Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
HUIHmcbfpW

Overview

General Information

Sample Name:HUIHmcbfpW
Analysis ID:680642
MD5:7463d28ae705f29277567f6888315855
SHA1:ca0836b4c352f1dd91a77422b952987f466f40e3
SHA256:ed29224a554dd58df35208de727e297679bcbe2101d877e67736986deecffa8f
Tags:32elfmiraipowerpc
Infos:

Detection

Mirai
Score:72
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
ELF contains segments with high entropy indicating compressed/encrypted content

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:35.0.0 Citrine
Analysis ID:680642
Start date and time: 08/08/202223:06:112022-08-08 23:06:11 +02:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 7m 2s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:HUIHmcbfpW
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal72.troj.evad.lin@0/0@0/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Runtime Messages

Command:/tmp/HUIHmcbfpW
PID:6226
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    6336.1.00007f8a6400b000.00007f8a64010000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0x41d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x41e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x41f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x420c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x425c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x434c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    6336.1.00007f8a6400b000.00007f8a64010000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0x4728:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    6229.1.00007f8a6400b000.00007f8a64010000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0x41d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x41e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x41f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x420c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x425c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x434c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    6229.1.00007f8a6400b000.00007f8a64010000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0x4728:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    6228.1.00007f8a6400b000.00007f8a64010000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0x41d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x41e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x41f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x420c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x425c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x42fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x434c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x4360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    Click to see the 22 entries

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Multi AV Scanner detection for submitted file
    Source: HUIHmcbfpWVirustotal: Detection: 41%Perma Link

    Networking

    barindex
    Uses known network protocols on non-standard ports
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52774
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52804
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52824
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52834
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52838
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52844
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52850
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52856
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52864
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52870
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:35686 -> 208.67.106.33:1312
    Source: /tmp/HUIHmcbfpW (PID: 6228)Socket: 0.0.0.0::0
    Source: /tmp/HUIHmcbfpW (PID: 6234)Socket: 0.0.0.0::0
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
    Source: unknownTCP traffic detected without corresponding DNS query: 208.67.106.33
    Source: unknownTCP traffic detected without corresponding DNS query: 208.67.106.33
    Source: unknownTCP traffic detected without corresponding DNS query: 208.67.106.33
    Source: unknownTCP traffic detected without corresponding DNS query: 34.196.200.1
    Source: unknownTCP traffic detected without corresponding DNS query: 213.223.108.162
    Source: unknownTCP traffic detected without corresponding DNS query: 202.126.138.58
    Source: unknownTCP traffic detected without corresponding DNS query: 118.55.100.58
    Source: unknownTCP traffic detected without corresponding DNS query: 179.100.216.194
    Source: unknownTCP traffic detected without corresponding DNS query: 196.207.30.117
    Source: unknownTCP traffic detected without corresponding DNS query: 24.115.44.80
    Source: unknownTCP traffic detected without corresponding DNS query: 165.14.99.245
    Source: unknownTCP traffic detected without corresponding DNS query: 243.55.137.136
    Source: unknownTCP traffic detected without corresponding DNS query: 184.99.170.148
    Source: unknownTCP traffic detected without corresponding DNS query: 216.72.48.251
    Source: unknownTCP traffic detected without corresponding DNS query: 63.87.34.207
    Source: unknownTCP traffic detected without corresponding DNS query: 85.191.128.179
    Source: unknownTCP traffic detected without corresponding DNS query: 178.117.176.43
    Source: unknownTCP traffic detected without corresponding DNS query: 250.121.216.21
    Source: unknownTCP traffic detected without corresponding DNS query: 172.99.97.86
    Source: unknownTCP traffic detected without corresponding DNS query: 85.85.156.204
    Source: unknownTCP traffic detected without corresponding DNS query: 247.143.53.199
    Source: unknownTCP traffic detected without corresponding DNS query: 153.195.100.147
    Source: unknownTCP traffic detected without corresponding DNS query: 20.162.48.51
    Source: unknownTCP traffic detected without corresponding DNS query: 83.100.124.145
    Source: unknownTCP traffic detected without corresponding DNS query: 202.95.72.248
    Source: unknownTCP traffic detected without corresponding DNS query: 218.72.48.7
    Source: unknownTCP traffic detected without corresponding DNS query: 81.83.174.195
    Source: unknownTCP traffic detected without corresponding DNS query: 184.55.253.24
    Source: unknownTCP traffic detected without corresponding DNS query: 95.227.201.237
    Source: unknownTCP traffic detected without corresponding DNS query: 148.193.195.219
    Source: unknownTCP traffic detected without corresponding DNS query: 135.73.167.4
    Source: unknownTCP traffic detected without corresponding DNS query: 81.116.113.66
    Source: unknownTCP traffic detected without corresponding DNS query: 74.67.21.210
    Source: unknownTCP traffic detected without corresponding DNS query: 60.67.32.108
    Source: unknownTCP traffic detected without corresponding DNS query: 124.91.82.9
    Source: unknownTCP traffic detected without corresponding DNS query: 164.124.144.11
    Source: unknownTCP traffic detected without corresponding DNS query: 57.136.201.248
    Source: unknownTCP traffic detected without corresponding DNS query: 144.3.73.153
    Source: unknownTCP traffic detected without corresponding DNS query: 4.160.44.112
    Source: unknownTCP traffic detected without corresponding DNS query: 182.54.215.204
    Source: unknownTCP traffic detected without corresponding DNS query: 161.144.42.95
    Source: unknownTCP traffic detected without corresponding DNS query: 159.248.85.135
    Source: unknownTCP traffic detected without corresponding DNS query: 159.165.131.77
    Source: unknownTCP traffic detected without corresponding DNS query: 183.202.75.168
    Source: unknownTCP traffic detected without corresponding DNS query: 37.208.213.227
    Source: unknownTCP traffic detected without corresponding DNS query: 152.128.119.234
    Source: unknownTCP traffic detected without corresponding DNS query: 196.53.232.254
    Source: unknownTCP traffic detected without corresponding DNS query: 45.100.207.75
    Source: unknownTCP traffic detected without corresponding DNS query: 218.13.131.203
    Source: HUIHmcbfpWString found in binary or memory: http://upx.sf.net

