAMDONGNET-AS-KRTBROADSaeromNamdongSeohaebroadcastingKRfalse
        162.119.15.38
        		unknownUnited States
        		3379KAISER-NCALUSfalse
        185.41.237.242
        		unknownBelgium
        		199942CHEOPSBEfalse
        45.1.177.213
        		unknownUnited States
        		7377UCSDUSfalse
        43.110.214.123
        		unknownJapan4249LILLY-ASUSfalse
        14.245.235.120
        		unknownViet Nam
        		45899VNPT-AS-VNVNPTCorpVNfalse
        111.208.128.52
        		unknownChina
        		4808CHINA169-BJChinaUnicomBeijingProvinceNetworkCNfalse
        72.137.191.183
        		unknownCanada
        		812ROGERS-COMMUNICATIONSCAfalse
        160.39.196.228
        		unknownUnited States
        		14COLUMBIA-GWUSfalse
        181.104.155.22
        		unknownArgentina
        		6147TelefonicadelPeruSAAPEfalse
        82.221.170.8
        		unknownIceland
        		30818IS-ADVANIA-TRANSITISfalse
        66.141.134.12
        		unknownUnited States
        		7018ATT-INTERNET4USfalse
        121.137.201.237
        		unknownKorea Republic of
        		4766KIXS-AS-KRKoreaTelecomKRfalse
        172.7.251.188
        		unknownUnited States
        		7018ATT-INTERNET4USfalse
        252.163.150.243
        		unknownReserved
        		unknownunknownfalse
        122.114.141.69
        		unknownChina
        		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
        153.161.19.176
        		unknownJapan4713OCNNTTCommunicationsCorporationJPfalse
        124.94.70.87
        		unknownChina
        		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
        75.50.159.107
        		unknownUnited States
        		7018ATT-INTERNET4USfalse
        162.5.54.167
        		unknownUnited States
        		33348PIERCE-COUNTYUSfalse
        201.68.106.106
        		unknownBrazil
        		27699TELEFONICABRASILSABRfalse
        44.78.82.191
        		unknownUnited States
        		7377UCSDUSfalse
        67.0.96.13
        		unknownUnited States
        		209CENTURYLINK-US-LEGACY-QWESTUSfalse
        244.53.184.180
        		unknownReserved
        		unknownunknownfalse
        151.168.66.12
        		unknownUnited States
        		45025EDN-ASUAfalse
        112.107.186.81
        		unknownKorea Republic of
        		6619SAMSUNGSDS-AS-KRSamsungSDSIncKRfalse
        145.22.219.194
        		unknownNetherlands
        		1103SURFNET-NLSURFnetTheNetherlandsNLfalse
        61.230.253.244
        		unknownTaiwan; Republic of China (ROC)
        		3462HINETDataCommunicationBusinessGroupTWfalse
        35.25.130.31
        		unknownUnited States
        		36375UMICH-AS-5USfalse
        72.155.239.236
        		unknownUnited States
        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        87.203.200.222
        		unknownGreece
        		6799OTENET-GRAthens-GreeceGRfalse
        69.234.250.41
        		unknownChina
        		7018ATT-INTERNET4USfalse
        36.96.13.140
        		unknownChina
        		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
        9.215.94.18
        		unknownUnited States
        		3356LEVEL3USfalse
        213.121.90.101
        		unknownUnited Kingdom
        		2856BT-UK-ASBTnetUKRegionalnetworkGBfalse
        152.50.33.117
        		unknownUnited States
        		81NCRENUSfalse
        194.194.0.57
        		unknownEuropean Union
        		2686ATGS-MMD-ASUSfalse
        243.144.161.246
        		unknownReserved
        		unknownunknownfalse
        159.86.109.59
        		unknownUnited Kingdom
        		1945FR-LYRESLyonRechercheetEnseignementSuperieurLyRESEfalse
        75.10.61.95
        		unknownUnited States
        		7018ATT-INTERNET4USfalse
        113.20.55.68
        		unknownNew Caledonia
        		45461TELENET-AS-APTeleNetNCfalse
        117.71.137.154
        		unknownChina
        		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
        182.9.51.16
        		unknownIndonesia
        		23693TELKOMSEL-ASN-IDPTTelekomunikasiSelularIDfalse
        93.56.245.69
        		unknownItaly
        		12874FASTWEBITfalse
        24.75.110.232
        		unknownUnited States
        		3356LEVEL3USfalse
        121.45.181.169
        		unknownAustralia
        		4739INTERNODE-ASInternodePtyLtdAUfalse
        112.167.3.3
        		unknownKorea Republic of
        		4766KIXS-AS-KRKoreaTelecomKRfalse
        197.204.101.39
        		unknownAlgeria
        		36947ALGTEL-ASDZfalse

