Edit tour

Linux Analysis Report
CLqMCUCXCO

Overview

General Information

Sample Name:	CLqMCUCXCO
Analysis ID:	680646
MD5:	0d9bef8f8f3122657c1861adf01c3eab
SHA1:	1f9e60bbbbf572cd3fb8f79004bacd0cdb624fc8
SHA256:	a0ef9bb1cde6cc4d41a0a4a594c631763bbfa93ee76879b372fd61a466f85590
Tags:	32elfintelmirai
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Uses known network protocols on non-standard ports

Sample contains only a LOAD segment without any section mappings

Yara signature match

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample tries to kill a process (SIGKILL)

ELF contains segments with high entropy indicating compressed/encrypted content

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	680646
Start date and time: 08/08/202223:11:37	2022-08-08 23:11:37 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 40s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	CLqMCUCXCO
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal80.troj.evad.lin@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100

Runtime Messages

Command:	/tmp/CLqMCUCXCO
PID:	6225
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

CLqMCUCXCO (PID: 6225, Parent: 6124, MD5: 0d9bef8f8f3122657c1861adf01c3eab) Arguments: /tmp/CLqMCUCXCO

CLqMCUCXCO New Fork (PID: 6226, Parent: 6225)

CLqMCUCXCO New Fork (PID: 6317, Parent: 6226)

CLqMCUCXCO New Fork (PID: 6318, Parent: 6226)

CLqMCUCXCO New Fork (PID: 6319, Parent: 6318)

CLqMCUCXCO New Fork (PID: 6327, Parent: 6319)

CLqMCUCXCO New Fork (PID: 6328, Parent: 6319)

CLqMCUCXCO New Fork (PID: 6322, Parent: 6318)

CLqMCUCXCO New Fork (PID: 6323, Parent: 6318)

CLqMCUCXCO New Fork (PID: 6227, Parent: 6225)

CLqMCUCXCO New Fork (PID: 6228, Parent: 6225)

CLqMCUCXCO New Fork (PID: 6229, Parent: 6228)

CLqMCUCXCO New Fork (PID: 6320, Parent: 6229)

CLqMCUCXCO New Fork (PID: 6321, Parent: 6229)

CLqMCUCXCO New Fork (PID: 6230, Parent: 6228)

CLqMCUCXCO New Fork (PID: 6231, Parent: 6228)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6320.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6320.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6320.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6320.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6320.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6320.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6320.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6320.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6320.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6322.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6322.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6322.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6322.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6322.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6322.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6322.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6322.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6322.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6317.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6230.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6230.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6230.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6230.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6230.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6230.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6230.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6230.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6230.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6327.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6327.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6327.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6327.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6327.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6327.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6327.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6327.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6327.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6226.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6226.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6226.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6226.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6226.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6226.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6226.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6226.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6226.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6227.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6225.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6227.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6227.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6227.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6227.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6227.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6227.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6227.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6227.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 67 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: CLqMCUCXCO	Virustotal: Detection: 39%			Perma Link
Source: CLqMCUCXCO	ReversingLabs: Detection: 56%

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34898
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34902
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34904
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34906
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34908
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34910
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34914
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34920
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34922
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34924
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47468
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33356
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47476
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33364
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47490
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33382
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47510
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33398
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47526
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33416
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47544
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33434
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47558
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33452
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47576
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47592
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47610
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33468

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:35686 -> 208.67.106.33:1312