    System Summary

    barindex
    Malicious sample detected (through community Yara rule)
    Source: 6336.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: 6336.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: 6229.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: 6229.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: 6228.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: 6228.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: 6342.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: 6342.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: 6330.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: 6330.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: 6235.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: 6235.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: 6325.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: 6325.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: 6226.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: 6226.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: Process Memory Space: HUIHmcbfpW PID: 6228, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: Process Memory Space: HUIHmcbfpW PID: 6228, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: Process Memory Space: HUIHmcbfpW PID: 6229, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: Process Memory Space: HUIHmcbfpW PID: 6229, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: Process Memory Space: HUIHmcbfpW PID: 6235, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: Process Memory Space: HUIHmcbfpW PID: 6235, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: Process Memory Space: HUIHmcbfpW PID: 6330, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: Process Memory Space: HUIHmcbfpW PID: 6330, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: Process Memory Space: HUIHmcbfpW PID: 6336, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: Process Memory Space: HUIHmcbfpW PID: 6336, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
    Source: Process Memory Space: HUIHmcbfpW PID: 6342, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
    Source: LOAD without section mappingsProgram segment: 0x100000
    Source: 6336.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: 6336.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: 6229.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: 6229.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: 6228.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: 6228.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: 6342.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: 6342.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: 6330.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: 6330.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: 6235.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: 6235.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: 6325.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: 6325.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: 6226.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: 6226.1.00007f8a6400b000.00007f8a64010000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: Process Memory Space: HUIHmcbfpW PID: 6228, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: Process Memory Space: HUIHmcbfpW PID: 6228, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: Process Memory Space: HUIHmcbfpW PID: 6229, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: Process Memory Space: HUIHmcbfpW PID: 6229, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: Process Memory Space: HUIHmcbfpW PID: 6235, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: Process Memory Space: HUIHmcbfpW PID: 6235, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: Process Memory Space: HUIHmcbfpW PID: 6330, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: Process Memory Space: HUIHmcbfpW PID: 6330, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: Process Memory Space: HUIHmcbfpW PID: 6336, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: Process Memory Space: HUIHmcbfpW PID: 6336, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
    Source: Process Memory Space: HUIHmcbfpW PID: 6342, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
    Source: /tmp/HUIHmcbfpW (PID: 6228)SIGKILL sent: pid: 936, result: successful
    Source: /tmp/HUIHmcbfpW (PID: 6234)SIGKILL sent: pid: 936, result: successful
    Source: classification engineClassification label: mal72.troj.evad.lin@0/0@0/0

    Data Obfuscation

    barindex
    Sample is packed with UPX
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/491/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/793/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/772/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/796/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/774/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/797/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/777/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/799/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/658/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/912/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/759/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/936/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/918/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/1/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/761/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/785/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/884/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/720/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/721/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/788/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/789/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/800/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/801/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/847/fd
    Source: /tmp/HUIHmcbfpW (PID: 6234)File opened: /proc/904/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/491/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/793/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/772/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/796/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/774/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/797/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/777/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/799/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/658/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/912/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/759/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/936/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/918/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/1/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/761/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/785/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/884/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/720/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/721/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/788/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/789/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/800/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/801/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/847/fd
    Source: /tmp/HUIHmcbfpW (PID: 6228)File opened: /proc/904/fd