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        ⊘No created / dropped files found

        Static File Info

        General

        File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
        Entropy (8bit):6.056530017553513
        TrID:
        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
        File name:Nmg21us74I
        File size:63948
        MD5:01ec15a16805e0b57d0ef42097dca5ec
        SHA1:d9ea867164e9ad0c1901b85c8f18174743e1a0b4
        SHA256:a3946c00d0daf54a7e99a22e731dbc7977936ef6c9591dd0ae2a45632626b357
        SHA512:d00a10fb66a353b990d03e0493b049f922b3c736ccfb88e40b4da84a398a48c99b2115f5eb2185ebf08bb062511927db0003ad567859ab47d2c25816eba28912
        SSDEEP:768:zHnEczUZv4tZy6hQfyjXI8CMRxYVsx/DeiZvspz1Y3W7wCVy/Jx+5H8hG1rmCd/4:rEFZEZyjyj48NCiZvsphYceZWTMWCBW
        TLSH:D453F8827D81AA16C7C05777FE1F018D3319A798E0EA73438C191BA17ACED1F0D6B65A
        File Content Preview:.ELF...a..........(.........4...<.......4. ...(.....................................................,...............Q.td..................................-...L."....:..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

        Static ELF Info

        ELF header

        Class:ELF32
        Data:2's complement, little endian
        Version:1 (current)
        Machine:ARM
        Version Number:0x1
        Type:EXEC (Executable file)
        OS/ABI:ARM - ABI
        ABI Version:0
        Entry Point Address:0x8190
        Flags:0x2
        ELF Header Size:52
        Program Header Offset:52
        Program Header Size:32
        Number of Program Headers:3
        Section Header Offset:63548
        Section Header Size:40
        Number of Section Headers:10
        Header String Table Index:9

        Sections

        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
        NULL0x00x00x00x00x0000
        .initPROGBITS0x80940x940x180x00x6AX004
        .textPROGBITS0x80b00xb00xea500x00x6AX0016
        .finiPROGBITS0x16b000xeb000x140x00x6AX004
        .rodataPROGBITS0x16b140xeb140xab80x00x2A004
        .ctorsPROGBITS0x1f5d00xf5d00x80x00x3WA004
        .dtorsPROGBITS0x1f5d80xf5d80x80x00x3WA004
        .dataPROGBITS0x1f5e40xf5e40x2180x00x3WA004
        .bssNOBITS0x1f7fc0xf7fc0x5780x00x3WA004
        .shstrtabSTRTAB0x00xf7fc0x3e0x00x0001

        Program Segments

        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
        LOAD0x00x80000x80000xf5cc0xf5cc6.08100x5R E0x8000.init .text .fini .rodata
        LOAD0xf5d00x1f5d00x1f5d00x22c0x7a42.93550x6RW 0x8000.ctors .dtors .data .bss
        GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

