Edit tour

Linux Analysis Report
6e180puJTD

Overview

General Information

Sample Name:	6e180puJTD
Analysis ID:	680645
MD5:	b19338343c7925b9ee1683f1371171f4
SHA1:	584b5f2f0dd993ab0e12869ec59f286174e31b18
SHA256:	091731e0f53b9f9b1c7d7c84b037c197b839949988d47aed4c8e23d6f3edaed5
Tags:	32elfmirairenesas
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Uses known network protocols on non-standard ports

Sample tries to kill multiple processes (SIGKILL)

Yara signature match

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	680645
Start date and time: 08/08/202223:11:37	2022-08-08 23:11:37 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	6e180puJTD
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal80.spre.troj.lin@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100

Runtime Messages

Command:	/tmp/6e180puJTD
PID:	6227
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

6e180puJTD (PID: 6227, Parent: 6121, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/6e180puJTD

6e180puJTD New Fork (PID: 6229, Parent: 6227)

6e180puJTD New Fork (PID: 6230, Parent: 6227)

6e180puJTD New Fork (PID: 6232, Parent: 6227)

6e180puJTD New Fork (PID: 6235, Parent: 6232)

6e180puJTD New Fork (PID: 6337, Parent: 6235)

6e180puJTD New Fork (PID: 6339, Parent: 6235)

6e180puJTD New Fork (PID: 6236, Parent: 6232)

6e180puJTD New Fork (PID: 6237, Parent: 6232)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
6e180puJTD	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6e180puJTD	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdf64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6e180puJTD	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xe4bc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6337.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6237.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6337.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdf64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6337.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xe4bc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6237.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdf64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6237.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xe4bc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6230.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6230.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdf64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6230.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xe4bc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6227.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6227.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdf64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6227.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xe4bc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6236.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6236.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdf64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6236.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xe4bc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6229.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6229.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdf64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdfdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe0f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6229.1.00007f87d0400000.00007f87d0410000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xe4bc:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 6e180puJTD PID: 6227	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x401e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4032:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4046:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x405a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x406e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4082:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4096:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x410e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4122:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4136:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x414a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x415e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4172:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4186:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x419a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 6e180puJTD PID: 6227	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x48db:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 6e180puJTD PID: 6229	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd08c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd0a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd0b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd0c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd0dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd0f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd12c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd17c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd1a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd1b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd1cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd1e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd1f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd208:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd21c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 6e180puJTD PID: 6229	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd949:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 6e180puJTD PID: 6230	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1313:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1327:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x133b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1363:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1377:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x138b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x139f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1403:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1417:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x143f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1453:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1467:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 6e180puJTD PID: 6230	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1b94:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 6e180puJTD PID: 6236	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1df3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ea7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ebb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ecf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ee3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ef7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 6e180puJTD PID: 6236	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x26b0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 6e180puJTD PID: 6237	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x258a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x259e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2602:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2616:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x262a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x263e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2652:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2666:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x267a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x268e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2706:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x271a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 6e180puJTD PID: 6237	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x2e47:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 6e180puJTD PID: 6337	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xcc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcfe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 6e180puJTD PID: 6337	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x157f:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 25 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 6e180puJTD	Virustotal: Detection: 54%			Perma Link
Source: 6e180puJTD	ReversingLabs: Detection: 53%

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38666
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38670
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38678
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38686
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38698
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38708
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38718
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38726
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38742
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38752

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:35686 -> 208.67.106.33:1312

Source: /tmp/6e180puJTD (PID: 6229)	Socket: 0.0.0.0::0
Source: /tmp/6e180puJTD (PID: 6229)	Socket: 0.0.0.0::53413
Source: /tmp/6e180puJTD (PID: 6229)	Socket: 0.0.0.0::80
Source: /tmp/6e180puJTD (PID: 6235)	Socket: 0.0.0.0::0
Source: /tmp/6e180puJTD (PID: 6235)	Socket: 0.0.0.0::53413
Source: /tmp/6e180puJTD (PID: 6235)	Socket: 0.0.0.0::80