    Hooking and other Techniques for Hiding and Protection

    barindex
    Uses known network protocols on non-standard ports
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52774
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52804
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52824
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52834
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52838
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52844
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52850
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52856
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52864
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 52870
    Source: HUIHmcbfpWSubmission file: segment LOAD with 7.9313 entropy (max. 8.0)
    Source: /tmp/HUIHmcbfpW (PID: 6226)Queries kernel information via 'uname':
    Source: HUIHmcbfpW, 6226.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6228.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6325.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6342.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6330.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6229.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6336.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6235.1.00007ffda5dce000.00007ffda5def000.rw-.sdmpBinary or memory string: 8x86_64/usr/bin/qemu-ppc/tmp/HUIHmcbfpWSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/HUIHmcbfpW
    Source: HUIHmcbfpW, 6226.1.0000558ea9f73000.0000558eaa023000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
    Source: HUIHmcbfpW, 6228.1.0000558ea9f73000.0000558eaa023000.rw-.sdmp, HUIHmcbfpW, 6325.1.0000558ea9f73000.0000558eaa023000.rw-.sdmp, HUIHmcbfpW, 6342.1.0000558ea9f73000.0000558eaa023000.rw-.sdmp, HUIHmcbfpW, 6330.1.0000558ea9f73000.0000558eaa023000.rw-.sdmp, HUIHmcbfpW, 6229.1.0000558ea9f73000.0000558eaa023000.rw-.sdmp, HUIHmcbfpW, 6336.1.0000558ea9f73000.0000558eaa023000.rw-.sdmp, HUIHmcbfpW, 6235.1.0000558ea9f73000.0000558eaa023000.rw-.sdmpBinary or memory string: !/etc/qemu-binfmt/ppc1
    Source: HUIHmcbfpW, 6226.1.0000558ea9f73000.0000558eaa023000.rw-.sdmp, HUIHmcbfpW, 6228.1.0000558ea9f73000.0000558eaa023000.rw-.sdmp, HUIHmcbfpW, 6325.1.0000558ea9f73000.0000558eaa023000.rw-.sdmp, HUIHmcbfpW, 6342.1.0000558ea9f73000.0000558eaa023000.rw-.sdmp, HUIHmcbfpW, 6330.1.0000558ea9f73000.0000558eaa023000.rw-.sdmp, HUIHmcbfpW, 6229.1.0000558ea9f73000.0000558eaa023000.rw-.sdmp, HUIHmcbfpW, 6336.1.0000558ea9f73000.0000558eaa023000.rw-.sdmp, HUIHmcbfpW, 6235.1.0000558ea9f73000.0000558eaa023000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/ppc
    Source: HUIHmcbfpW, 6226.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6228.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6325.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6342.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6330.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6229.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6336.1.00007ffda5dce000.00007ffda5def000.rw-.sdmp, HUIHmcbfpW, 6235.1.00007ffda5dce000.00007ffda5def000.rw-.sdmpBinary or memory string: /usr/bin/qemu-ppc

    Stealing of Sensitive Information

    barindex
    Yara detected Mirai
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Yara detected Mirai
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
    Obfuscated Files or Information    		1
    OS Credential Dumping    		11
    Security Software Discovery    		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
    Encrypted Channel    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
    Non-Standard Port    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
    Application Layer Protocol    		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

    Malware Configuration

    ⊘No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 680642 Sample: HUIHmcbfpW Startdate: 08/08/2022 Architecture: LINUX Score: 72 42 166.103.15.250 WINDSTREAMUS Korea Republic of 2->42 44 71.20.93.194 WINDSTREAMUS United States 2->44 46 98 other IPs or domains 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 Yara detected Mirai 2->52 54 2 other signatures 2->54 10 HUIHmcbfpW 2->10         started        signatures3 process4 process5 12 HUIHmcbfpW 10->12         started        14 HUIHmcbfpW 10->14         started        16 HUIHmcbfpW 10->16         started        process6 18 HUIHmcbfpW 12->18         started        20 HUIHmcbfpW 12->20         started        22 HUIHmcbfpW 14->22         started        24 HUIHmcbfpW 14->24         started        26 HUIHmcbfpW 14->26         started        process7 28 HUIHmcbfpW 18->28         started        30 HUIHmcbfpW 18->30         started        32 HUIHmcbfpW 18->32         started        34 HUIHmcbfpW 22->34         started        36 HUIHmcbfpW 22->36         started        process8 38 HUIHmcbfpW 28->38         started        40 HUIHmcbfpW 28->40         started       