        Network Behavior

        Network Port Distribution

        TCP Packets

        TimestampSource PortDest PortSource IPDest IP
        Aug 5, 2022 22:23:04.812733889 CEST42836443192.168.2.2391.189.91.43
        Aug 5, 2022 22:23:05.068660021 CEST4251680192.168.2.23109.202.202.202
        Aug 5, 2022 22:23:08.000996113 CEST3377523192.168.2.23247.69.125.15
        Aug 5, 2022 22:23:08.001143932 CEST3377523192.168.2.2389.62.97.13
        Aug 5, 2022 22:23:08.001148939 CEST3377523192.168.2.23201.64.150.235
        Aug 5, 2022 22:23:08.001164913 CEST3377523192.168.2.2399.33.248.85
        Aug 5, 2022 22:23:08.001185894 CEST3377523192.168.2.23201.133.179.101
        Aug 5, 2022 22:23:08.001262903 CEST3377523192.168.2.23123.213.193.207
        Aug 5, 2022 22:23:08.001267910 CEST3377523192.168.2.231.55.165.112
        Aug 5, 2022 22:23:08.001277924 CEST3377523192.168.2.2324.220.186.101
        Aug 5, 2022 22:23:08.001302004 CEST3377523192.168.2.23171.190.215.92
        Aug 5, 2022 22:23:08.001327038 CEST3377523192.168.2.2374.219.179.190
        Aug 5, 2022 22:23:08.001328945 CEST3377523192.168.2.2368.55.130.165
        Aug 5, 2022 22:23:08.001338959 CEST3377523192.168.2.23185.134.162.198
        Aug 5, 2022 22:23:08.001343966 CEST3377523192.168.2.23186.120.206.202
        Aug 5, 2022 22:23:08.001388073 CEST3377523192.168.2.2377.237.72.112
        Aug 5, 2022 22:23:08.001415968 CEST3377523192.168.2.23174.100.78.43
        Aug 5, 2022 22:23:08.001435041 CEST3377523192.168.2.23223.213.17.120
        Aug 5, 2022 22:23:08.001441002 CEST3377523192.168.2.23115.70.188.226
        Aug 5, 2022 22:23:08.001473904 CEST3377523192.168.2.23246.88.72.79
        Aug 5, 2022 22:23:08.001493931 CEST3377523192.168.2.2374.4.255.140
        Aug 5, 2022 22:23:08.001499891 CEST3377523192.168.2.23102.96.34.54
        Aug 5, 2022 22:23:08.001516104 CEST3377523192.168.2.2332.126.77.119
        Aug 5, 2022 22:23:08.001543999 CEST3377523192.168.2.23112.187.57.147
        Aug 5, 2022 22:23:08.001579046 CEST3377523192.168.2.23203.108.232.50
        Aug 5, 2022 22:23:08.001606941 CEST3377523192.168.2.23193.38.42.40
        Aug 5, 2022 22:23:08.001655102 CEST3377523192.168.2.23247.249.136.144
        Aug 5, 2022 22:23:08.001668930 CEST3377523192.168.2.2392.175.108.39
        Aug 5, 2022 22:23:08.001677990 CEST3377523192.168.2.23217.67.41.171
        Aug 5, 2022 22:23:08.001705885 CEST3377523192.168.2.2314.179.207.111
        Aug 5, 2022 22:23:08.001739979 CEST3377523192.168.2.2340.187.84.210
        Aug 5, 2022 22:23:08.002356052 CEST3377523192.168.2.2316.28.78.124
        Aug 5, 2022 22:23:08.002379894 CEST3377523192.168.2.23176.2.125.141
        Aug 5, 2022 22:23:08.002427101 CEST3377523192.168.2.2346.15.198.202
        Aug 5, 2022 22:23:08.002443075 CEST3377523192.168.2.23190.75.209.114
        Aug 5, 2022 22:23:08.004472017 CEST3377523192.168.2.23117.38.60.242
        Aug 5, 2022 22:23:08.004477024 CEST3377523192.168.2.23167.69.41.250
        Aug 5, 2022 22:23:08.004506111 CEST3377523192.168.2.23161.24.53.149
        Aug 5, 2022 22:23:08.004513025 CEST3377523192.168.2.2383.225.24.201