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 80.151.104.16
Source: unknown	TCP traffic detected without corresponding DNS query: 1.218.67.62
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.106.33
Source: unknown	TCP traffic detected without corresponding DNS query: 211.109.125.239
Source: unknown	TCP traffic detected without corresponding DNS query: 217.156.54.239
Source: unknown	TCP traffic detected without corresponding DNS query: 198.133.153.239
Source: unknown	TCP traffic detected without corresponding DNS query: 112.191.239.84
Source: unknown	TCP traffic detected without corresponding DNS query: 9.65.211.238
Source: unknown	TCP traffic detected without corresponding DNS query: 255.199.230.89
Source: unknown	TCP traffic detected without corresponding DNS query: 115.13.254.117
Source: unknown	TCP traffic detected without corresponding DNS query: 192.239.65.94
Source: unknown	TCP traffic detected without corresponding DNS query: 201.200.11.61
Source: unknown	TCP traffic detected without corresponding DNS query: 4.61.38.229
Source: unknown	TCP traffic detected without corresponding DNS query: 104.176.233.191
Source: unknown	TCP traffic detected without corresponding DNS query: 41.234.231.234
Source: unknown	TCP traffic detected without corresponding DNS query: 191.214.182.44
Source: unknown	TCP traffic detected without corresponding DNS query: 112.205.38.26
Source: unknown	TCP traffic detected without corresponding DNS query: 47.105.236.120
Source: unknown	TCP traffic detected without corresponding DNS query: 13.234.4.3
Source: unknown	TCP traffic detected without corresponding DNS query: 121.124.195.15
Source: unknown	TCP traffic detected without corresponding DNS query: 24.163.56.67
Source: unknown	TCP traffic detected without corresponding DNS query: 99.26.8.125
Source: unknown	TCP traffic detected without corresponding DNS query: 107.39.125.205
Source: unknown	TCP traffic detected without corresponding DNS query: 205.137.221.173
Source: unknown	TCP traffic detected without corresponding DNS query: 190.96.21.175
Source: unknown	TCP traffic detected without corresponding DNS query: 112.171.135.92
Source: unknown	TCP traffic detected without corresponding DNS query: 190.27.231.27
Source: unknown	TCP traffic detected without corresponding DNS query: 138.198.15.53
Source: unknown	TCP traffic detected without corresponding DNS query: 19.57.20.104
Source: unknown	TCP traffic detected without corresponding DNS query: 222.11.112.213
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.176.166
Source: unknown	TCP traffic detected without corresponding DNS query: 19.113.90.208
Source: unknown	TCP traffic detected without corresponding DNS query: 201.64.243.183
Source: unknown	TCP traffic detected without corresponding DNS query: 180.63.226.44
Source: unknown	TCP traffic detected without corresponding DNS query: 161.23.181.198
Source: unknown	TCP traffic detected without corresponding DNS query: 221.230.84.199
Source: unknown	TCP traffic detected without corresponding DNS query: 119.195.113.201
Source: unknown	TCP traffic detected without corresponding DNS query: 32.15.36.151
Source: unknown	TCP traffic detected without corresponding DNS query: 169.127.204.159
Source: unknown	TCP traffic detected without corresponding DNS query: 58.35.94.190
Source: unknown	TCP traffic detected without corresponding DNS query: 145.149.88.112
Source: unknown	TCP traffic detected without corresponding DNS query: 154.202.238.149
Source: unknown	TCP traffic detected without corresponding DNS query: 35.20.122.151
Source: unknown	TCP traffic detected without corresponding DNS query: 150.214.158.65
Source: unknown	TCP traffic detected without corresponding DNS query: 82.174.6.191
Source: unknown	TCP traffic detected without corresponding DNS query: 53.160.167.116
Source: unknown	TCP traffic detected without corresponding DNS query: 71.155.51.73
Source: unknown	TCP traffic detected without corresponding DNS query: 216.68.193.253
Source: unknown	TCP traffic detected without corresponding DNS query: 223.87.130.201
Source: unknown	TCP traffic detected without corresponding DNS query: 150.140.185.12

System Summary

Malicious sample detected (through community Yara rule)

Source: 6e180puJTD, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6e180puJTD, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6337.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6337.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6237.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6237.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6230.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6230.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6227.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6227.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6236.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6236.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6229.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6229.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 6e180puJTD PID: 6227, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 6e180puJTD PID: 6227, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 6e180puJTD PID: 6229, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 6e180puJTD PID: 6229, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 6e180puJTD PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 6e180puJTD PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 6e180puJTD PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 6e180puJTD PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 6e180puJTD PID: 6237, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 6e180puJTD PID: 6237, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 6e180puJTD PID: 6337, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 6e180puJTD PID: 6337, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/6e180puJTD (PID: 6229)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 720, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 759, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 788, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 800, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 847, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 884, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 1334, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 1335, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 1860, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 1872, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2096, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2097, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2102, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2180, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2208, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2275, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2281, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2285, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2289, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2294, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 6229, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 6237, result: successful