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    HUIHmcbfpW42%VirustotalBrowse

    Dropped Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Contacted Domains

    ⊘No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.netHUIHmcbfpWfalse
      		high

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      115.70.214.247
      		unknownAustralia
      		10143EXETEL-AS-APExetelPtyLtdAUfalse
      75.108.75.216
      		unknownUnited States
      		19108SUDDENLINK-COMMUNICATIONSUSfalse
      93.195.229.176
      		unknownGermany
      		3320DTAGInternetserviceprovideroperationsDEfalse
      34.133.78.216
      		unknownUnited States
      		2686ATGS-MMD-ASUSfalse
      114.199.124.68
      		unknownIndonesia
      		24525SAP-AS-IDPTSolusiAksesindoPratamaIDfalse
      218.33.69.123
      		unknownIndonesia
      		9919NCIC-TWNewCenturyInfoCommTechCoLtdTWfalse
      155.195.109.15
      		unknownUnited States
      		8698NationwideBuildingSocietyGBfalse
      183.195.9.118
      		unknownChina
      		24400CMNET-V4SHANGHAI-AS-APShanghaiMobileCommunicationsCoLtfalse
      218.131.175.97
      		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
      75.123.52.91
      		unknownUnited States
      		209CENTURYLINK-US-LEGACY-QWESTUSfalse
      213.153.202.31
      		unknownTurkey
      		34984TELLCOM-ASTRfalse
      34.81.60.26
      		unknownUnited States
      		15169GOOGLEUSfalse
      244.122.119.68
      		unknownReserved
      		unknownunknownfalse
      207.16.235.134
      		unknownUnited States
      		701UUNETUSfalse
      35.1.148.43
      		unknownUnited States
      		36375UMICH-AS-5USfalse
      41.225.142.123
      		unknownTunisia
      		37671GLOBALNET-ASTNfalse
      75.9.11.2
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      17.226.59.114
      		unknownUnited States
      		714APPLE-ENGINEERINGUSfalse
      18.8.247.30
      		unknownUnited States
      		3MIT-GATEWAYSUSfalse
      108.184.71.71
      		unknownUnited States
      		20001TWC-20001-PACWESTUSfalse
      80.94.206.63
      		unknownUnited Kingdom
      		199335TALKSTRAIGHTGBfalse
      17.11.240.42
      		unknownUnited States
      		714APPLE-ENGINEERINGUSfalse
      194.248.0.38
      		unknownNorway
      		2119TELENOR-NEXTELTelenorNorgeASNOfalse
      100.25.217.60
      		unknownUnited States
      		14618AMAZON-AESUSfalse
      150.57.210.52
      		unknownJapan17511OPTAGEOPTAGEIncJPfalse
      17.45.206.26
      		unknownUnited States
      		714APPLE-ENGINEERINGUSfalse
      1.20.112.75
      		unknownThailand
      		23969TOT-NETTOTPublicCompanyLimitedTHfalse
      169.25.164.54
      		unknownUnited States
      		37611AfrihostZAfalse
      106.17.155.36
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      123.140.76.147
      		unknownKorea Republic of
      		3786LGDACOMLGDACOMCorporationKRfalse
      40.29.213.216
      		unknownUnited States
      		4249LILLY-ASUSfalse
      27.66.85.154
      		unknownViet Nam
      		7552VIETEL-AS-APViettelGroupVNfalse
      178.255.242.149
      		unknownItaly
      		13287NIXVALIP-ASNIXVALDatacenterESfalse
      125.153.47.14
      		unknownKorea Republic of
      		4766KIXS-AS-KRKoreaTelecomKRfalse
      65.201.108.232
      		unknownUnited States
      		701UUNETUSfalse
      194.220.87.9
      		unknownSpain
      		12430VODAFONE_ESESfalse
      78.204.247.20
      		unknownFrance
      		12322PROXADFRfalse
      247.49.166.233
      		unknownReserved
      		unknownunknownfalse
      70.139.248.245
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      147.136.11.53
      		unknownUnited States
      		16753UNASSIGNEDfalse
      148.250.20.98
      		unknownMexico
      		6503AxtelSABdeCVMXfalse
      161.45.98.33
      		unknownUnited States
      		26335MTSUUSfalse
      151.208.146.197
      		unknownUnited States
      		11003PANDGUSfalse
      240.48.3.48
      		unknownReserved
      		unknownunknownfalse
      73.250.35.113
      		unknownUnited States
      		7922COMCAST-7922USfalse
      32.143.82.94
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      76.251.40.162
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      208.52.153.4
      		unknownUnited States
      		22626VCI-22626USfalse
      14.108.217.117
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      183.41.239.45