        Aug 5, 2022 22:23:08.004525900 CEST3377523192.168.2.23176.136.18.174
        Aug 5, 2022 22:23:08.004544020 CEST3377523192.168.2.2359.246.10.175
        Aug 5, 2022 22:23:08.004587889 CEST3377523192.168.2.2395.2.3.253
        Aug 5, 2022 22:23:08.004616976 CEST3377523192.168.2.23197.117.13.64
        Aug 5, 2022 22:23:08.004616022 CEST3377523192.168.2.23193.219.10.16
        Aug 5, 2022 22:23:08.004647970 CEST3377523192.168.2.23255.10.234.164
        Aug 5, 2022 22:23:08.004654884 CEST3377523192.168.2.23117.20.163.155
        Aug 5, 2022 22:23:08.004657984 CEST3377523192.168.2.23242.36.164.230
        Aug 5, 2022 22:23:08.004687071 CEST3377523192.168.2.23186.200.170.6
        Aug 5, 2022 22:23:08.004698038 CEST3377523192.168.2.2394.33.47.97
        Aug 5, 2022 22:23:08.004736900 CEST3377523192.168.2.2319.183.144.84
        Aug 5, 2022 22:23:08.004743099 CEST3377523192.168.2.23142.183.217.180
        Aug 5, 2022 22:23:08.004750013 CEST3377523192.168.2.2365.118.148.19
        Aug 5, 2022 22:23:08.004770041 CEST3377523192.168.2.23173.151.241.139
        Aug 5, 2022 22:23:08.004774094 CEST3377523192.168.2.2369.168.167.79
        Aug 5, 2022 22:23:08.004775047 CEST3377523192.168.2.23176.139.44.160
        Aug 5, 2022 22:23:08.004789114 CEST3377523192.168.2.23149.192.46.215
        Aug 5, 2022 22:23:08.004796028 CEST3377523192.168.2.23175.242.2.141
        Aug 5, 2022 22:23:08.004805088 CEST3377523192.168.2.238.46.145.43
        Aug 5, 2022 22:23:08.004832029 CEST3377523192.168.2.2371.185.19.208
        Aug 5, 2022 22:23:08.004858017 CEST3377523192.168.2.23246.93.180.34
        Aug 5, 2022 22:23:08.004869938 CEST3377523192.168.2.23142.154.105.13
        Aug 5, 2022 22:23:08.004884958 CEST3377523192.168.2.23243.229.146.92
        Aug 5, 2022 22:23:08.004884958 CEST3377523192.168.2.23114.122.111.179
        Aug 5, 2022 22:23:08.004911900 CEST3377523192.168.2.2344.60.110.162
        Aug 5, 2022 22:23:08.004924059 CEST3377523192.168.2.23249.64.13.200
        Aug 5, 2022 22:23:08.004990101 CEST3377523192.168.2.2323.16.247.61
        Aug 5, 2022 22:23:08.005002975 CEST3377523192.168.2.23135.33.19.64
        Aug 5, 2022 22:23:08.005023003 CEST3377523192.168.2.2314.138.57.47
        Aug 5, 2022 22:23:08.005029917 CEST3377523192.168.2.23116.101.219.134
        Aug 5, 2022 22:23:08.005039930 CEST3377523192.168.2.23111.36.109.149
        Aug 5, 2022 22:23:08.005073071 CEST3377523192.168.2.23148.142.140.111
        Aug 5, 2022 22:23:08.005088091 CEST3377523192.168.2.23249.144.151.180
        Aug 5, 2022 22:23:08.005100965 CEST3377523192.168.2.23186.78.38.128
        Aug 5, 2022 22:23:08.005111933 CEST3377523192.168.2.2367.255.197.100
        Aug 5, 2022 22:23:08.005132914 CEST3377523192.168.2.2393.217.14.95
        Aug 5, 2022 22:23:08.005153894 CEST3377523192.168.2.23243.167.218.87
        Aug 5, 2022 22:23:08.005162954 CEST3377523192.168.2.2366.89.19.137
        Aug 5, 2022 22:23:08.005170107 CEST3377523192.168.2.23196.170.83.100
        Aug 5, 2022 22:23:08.005192995 CEST3377523192.168.2.2399.63.243.34