Source: 6e180puJTD, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6e180puJTD, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6337.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6337.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6237.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6237.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6230.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6230.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6227.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6227.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6236.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6236.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6229.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6229.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 6e180puJTD PID: 6227, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 6e180puJTD PID: 6227, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 6e180puJTD PID: 6229, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 6e180puJTD PID: 6229, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 6e180puJTD PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 6e180puJTD PID: 6230, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 6e180puJTD PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 6e180puJTD PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 6e180puJTD PID: 6237, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 6e180puJTD PID: 6237, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 6e180puJTD PID: 6337, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 6e180puJTD PID: 6337, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/6e180puJTD (PID: 6229)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 720, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 759, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 788, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 800, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 847, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 884, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 1334, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 1335, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 1860, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 1872, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2096, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2097, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2102, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2180, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2208, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2275, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2281, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2285, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2289, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 2294, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 6229, result: successful
Source: /tmp/6e180puJTD (PID: 6235)	SIGKILL sent: pid: 6237, result: successful

Source: classification engine

Classification label: mal80.spre.troj.lin@0/0@0/0

Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1582/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2033/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2275/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/3088/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1612/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1579/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1699/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1335/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1698/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2028/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1334/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1576/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2302/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/3236/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2025/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2146/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/910/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/912/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/912/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/912/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/6229/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/759/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/759/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/759/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/517/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2307/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/918/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/918/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/918/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/6243/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/6242/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/4465/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1594/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2285/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2281/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1349/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1623/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/761/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/761/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/761/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1622/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/884/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/884/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/884/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1983/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2038/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1344/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1465/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1586/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1860/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1463/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2156/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/800/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/800/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/800/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/801/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/801/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/801/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/6237/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1629/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1627/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1900/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/3021/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/491/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/491/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/491/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2294/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2050/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1877/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/772/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/772/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/772/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1633/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1599/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1632/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/774/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/774/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/774/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1477/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/654/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/896/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1476/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1872/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2048/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/655/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1475/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/2289/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/777/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/777/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/777/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/656/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/657/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/4466/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/658/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/658/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/658/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/4467/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/4468/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/936/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/936/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/936/fd
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/419/exe
Source: /tmp/6e180puJTD (PID: 6235)	File opened: /proc/1639/exe

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38666
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38670
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38678
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38686
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38698
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38708
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38718
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38726
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38742
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38752

Source: /tmp/6e180puJTD (PID: 6227)

Queries kernel information via 'uname':

Source: 6e180puJTD, 6337.1.00005574377f8000.0000557437818000.rw-.sdmp	Binary or memory string: 7tU/sh4/0 /proc/491/fd/69!/proc/777/fd/22/sh4/pro1/proc/1335/exe/sh4/0!/proc/491/fd/70!/proc/777/fd/19/sh4/pro1/usr/bin/vmtoolsdh4/0!/proc/491/fd/71!/proc/777/fd/18/sh4/pro1/usr/bin/xiccd/sh4/0!/proc/491/fd/72!/proc/777/fd/17/sh4/pro1
Source: 6e180puJTD, 6227.1.00007ffd5f8a3000.00007ffd5f8c4000.rw-.sdmp, 6e180puJTD, 6229.1.00007ffd5f8a3000.00007ffd5f8c4000.rw-.sdmp, 6e180puJTD, 6230.1.00007ffd5f8a3000.00007ffd5f8c4000.rw-.sdmp, 6e180puJTD, 6337.1.00005574377f8000.0000557437818000.rw-.sdmp, 6e180puJTD, 6337.1.00007ffd5f8a3000.00007ffd5f8c4000.rw-.sdmp, 6e180puJTD, 6236.1.00007ffd5f8a3000.00007ffd5f8c4000.rw-.sdmp, 6e180puJTD, 6237.1.00007ffd5f8a3000.00007ffd5f8c4000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: 6e180puJTD, 6337.1.00005574377f8000.0000557437818000.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: 6e180puJTD, 6227.1.0000557437795000.00005574377f8000.rw-.sdmp, 6e180puJTD, 6229.1.0000557437795000.00005574377f8000.rw-.sdmp, 6e180puJTD, 6230.1.0000557437795000.00005574377f8000.rw-.sdmp, 6e180puJTD, 6337.1.0000557437795000.00005574377f8000.rw-.sdmp, 6e180puJTD, 6236.1.0000557437795000.00005574377f8000.rw-.sdmp, 6e180puJTD, 6237.1.0000557437795000.00005574377f8000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: 6e180puJTD, 6227.1.0000557437795000.00005574377f8000.rw-.sdmp, 6e180puJTD, 6229.1.0000557437795000.00005574377f8000.rw-.sdmp, 6e180puJTD, 6230.1.0000557437795000.00005574377f8000.rw-.sdmp, 6e180puJTD, 6337.1.0000557437795000.00005574377f8000.rw-.sdmp, 6e180puJTD, 6236.1.0000557437795000.00005574377f8000.rw-.sdmp, 6e180puJTD, 6237.1.0000557437795000.00005574377f8000.rw-.sdmp	Binary or memory string: uy7tU5!/etc/qemu-binfmt/sh4
Source: 6e180puJTD, 6337.1.00005574377f8000.0000557437818000.rw-.sdmp	Binary or memory string: 7tU/sh4/ro10 /usr/bin/qemu-sh4!/proc/799/fd/01
Source: 6e180puJTD, 6227.1.00007ffd5f8a3000.00007ffd5f8c4000.rw-.sdmp, 6e180puJTD, 6229.1.00007ffd5f8a3000.00007ffd5f8c4000.rw-.sdmp, 6e180puJTD, 6230.1.00007ffd5f8a3000.00007ffd5f8c4000.rw-.sdmp, 6e180puJTD, 6337.1.00007ffd5f8a3000.00007ffd5f8c4000.rw-.sdmp, 6e180puJTD, 6236.1.00007ffd5f8a3000.00007ffd5f8c4000.rw-.sdmp, 6e180puJTD, 6237.1.00007ffd5f8a3000.00007ffd5f8c4000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/6e180puJTDSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/6e180puJTD