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      176.131.97.133
      		unknownFrance
      		5410BOUYGTEL-ISPFRfalse
      43.36.69.65
      		unknownJapan4249LILLY-ASUSfalse
      73.33.179.23
      		unknownUnited States
      		7922COMCAST-7922USfalse
      2.86.93.252
      		unknownGreece
      		6799OTENET-GRAthens-GreeceGRfalse
      164.171.204.251
      		unknownUnited States
      		22773ASN-CXA-ALL-CCI-22773-RDCUSfalse
      115.13.47.220
      		unknownKorea Republic of
      		4766KIXS-AS-KRKoreaTelecomKRfalse
      130.180.210.162
      		unknownUkraine
      		31343INTERTELECOMUAfalse
      177.112.198.189
      		unknownBrazil
      		26599TELEFONICABRASILSABRfalse
      166.103.15.250
      		unknownKorea Republic of
      		7029WINDSTREAMUSfalse
      156.14.91.235
      		unknownItaly
      		137ASGARRConsortiumGARREUfalse
      32.198.117.210
      		unknownUnited States
      		2686ATGS-MMD-ASUSfalse
      148.125.59.177
      		unknownUnited States
      		2119TELENOR-NEXTELTelenorNorgeASNOfalse
      40.93.122.158
      		unknownUnited States
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
      108.127.33.16
      		unknownUnited States
      		10507SPCSUSfalse
      120.140.255.84
      		unknownMalaysia
      		45177DEVOLI-AS-APDevoliNZfalse
      84.107.200.105
      		unknownNetherlands
      		33915TNF-ASNLfalse
      2.106.168.48
      		unknownDenmark
      		3292TDCTDCASDKfalse
      150.108.196.65
      		unknownUnited States
      		32531FORDHAM-UNIVERSITYUSfalse
      204.156.18.99
      		unknownUnited States
      		2914NTT-COMMUNICATIONS-2914USfalse
      13.51.123.170
      		unknownUnited States
      		16509AMAZON-02USfalse
      71.20.93.194
      		unknownUnited States
      		7029WINDSTREAMUSfalse
      74.93.248.194
      		unknownUnited States
      		7922COMCAST-7922USfalse
      23.240.15.65
      		unknownUnited States
      		20001TWC-20001-PACWESTUSfalse
      130.34.207.192
      		unknownJapan2907SINET-ASResearchOrganizationofInformationandSystemsNfalse
      190.162.40.247
      		unknownChile
      		22047VTRBANDAANCHASACLfalse
      60.63.70.32
      		unknownChina
      		9812CNNIC-CN-COLNETOrientalCableNetworkCoLtdCNfalse
      178.52.228.3
      		unknownSyrian Arab Republic
      		29256INT-PDN-STE-ASSTEPDNInternalASSYfalse
      9.62.229.54
      		unknownUnited States
      		3356LEVEL3USfalse
      197.146.254.207
      		unknownMorocco
      		36884MAROCCONNECTMAfalse
      13.207.127.225
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      184.38.86.44
      		unknownUnited States
      		5778CENTURYLINK-LEGACY-EMBARQ-RCMTUSfalse
      2.15.132.102
      		unknownFrance
      		3215FranceTelecom-OrangeFRfalse
      95.187.223.59
      		unknownSaudi Arabia
      		39891ALJAWWALSTC-ASSAfalse
      149.53.234.146
      		unknownUnited States
      		174COGENT-174USfalse
      197.185.70.91
      		unknownSouth Africa
      		37105NEOLOGY-ASZAfalse
      118.123.103.248
      		unknownChina
      		38283CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetDatafalse
      87.44.156.228
      		unknownIreland
      		1213HEANETIEfalse
      223.223.106.42
      		unknownJapan18144AS-ENECOMEnergiaCommunicationsIncJPfalse
      78.180.81.253
      		unknownTurkey
      		9121TTNETTRfalse
      174.243.224.93
      		unknownUnited States
      		22394CELLCOUSfalse
      207.5.2.91
      		unknownUnited States
      		22646HARCOM1USfalse
      93.141.216.21
      		unknownCroatia (LOCAL Name: Hrvatska)
      		5391T-HTCroatianTelecomIncHRfalse
      16.107.72.161
      		unknownUnited States
      		unknownunknownfalse
      31.17.181.253
      		unknownGermany
      		31334KABELDEUTSCHLAND-ASDEfalse
      60.233.124.194
      		unknownChina
      		1221ASN-TELSTRATelstraCorporationLtdAUfalse
      193.162.116.56
      		unknownDenmark
      		210210REGION-MIDTJYLLAND-DKfalse
      223.64.16.29
      		unknownChina
      		56046CMNET-JIANGSU-APChinaMobilecommunicationscorporationCNfalse
      125.8.172.81
      		unknownJapan9824JTCL-JP-ASJupiterTelecommunicationCoLtdJPfalse
      45.161.181.39
      		unknownArgentina
      		266892SEBECABLESRLARfalse
      174.47.121.216
      		unknownUnited States
      		32419BALDWIN-LYONSUSfalse