        Aug 5, 2022 22:23:08.005225897 CEST3377523192.168.2.2393.246.24.158
        Aug 5, 2022 22:23:08.005237103 CEST3377523192.168.2.23208.57.43.157
        Aug 5, 2022 22:23:08.005249977 CEST3377523192.168.2.2372.254.89.34
        Aug 5, 2022 22:23:08.005268097 CEST3377523192.168.2.23131.253.49.46
        Aug 5, 2022 22:23:08.005280972 CEST3377523192.168.2.23193.105.74.102
        Aug 5, 2022 22:23:08.005290985 CEST3377523192.168.2.23122.251.67.178
        Aug 5, 2022 22:23:08.005294085 CEST3377523192.168.2.2364.56.252.111
        Aug 5, 2022 22:23:08.005306005 CEST3377523192.168.2.23200.187.16.47
        Aug 5, 2022 22:23:08.005346060 CEST3377523192.168.2.23158.93.232.145
        Aug 5, 2022 22:23:08.005358934 CEST3377523192.168.2.23201.110.197.145
        Aug 5, 2022 22:23:08.005377054 CEST3377523192.168.2.23111.116.87.159
        Aug 5, 2022 22:23:08.005379915 CEST3377523192.168.2.2312.142.42.20
        Aug 5, 2022 22:23:08.005382061 CEST3377523192.168.2.23117.43.104.140
        Aug 5, 2022 22:23:08.005394936 CEST3377523192.168.2.2390.237.150.122
        Aug 5, 2022 22:23:08.005400896 CEST3377523192.168.2.23174.192.134.47
        Aug 5, 2022 22:23:08.005407095 CEST3377523192.168.2.2312.119.98.186
        Aug 5, 2022 22:23:08.005415916 CEST3377523192.168.2.2340.241.249.249
        Aug 5, 2022 22:23:08.005466938 CEST3377523192.168.2.23147.123.207.193
        Aug 5, 2022 22:23:08.005481005 CEST3377523192.168.2.23243.57.229.9
        Aug 5, 2022 22:23:08.005502939 CEST3377523192.168.2.2346.36.212.62
        Aug 5, 2022 22:23:08.005508900 CEST3377523192.168.2.2353.250.143.203

        System Behavior

        General

        Start time:22:23:04
        Start date:05/08/2022
        Path:/tmp/Nmg21us74I
        Arguments:/tmp/Nmg21us74I
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

        General

        Start time:22:23:07
        Start date:05/08/2022
        Path:/tmp/Nmg21us74I
        Arguments:n/a
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

        General

        Start time:22:23:07
        Start date:05/08/2022
        Path:/tmp/Nmg21us74I
        Arguments:n/a
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

        General

        Start time:22:23:07
        Start date:05/08/2022
        Path:/tmp/Nmg21us74I
        Arguments:n/a
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

        General

        Start time:22:23:07
        Start date:05/08/2022
        Path:/tmp/Nmg21us74I
        Arguments:n/a
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

        General

        Start time:22:23:14
        Start date:05/08/2022
        Path:/tmp/Nmg21us74I
        Arguments:n/a
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

        General

        Start time:22:23:14
        Start date:05/08/2022
        Path:/tmp/Nmg21us74I
        Arguments:n/a
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

        General

        Start time:22:23:14
        Start date:05/08/2022
        Path:/tmp/Nmg21us74I
        Arguments:n/a
        File size:4956856 bytes
        MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1