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6e180puJTD, type: SAMPLE
Source: Yara match	File source: 6337.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6230.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6236.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6e180puJTD, type: SAMPLE
Source: Yara match	File source: 6337.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6237.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6230.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6236.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.00007f87d0400000.00007f87d0410000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Service Stop
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
6e180puJTD	54%	Virustotal		Browse
6e180puJTD	54%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
241.48.61.17	unknown	Reserved	unknown	unknown	false
202.4.16.34	unknown	New Zealand	7306	ASIANDEVBANKUS	false
92.218.193.231	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
111.45.222.204	unknown	China	56044	CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	false
213.154.66.80	unknown	Senegal	8346	SONATEL-ASAutonomousSystemEU	false
170.167.20.34	unknown	United States	19739	COUNTY-SANBERNARDINOUS	false
23.57.232.20	unknown	United States	16625	AKAMAI-ASUS	false
94.72.180.46	unknown	Bulgaria	42735	MAXTELECOM-ASBG	false
152.53.64.70	unknown	United States	81	NCRENUS	false
181.254.19.203	unknown	Colombia	26611	COMCELSACO	false
112.198.124.93	unknown	Philippines	132199	GLOBE-MOBILE-5TH-GEN-ASGlobeTelecomIncPH	false
42.32.216.135	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
216.253.193.160	unknown	United States	3549	LVLT-3549US	false
255.25.47.63	unknown	Reserved	unknown	unknown	false
116.75.187.136	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	false
152.140.145.146	unknown	United States	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
136.114.115.150	unknown	United States	15169	GOOGLEUS	false
61.199.87.85	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
121.243.246.239	unknown	India	17908	TCISLTataCommunicationsIN	false
201.236.67.216	unknown	Chile	15311	TelefonicaEmpresasCL	false
105.219.30.248	unknown	South Africa	16637	MTNNS-ASZA	false
211.228.82.203	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
23.211.33.0	unknown	United States	20940	AKAMAI-ASN1EU	false
54.62.178.249	unknown	United States	14618	AMAZON-AESUS	false
106.8.250.67	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
245.43.211.188	unknown	Reserved	unknown	unknown	false
240.188.31.120	unknown	Reserved	unknown	unknown	false
53.84.230.224	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
89.166.205.104	unknown	Germany	9145	EWETELCloppenburgerStrasse310DE	false
211.238.83.67	unknown	Korea Republic of	9976	ICNDP-AS-KRNamincheonBrodcastingCoLtdKR	false
248.231.5.213	unknown	Reserved	unknown	unknown	false
181.199.34.216	unknown	Ecuador	27947	TelconetSAEC	false
212.182.0.33	unknown	Poland	12324	LUBMAN-EDU-ASPolandLublinPL	false
99.25.205.72	unknown	United States	7018	ATT-INTERNET4US	false
162.47.196.174	unknown	United States	3378	MCI-ASNUS	false
221.135.3.139	unknown	India	9583	SIFY-AS-INSifyLimitedIN	false
107.239.142.218	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
148.171.245.152	unknown	United States	397879	LUMINATE-01US	false
194.6.220.151	unknown	Russian Federation	197498	VERBETA-ASRU	false
170.249.28.22	unknown	United States	46208	PFNL-ASNUS	false
161.87.168.161	unknown	Netherlands	14298	EPA-NETUS	false
182.223.152.232	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
149.166.36.96	unknown	United States	87	INDIANA-ASUS	false
160.248.62.68	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
69.43.190.255	unknown	United States	22489	ZCOLO-SAN01US	false
180.149.166.204	unknown	Japan	4721	JCNJupiterTelecommunicationsCoLtdJP	false
27.168.199.202	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
12.202.34.160	unknown	United States	22983	FISERV-INCUS	false
90.39.150.123	unknown	France	3215	FranceTelecom-OrangeFR	false