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      ⊘No created / dropped files found

      Static File Info

      General

      File type:ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (GNU/Linux), statically linked, stripped
      Entropy (8bit):7.927381241431452
      TrID:
      • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
      • ELF Executable and Linkable format (generic) (4004/1) 49.84%
      File name:HUIHmcbfpW
      File size:26224
      MD5:7463d28ae705f29277567f6888315855
      SHA1:ca0836b4c352f1dd91a77422b952987f466f40e3
      SHA256:ed29224a554dd58df35208de727e297679bcbe2101d877e67736986deecffa8f
      SHA512:c3bd88c2b4cc13b51abaecd73895e3f854195620d3a9e61e4d93cf3004e10954234070f2447a6ac49ecbdca778bb0468df00fd6521ceed7de3b1d9046ba4be77
      SSDEEP:768:JKnqLiChP7gI5KUwxw2iEc0fxzULa2XiR4uVcqgw09v:JKqL1hz+iuGLaoiR4u+qgw09v
      TLSH:9CC2E170F8415E5AEBECDEF5D661C0D463AA8F4FA276DCB66045AF5043280238F5C56C
      File Content Preview:.ELF......................S....4.........4. ...(......................ex..ex...............D...D...D................dt.Q................................UPX!.......................T.......?.E.h4...@b..............H...i.&...Us..S?.....Q..u.....B....|4...5|}

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, big endian
      Version:1 (current)
      Machine:PowerPC
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - Linux
      ABI Version:0
      Entry Point Address:0x105390
      Flags:0x0
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:0
      Section Header Size:40
      Number of Section Headers:0
      Header String Table Index:0

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x1000000x1000000x65780x65787.93130x5R E0x10000
      LOAD0xfb440x1001fb440x1001fb440x00x00.00000x6RW 0x10000
      GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