190.72.15.38	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	false
223.1.225.83	unknown	China	63555	CNBIDCCBeijingBeilongYunhaiNetworkDataTechnologyCorpo	false
154.50.90.162	unknown	United States	174	COGENT-174US	false
107.164.228.73	unknown	United States	18779	EGIHOSTINGUS	false
153.237.4.55	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
20.58.232.198	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
242.167.10.248	unknown	Reserved	unknown	unknown	false
198.154.232.182	unknown	United States	46606	UNIFIEDLAYER-AS-1US	false
80.119.148.81	unknown	France	15557	LDCOMNETFR	false
159.11.199.53	unknown	United States	16983	AS16983US	false
135.89.233.67	unknown	United States	10455	LUCENT-CIOUS	false
9.172.236.202	unknown	United States	3356	LEVEL3US	false
146.120.215.100	unknown	Czech Republic	61240	SKYNET2010-ASUA	false
178.245.89.170	unknown	Turkey	16135	TURKCELL-ASTurkcellASTR	false
123.46.180.186	unknown	Korea Republic of	6619	SAMSUNGSDS-AS-KRSamsungSDSIncKR	false
153.178.204.6	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
39.114.213.225	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
12.247.187.54	unknown	United States	7018	ATT-INTERNET4US	false
71.211.10.242	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
167.27.235.115	unknown	United States	7838	USAAUS	false
2.145.36.98	unknown	Iran (ISLAMIC Republic Of)	44244	IRANCELL-ASIR	false
210.194.84.73	unknown	Japan	9824	JTCL-JP-ASJupiterTelecommunicationCoLtdJP	false
246.109.35.156	unknown	Reserved	unknown	unknown	false
200.102.192.29	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
69.119.225.193	unknown	United States	6128	CABLE-NET-1US	false
58.107.214.72	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
141.201.90.37	unknown	Austria	1109	UNI-SALZBURGUniversityofSalzburgAT	false
66.157.86.21	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
141.95.237.110	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
201.166.226.252	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	false
67.24.66.23	unknown	United States	202818	LEVEL3COMMUNICATIONSFR	false
37.55.245.82	unknown	Ukraine	6849	UKRTELNETUA	false
89.59.121.171	unknown	Germany	5430	FREENETDEfreenetDatenkommunikationsGmbHDE	false
175.183.201.54	unknown	Taiwan; Republic of China (ROC)	18049	TINP-TWTaiwanInfrastructureNetworkTechnologieTW	false
254.14.236.113	unknown	Reserved	unknown	unknown	false
184.85.6.114	unknown	United States	16625	AKAMAI-ASUS	false
184.209.135.95	unknown	United States	10507	SPCSUS	false
107.114.209.29	unknown	United States	7018	ATT-INTERNET4US	false
173.73.28.233	unknown	United States	701	UUNETUS	false
251.157.26.163	unknown	Reserved	unknown	unknown	false
73.108.225.174	unknown	United States	7922	COMCAST-7922US	false
92.33.148.109	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
141.166.179.222	unknown	United States	20105	URICHMONDUS	false
46.118.113.132	unknown	Ukraine	15895	KSNET-ASUA	false
242.215.49.122	unknown	Reserved	unknown	unknown	false
163.178.130.139	unknown	Costa Rica	11830	InstitutoCostarricensedeElectricidadyTelecomCR	false
41.35.35.120	unknown	Egypt	8452	TE-ASTE-ASEG	false
152.253.191.168	unknown	Brazil	26599	TELEFONICABRASILSABR	false
75.203.185.46	unknown	United States	22394	CELLCOUS	false
199.52.203.174	unknown	United States	398192	ARDOT-NET-01US	false
12.189.115.9	unknown	United States	7018	ATT-INTERNET4US	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.776759926089661
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	6e180puJTD
File size:	63480
MD5:	b19338343c7925b9ee1683f1371171f4
SHA1:	584b5f2f0dd993ab0e12869ec59f286174e31b18
SHA256:	091731e0f53b9f9b1c7d7c84b037c197b839949988d47aed4c8e23d6f3edaed5
SHA512:	4366eae63878492ddbb82a20ab2a90eec1f2387efcc5fbee67512fa17748222b41ecf8e3430f4d7b82f9ef1ae8452a51d94008491fc647eb3a50ca26aabb1dfb
SSDEEP:	1536:ragXV1f1Fl/wtkniPQauiufs3Ii3O/qyD6EZeCc:r57f1b/0QHf+Iey6EZe
TLSH:	1D538D75D12DAEA8C0414AB4A9198E704F13E4C046733EF7EA9587A68443DBCF858FF8
File Content Preview:	.ELF.....................@.4...h.......4. ...(...............@...@...........................A...A.$...............Q.td............................././"O.n........#.@........#.*@L....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	63080
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0xde60	0x0	0x6	AX	32
.fini	PROGBITS	0x40df40	0xdf40	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x40df64	0xdf64	0x149c	0x0	0x2	A	4
.ctors	PROGBITS	0x41f404	0xf404	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x41f40c	0xf40c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x41f418	0xf418	0x210	0x0	0x3	WA	4
.bss	NOBITS	0x41f628	0xf628	0x280	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xf628	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xf400	0xf400	6.8133	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xf404	0x41f404	0x41f404	0x224	0x4a4	2.9546	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 8, 2022 23:17:50.092096090 CEST	23	60242	80.151.104.16	192.168.2.23
Aug 8, 2022 23:17:50.092271090 CEST	60242	23	192.168.2.23	80.151.104.16
Aug 8, 2022 23:17:51.554292917 CEST	23	43528	1.218.67.62	192.168.2.23
Aug 8, 2022 23:17:51.554444075 CEST	43528	23	192.168.2.23	1.218.67.62
Aug 8, 2022 23:17:52.460179090 CEST	35686	1312	192.168.2.23	208.67.106.33
Aug 8, 2022 23:17:52.469990015 CEST	64348	23	192.168.2.23	211.109.125.239
Aug 8, 2022 23:17:52.470042944 CEST	64348	23	192.168.2.23	217.156.54.239
Aug 8, 2022 23:17:52.470091105 CEST	64348	23	192.168.2.23	198.133.153.239
Aug 8, 2022 23:17:52.470101118 CEST	64348	23	192.168.2.23	112.191.239.84
Aug 8, 2022 23:17:52.470102072 CEST	64348	23	192.168.2.23	9.65.211.238
Aug 8, 2022 23:17:52.470151901 CEST	64348	23	192.168.2.23	255.199.230.89
Aug 8, 2022 23:17:52.470155001 CEST	64348	23	192.168.2.23	115.13.254.117
Aug 8, 2022 23:17:52.470158100 CEST	64348	23	192.168.2.23	192.239.65.94
Aug 8, 2022 23:17:52.470339060 CEST	64348	23	192.168.2.23	201.200.11.61
Aug 8, 2022 23:17:52.470675945 CEST	64348	23	192.168.2.23	4.61.38.229
Aug 8, 2022 23:17:52.470710993 CEST	64348	23	192.168.2.23	104.176.233.191
Aug 8, 2022 23:17:52.470752954 CEST	64348	23	192.168.2.23	41.234.231.234
Aug 8, 2022 23:17:52.470761061 CEST	64348	23	192.168.2.23	191.214.182.44
Aug 8, 2022 23:17:52.470771074 CEST	64348	23	192.168.2.23	112.205.38.26
Aug 8, 2022 23:17:52.470804930 CEST	64348	23	192.168.2.23	47.105.236.120
Aug 8, 2022 23:17:52.470810890 CEST	64348	23	192.168.2.23	13.234.4.3
Aug 8, 2022 23:17:52.470817089 CEST	64348	23	192.168.2.23	121.124.195.15
Aug 8, 2022 23:17:52.470837116 CEST	64348	23	192.168.2.23	24.163.56.67
Aug 8, 2022 23:17:52.470841885 CEST	64348	23	192.168.2.23	99.26.8.125
Aug 8, 2022 23:17:52.470844030 CEST	64348	23	192.168.2.23	107.39.125.205
Aug 8, 2022 23:17:52.470848083 CEST	64348	23	192.168.2.23	205.137.221.173
Aug 8, 2022 23:17:52.470868111 CEST	64348	23	192.168.2.23	190.96.21.175
Aug 8, 2022 23:17:52.470884085 CEST	64348	23	192.168.2.23	112.171.135.92
Aug 8, 2022 23:17:52.470942020 CEST	64348	23	192.168.2.23	190.27.231.27
Aug 8, 2022 23:17:52.470979929 CEST	64348	23	192.168.2.23	138.198.15.53
Aug 8, 2022 23:17:52.470979929 CEST	64348	23	192.168.2.23	19.57.20.104
Aug 8, 2022 23:17:52.470978975 CEST	64348	23	192.168.2.23	222.11.112.213
Aug 8, 2022 23:17:52.470983028 CEST	64348	23	192.168.2.23	46.173.176.166
Aug 8, 2022 23:17:52.470984936 CEST	64348	23	192.168.2.23	19.113.90.208
Aug 8, 2022 23:17:52.470999956 CEST	64348	23	192.168.2.23	201.64.243.183
Aug 8, 2022 23:17:52.471004009 CEST	64348	23	192.168.2.23	180.63.226.44
Aug 8, 2022 23:17:52.471004009 CEST	64348	23	192.168.2.23	161.23.181.198
Aug 8, 2022 23:17:52.471013069 CEST	64348	23	192.168.2.23	221.230.84.199
Aug 8, 2022 23:17:52.471035004 CEST	64348	23	192.168.2.23	119.195.113.201
Aug 8, 2022 23:17:52.471040010 CEST	64348	23	192.168.2.23	32.15.36.151
Aug 8, 2022 23:17:52.471045971 CEST	64348	23	192.168.2.23	169.127.204.159
Aug 8, 2022 23:17:52.471066952 CEST	64348	23	192.168.2.23	58.35.94.190
Aug 8, 2022 23:17:52.471071005 CEST	64348	23	192.168.2.23	145.149.88.112
Aug 8, 2022 23:17:52.471082926 CEST	64348	23	192.168.2.23	154.202.238.149