      Network Behavior

      Network Port Distribution

      TCP Packets

      TimestampSource PortDest PortSource IPDest IP
      Aug 8, 2022 23:06:57.912014961 CEST42836443192.168.2.2391.189.91.43
      Aug 8, 2022 23:06:58.030729055 CEST356861312192.168.2.23208.67.106.33
      Aug 8, 2022 23:06:58.057872057 CEST131235686208.67.106.33192.168.2.23
      Aug 8, 2022 23:06:58.058027029 CEST356861312192.168.2.23208.67.106.33
      Aug 8, 2022 23:06:58.058298111 CEST356861312192.168.2.23208.67.106.33
      Aug 8, 2022 23:06:58.072499037 CEST2202023192.168.2.2334.196.200.1
      Aug 8, 2022 23:06:58.072510958 CEST2202023192.168.2.23213.223.108.162
      Aug 8, 2022 23:06:58.072555065 CEST2202023192.168.2.23202.126.138.58
      Aug 8, 2022 23:06:58.072560072 CEST2202023192.168.2.23118.55.100.58
      Aug 8, 2022 23:06:58.072560072 CEST2202023192.168.2.23179.100.216.194
      Aug 8, 2022 23:06:58.072582960 CEST2202023192.168.2.23196.207.30.117
      Aug 8, 2022 23:06:58.072582006 CEST2202023192.168.2.23210.252.127.246
      Aug 8, 2022 23:06:58.072596073 CEST2202023192.168.2.2324.115.44.80
      Aug 8, 2022 23:06:58.072597980 CEST2202023192.168.2.23165.14.99.245
      Aug 8, 2022 23:06:58.072622061 CEST2202023192.168.2.23243.55.137.136
      Aug 8, 2022 23:06:58.072630882 CEST2202023192.168.2.23184.99.170.148
      Aug 8, 2022 23:06:58.072640896 CEST2202023192.168.2.23216.72.48.251
      Aug 8, 2022 23:06:58.072648048 CEST2202023192.168.2.2363.87.34.207
      Aug 8, 2022 23:06:58.072660923 CEST2202023192.168.2.2385.191.128.179
      Aug 8, 2022 23:06:58.072664022 CEST2202023192.168.2.23178.117.176.43
      Aug 8, 2022 23:06:58.072674036 CEST2202023192.168.2.23250.121.216.21
      Aug 8, 2022 23:06:58.072674990 CEST2202023192.168.2.23172.99.97.86
      Aug 8, 2022 23:06:58.072678089 CEST2202023192.168.2.2385.85.156.204
      Aug 8, 2022 23:06:58.072686911 CEST2202023192.168.2.2384.210.3.89
      Aug 8, 2022 23:06:58.072698116 CEST2202023192.168.2.23247.143.53.199
      Aug 8, 2022 23:06:58.072701931 CEST2202023192.168.2.23153.195.100.147
      Aug 8, 2022 23:06:58.072707891 CEST2202023192.168.2.2320.162.48.51
      Aug 8, 2022 23:06:58.072714090 CEST2202023192.168.2.2383.100.124.145
      Aug 8, 2022 23:06:58.072716951 CEST2202023192.168.2.23202.95.72.248
      Aug 8, 2022 23:06:58.072721958 CEST2202023192.168.2.23218.72.48.7
      Aug 8, 2022 23:06:58.072731972 CEST2202023192.168.2.23172.94.10.212
      Aug 8, 2022 23:06:58.072741032 CEST2202023192.168.2.2381.83.174.195
      Aug 8, 2022 23:06:58.072741985 CEST2202023192.168.2.23184.55.253.24
      Aug 8, 2022 23:06:58.072760105 CEST2202023192.168.2.2395.227.201.237
      Aug 8, 2022 23:06:58.072774887 CEST2202023192.168.2.23148.193.195.219
      Aug 8, 2022 23:06:58.072782040 CEST2202023192.168.2.23135.73.167.4
      Aug 8, 2022 23:06:58.072817087 CEST2202023192.168.2.2381.116.113.66
      Aug 8, 2022 23:06:58.072818041 CEST2202023192.168.2.2374.67.21.210
      Aug 8, 2022 23:06:58.072952986 CEST2202023192.168.2.2360.67.32.108
      Aug 8, 2022 23:06:58.072959900 CEST2202023192.168.2.23124.91.82.9
      Aug 8, 2022 23:06:58.072959900 CEST2202023192.168.2.23164.124.144.11
      Aug 8, 2022 23:06:58.072961092 CEST2202023192.168.2.2357.136.201.248
      Aug 8, 2022 23:06:58.072967052 CEST2202023192.168.2.23144.3.73.153
      Aug 8, 2022 23:06:58.072968960 CEST2202023192.168.2.234.160.44.112
      Aug 8, 2022 23:06:58.072982073 CEST2202023192.168.2.23182.54.215.204
      Aug 8, 2022 23:06:58.072984934 CEST2202023192.168.2.23161.144.42.95
      Aug 8, 2022 23:06:58.073031902 CEST2202023192.168.2.23159.248.85.135
      Aug 8, 2022 23:06:58.073043108 CEST2202023192.168.2.23159.165.131.77
      Aug 8, 2022 23:06:58.073045015 CEST2202023192.168.2.23183.202.75.168
      Aug 8, 2022 23:06:58.073072910 CEST2202023192.168.2.2337.208.213.227
      Aug 8, 2022 23:06:58.073105097 CEST2202023192.168.2.23152.128.119.234
      Aug 8, 2022 23:06:58.073113918 CEST2202023192.168.2.23196.53.232.254
      Aug 8, 2022 23:06:58.073139906 CEST2202023192.168.2.2345.100.207.75
      Aug 8, 2022 23:06:58.073143005 CEST2202023192.168.2.23218.13.131.203
      Aug 8, 2022 23:06:58.073160887 CEST2202023192.168.2.2371.186.90.180
      Aug 8, 2022 23:06:58.073364973 CEST2202023192.168.2.2386.51.89.103
      Aug 8, 2022 23:06:58.073385954 CEST2202023192.168.2.23116.196.160.5