Aug 8, 2022 23:17:52.471127987 CEST	64348	23	192.168.2.23	35.20.122.151
Aug 8, 2022 23:17:52.471210957 CEST	64348	23	192.168.2.23	150.214.158.65
Aug 8, 2022 23:17:52.471220970 CEST	64348	23	192.168.2.23	82.174.6.191
Aug 8, 2022 23:17:52.471226931 CEST	64348	23	192.168.2.23	53.160.167.116
Aug 8, 2022 23:17:52.471226931 CEST	64348	23	192.168.2.23	71.155.51.73
Aug 8, 2022 23:17:52.471251965 CEST	64348	23	192.168.2.23	216.68.193.253
Aug 8, 2022 23:17:52.471255064 CEST	64348	23	192.168.2.23	223.87.130.201
Aug 8, 2022 23:17:52.471256971 CEST	64348	23	192.168.2.23	150.140.185.12
Aug 8, 2022 23:17:52.471277952 CEST	64348	23	192.168.2.23	59.246.29.103
Aug 8, 2022 23:17:52.471280098 CEST	64348	23	192.168.2.23	162.15.128.230
Aug 8, 2022 23:17:52.471288919 CEST	64348	23	192.168.2.23	217.6.18.236
Aug 8, 2022 23:17:52.471292973 CEST	64348	23	192.168.2.23	23.237.221.160
Aug 8, 2022 23:17:52.471314907 CEST	64348	23	192.168.2.23	110.151.22.164
Aug 8, 2022 23:17:52.471321106 CEST	64348	23	192.168.2.23	197.8.81.196
Aug 8, 2022 23:17:52.471329927 CEST	64348	23	192.168.2.23	211.69.111.145
Aug 8, 2022 23:17:52.471333027 CEST	64348	23	192.168.2.23	245.109.147.201
Aug 8, 2022 23:17:52.471343040 CEST	64348	23	192.168.2.23	103.101.17.175
Aug 8, 2022 23:17:52.471369982 CEST	64348	23	192.168.2.23	122.44.101.57
Aug 8, 2022 23:17:52.471385002 CEST	64348	23	192.168.2.23	220.219.121.203
Aug 8, 2022 23:17:52.474731922 CEST	64348	23	192.168.2.23	74.187.103.184
Aug 8, 2022 23:17:52.474822044 CEST	64348	23	192.168.2.23	70.242.17.62
Aug 8, 2022 23:17:52.474834919 CEST	64348	23	192.168.2.23	101.159.125.233
Aug 8, 2022 23:17:52.474853039 CEST	64348	23	192.168.2.23	249.42.224.156
Aug 8, 2022 23:17:52.474872112 CEST	64348	23	192.168.2.23	151.27.75.128
Aug 8, 2022 23:17:52.474878073 CEST	64348	23	192.168.2.23	182.133.164.181
Aug 8, 2022 23:17:52.474884987 CEST	64348	23	192.168.2.23	146.28.180.191
Aug 8, 2022 23:17:52.474885941 CEST	64348	23	192.168.2.23	23.57.232.20
Aug 8, 2022 23:17:52.474898100 CEST	64348	23	192.168.2.23	59.232.211.186
Aug 8, 2022 23:17:52.474898100 CEST	64348	23	192.168.2.23	217.240.130.219
Aug 8, 2022 23:17:52.474914074 CEST	64348	23	192.168.2.23	157.174.170.45
Aug 8, 2022 23:17:52.474919081 CEST	64348	23	192.168.2.23	154.168.113.160
Aug 8, 2022 23:17:52.474930048 CEST	64348	23	192.168.2.23	218.127.136.88
Aug 8, 2022 23:17:52.474931002 CEST	64348	23	192.168.2.23	142.119.17.12
Aug 8, 2022 23:17:52.474975109 CEST	64348	23	192.168.2.23	208.81.29.64
Aug 8, 2022 23:17:52.474984884 CEST	64348	23	192.168.2.23	80.91.164.175
Aug 8, 2022 23:17:52.475001097 CEST	64348	23	192.168.2.23	183.183.44.218
Aug 8, 2022 23:17:52.475038052 CEST	64348	23	192.168.2.23	174.133.168.8
Aug 8, 2022 23:17:52.475042105 CEST	64348	23	192.168.2.23	169.104.220.7
Aug 8, 2022 23:17:52.475044966 CEST	64348	23	192.168.2.23	133.232.90.8
Aug 8, 2022 23:17:52.475044966 CEST	64348	23	192.168.2.23	213.177.164.23
Aug 8, 2022 23:17:52.475053072 CEST	64348	23	192.168.2.23	27.147.145.104
Aug 8, 2022 23:17:52.475059032 CEST	64348	23	192.168.2.23	40.29.27.109
Aug 8, 2022 23:17:52.475060940 CEST	64348	23	192.168.2.23	199.22.55.80
Aug 8, 2022 23:17:52.475081921 CEST	64348	23	192.168.2.23	216.16.210.129
Aug 8, 2022 23:17:52.475104094 CEST	64348	23	192.168.2.23	213.159.99.237
Aug 8, 2022 23:17:52.475112915 CEST	64348	23	192.168.2.23	249.203.177.119
Aug 8, 2022 23:17:52.475115061 CEST	64348	23	192.168.2.23	181.87.43.3
Aug 8, 2022 23:17:52.475117922 CEST	64348	23	192.168.2.23	128.8.55.179
Aug 8, 2022 23:17:52.475120068 CEST	64348	23	192.168.2.23	186.74.145.0
Aug 8, 2022 23:17:52.475128889 CEST	64348	23	192.168.2.23	156.181.88.171
Aug 8, 2022 23:17:52.475131989 CEST	64348	23	192.168.2.23	171.200.254.245
Aug 8, 2022 23:17:52.475132942 CEST	64348	23	192.168.2.23	206.90.146.181
Aug 8, 2022 23:17:52.475158930 CEST	64348	23	192.168.2.23	128.29.125.42
Aug 8, 2022 23:17:52.475188971 CEST	64348	23	192.168.2.23	164.29.164.14
Aug 8, 2022 23:17:52.475227118 CEST	64348	23	192.168.2.23	54.25.38.106
Aug 8, 2022 23:17:52.475230932 CEST	64348	23	192.168.2.23	205.135.44.159