      Aug 8, 2022 23:06:58.073426008 CEST2202023192.168.2.235.215.83.138
      Aug 8, 2022 23:06:58.073467970 CEST2202023192.168.2.23107.206.79.14
      Aug 8, 2022 23:06:58.073487043 CEST2202023192.168.2.23123.90.117.206
      Aug 8, 2022 23:06:58.073632002 CEST2202023192.168.2.23252.30.106.42
      Aug 8, 2022 23:06:58.073638916 CEST2202023192.168.2.2314.182.65.222
      Aug 8, 2022 23:06:58.073641062 CEST2202023192.168.2.23142.54.231.53
      Aug 8, 2022 23:06:58.073652983 CEST2202023192.168.2.23101.195.231.159
      Aug 8, 2022 23:06:58.073658943 CEST2202023192.168.2.2395.253.175.55
      Aug 8, 2022 23:06:58.073662043 CEST2202023192.168.2.23161.93.109.34
      Aug 8, 2022 23:06:58.073677063 CEST2202023192.168.2.23142.157.113.190
      Aug 8, 2022 23:06:58.073682070 CEST2202023192.168.2.23114.99.101.156
      Aug 8, 2022 23:06:58.073683977 CEST2202023192.168.2.23144.37.55.41
      Aug 8, 2022 23:06:58.073693037 CEST2202023192.168.2.2338.59.31.34
      Aug 8, 2022 23:06:58.073699951 CEST2202023192.168.2.2359.185.174.43
      Aug 8, 2022 23:06:58.073704004 CEST2202023192.168.2.23201.192.213.135
      Aug 8, 2022 23:06:58.073717117 CEST2202023192.168.2.23152.111.125.115
      Aug 8, 2022 23:06:58.073723078 CEST2202023192.168.2.23252.84.127.218
      Aug 8, 2022 23:06:58.073731899 CEST2202023192.168.2.23123.135.185.101
      Aug 8, 2022 23:06:58.073736906 CEST2202023192.168.2.23240.3.251.31
      Aug 8, 2022 23:06:58.073740959 CEST2202023192.168.2.23240.93.61.0
      Aug 8, 2022 23:06:58.073743105 CEST2202023192.168.2.23104.76.14.95
      Aug 8, 2022 23:06:58.073751926 CEST2202023192.168.2.2360.111.108.5
      Aug 8, 2022 23:06:58.073756933 CEST2202023192.168.2.23163.179.192.175
      Aug 8, 2022 23:06:58.073761940 CEST2202023192.168.2.2346.215.137.100
      Aug 8, 2022 23:06:58.073771000 CEST2202023192.168.2.23209.66.170.155
      Aug 8, 2022 23:06:58.073772907 CEST2202023192.168.2.2345.9.36.64
      Aug 8, 2022 23:06:58.073776007 CEST2202023192.168.2.23162.25.133.160
      Aug 8, 2022 23:06:58.073786974 CEST2202023192.168.2.2314.210.195.96
      Aug 8, 2022 23:06:58.073787928 CEST2202023192.168.2.23201.88.31.78
      Aug 8, 2022 23:06:58.073791981 CEST2202023192.168.2.2368.50.211.15
      Aug 8, 2022 23:06:58.073797941 CEST2202023192.168.2.23217.83.57.111
      Aug 8, 2022 23:06:58.073806047 CEST2202023192.168.2.23116.231.139.217
      Aug 8, 2022 23:06:58.073813915 CEST2202023192.168.2.23254.161.150.136
      Aug 8, 2022 23:06:58.073827028 CEST2202023192.168.2.23197.144.190.60
      Aug 8, 2022 23:06:58.073869944 CEST2202023192.168.2.23192.97.193.16
      Aug 8, 2022 23:06:58.073896885 CEST2202023192.168.2.23108.187.197.33
      Aug 8, 2022 23:06:58.073899031 CEST2202023192.168.2.23186.162.18.58
      Aug 8, 2022 23:06:58.073916912 CEST2202023192.168.2.23172.245.68.118
      Aug 8, 2022 23:06:58.073920012 CEST2202023192.168.2.23101.21.122.200
      Aug 8, 2022 23:06:58.073929071 CEST2202023192.168.2.23187.60.98.85
      Aug 8, 2022 23:06:58.073930025 CEST2202023192.168.2.231.5.225.166
      Aug 8, 2022 23:06:58.074059963 CEST2202023192.168.2.23138.215.135.130
      Aug 8, 2022 23:06:58.074078083 CEST2202023192.168.2.23187.171.138.113

      System Behavior

      General

      Start time:23:06:57
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:/tmp/HUIHmcbfpW
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:06:57
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:09:48
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:09:48
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:09:48
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:09:53
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:09:53
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:09:48
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:09:48
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:06:57
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:06:57
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:06:57
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:09:48
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:09:48
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:06:57
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6

      General

      Start time:23:06:57
      Start date:08/08/2022
      Path:/tmp/HUIHmcbfpW
      Arguments:n/a
      File size:5388968 bytes
      MD5 hash:ae65271c943d3451b7f026d1fadccea6