System Behavior

Analysis Process: 6e180puJTD PID: 6227, Parent PID: 6121

General

Start time:	23:17:51
Start date:	08/08/2022
Path:	/tmp/6e180puJTD
Arguments:	/tmp/6e180puJTD
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: 6e180puJTD PID: 6229, Parent PID: 6227

General

Start time:	23:17:51
Start date:	08/08/2022
Path:	/tmp/6e180puJTD
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: 6e180puJTD PID: 6230, Parent PID: 6227

General

Start time:	23:17:51
Start date:	08/08/2022
Path:	/tmp/6e180puJTD
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: 6e180puJTD PID: 6232, Parent PID: 6227

General

Start time:	23:17:51
Start date:	08/08/2022
Path:	/tmp/6e180puJTD
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: 6e180puJTD PID: 6235, Parent PID: 6232

General

Start time:	23:17:51
Start date:	08/08/2022
Path:	/tmp/6e180puJTD
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: 6e180puJTD PID: 6337, Parent PID: 6235

General

Start time:	23:21:01
Start date:	08/08/2022
Path:	/tmp/6e180puJTD
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: 6e180puJTD PID: 6339, Parent PID: 6235

General

Start time:	23:21:01
Start date:	08/08/2022
Path:	/tmp/6e180puJTD
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: 6e180puJTD PID: 6236, Parent PID: 6232

General

Start time:	23:17:51
Start date:	08/08/2022
Path:	/tmp/6e180puJTD
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: 6e180puJTD PID: 6237, Parent PID: 6232

General

Start time:	23:17:51
Start date:	08/08/2022
Path:	/tmp/6e180puJTD
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	API monitoring, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 6e180puJTD

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: 6e180puJTD PID: 6227, Parent PID: 6121

General

Analysis Process: 6e180puJTD PID: 6229, Parent PID: 6227

General

Analysis Process: 6e180puJTD PID: 6230, Parent PID: 6227

General

Analysis Process: 6e180puJTD PID: 6232, Parent PID: 6227

General

Analysis Process: 6e180puJTD PID: 6235, Parent PID: 6232

General

Analysis Process: 6e180puJTD PID: 6337, Parent PID: 6235

General

Analysis Process: 6e180puJTD PID: 6339, Parent PID: 6235

General

Analysis Process: 6e180puJTD PID: 6236, Parent PID: 6232

General

Analysis Process: 6e180puJTD PID: 6237, Parent PID: 6232

General

Linux Analysis Report
6e180puJTD