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.106.33
Source: unknown	TCP traffic detected without corresponding DNS query: 216.238.6.157
Source: unknown	TCP traffic detected without corresponding DNS query: 193.222.225.203
Source: unknown	TCP traffic detected without corresponding DNS query: 173.93.243.238
Source: unknown	TCP traffic detected without corresponding DNS query: 14.142.27.238
Source: unknown	TCP traffic detected without corresponding DNS query: 105.113.115.234
Source: unknown	TCP traffic detected without corresponding DNS query: 194.108.126.192
Source: unknown	TCP traffic detected without corresponding DNS query: 192.118.221.238
Source: unknown	TCP traffic detected without corresponding DNS query: 88.194.28.101
Source: unknown	TCP traffic detected without corresponding DNS query: 156.200.46.160
Source: unknown	TCP traffic detected without corresponding DNS query: 182.186.55.42
Source: unknown	TCP traffic detected without corresponding DNS query: 88.102.28.20
Source: unknown	TCP traffic detected without corresponding DNS query: 76.150.75.232
Source: unknown	TCP traffic detected without corresponding DNS query: 157.236.197.17
Source: unknown	TCP traffic detected without corresponding DNS query: 242.62.26.3
Source: unknown	TCP traffic detected without corresponding DNS query: 151.82.111.200
Source: unknown	TCP traffic detected without corresponding DNS query: 255.93.218.27
Source: unknown	TCP traffic detected without corresponding DNS query: 212.200.151.190
Source: unknown	TCP traffic detected without corresponding DNS query: 85.45.75.175
Source: unknown	TCP traffic detected without corresponding DNS query: 178.73.49.128
Source: unknown	TCP traffic detected without corresponding DNS query: 73.227.125.113
Source: unknown	TCP traffic detected without corresponding DNS query: 60.128.75.231
Source: unknown	TCP traffic detected without corresponding DNS query: 4.50.213.103
Source: unknown	TCP traffic detected without corresponding DNS query: 191.25.124.91
Source: unknown	TCP traffic detected without corresponding DNS query: 5.187.160.20
Source: unknown	TCP traffic detected without corresponding DNS query: 62.90.144.79
Source: unknown	TCP traffic detected without corresponding DNS query: 241.15.202.109
Source: unknown	TCP traffic detected without corresponding DNS query: 142.198.249.105
Source: unknown	TCP traffic detected without corresponding DNS query: 182.144.241.148
Source: unknown	TCP traffic detected without corresponding DNS query: 212.24.89.19
Source: unknown	TCP traffic detected without corresponding DNS query: 193.163.154.242
Source: unknown	TCP traffic detected without corresponding DNS query: 70.196.63.223
Source: unknown	TCP traffic detected without corresponding DNS query: 19.98.196.122
Source: unknown	TCP traffic detected without corresponding DNS query: 97.27.119.128
Source: unknown	TCP traffic detected without corresponding DNS query: 97.209.93.176
Source: unknown	TCP traffic detected without corresponding DNS query: 199.41.101.235
Source: unknown	TCP traffic detected without corresponding DNS query: 60.0.192.116
Source: unknown	TCP traffic detected without corresponding DNS query: 76.137.213.110
Source: unknown	TCP traffic detected without corresponding DNS query: 8.254.207.131
Source: unknown	TCP traffic detected without corresponding DNS query: 18.169.146.139
Source: unknown	TCP traffic detected without corresponding DNS query: 72.234.45.186
Source: unknown	TCP traffic detected without corresponding DNS query: 24.24.124.11
Source: unknown	TCP traffic detected without corresponding DNS query: 4.223.42.138
Source: unknown	TCP traffic detected without corresponding DNS query: 61.129.55.206
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.180.59
Source: unknown	TCP traffic detected without corresponding DNS query: 189.85.92.8
Source: unknown	TCP traffic detected without corresponding DNS query: 12.92.82.171
Source: unknown	TCP traffic detected without corresponding DNS query: 197.199.123.254
Source: unknown	TCP traffic detected without corresponding DNS query: 35.206.96.107

Source: CLqMCUCXCO

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: /tmp/CLqMCUCXCO (PID: 6226)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/CLqMCUCXCO (PID: 6229)	SIGKILL sent: pid: 936, result: successful

Source: classification engine

Classification label: mal80.troj.evad.lin@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/491/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/793/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/772/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/796/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/774/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/797/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/777/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/799/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/658/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/6226/exe
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/912/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/759/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/936/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/918/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/1/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/761/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/785/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/884/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/720/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/721/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/788/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/789/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/800/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/801/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/847/fd
Source: /tmp/CLqMCUCXCO (PID: 6226)	File opened: /proc/904/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/491/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/793/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/772/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/796/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/774/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/797/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/777/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/799/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/658/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/6229/exe
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/912/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/759/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/936/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/918/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/1/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/761/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/785/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/884/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/720/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/721/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/788/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/789/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/800/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/801/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/847/fd
Source: /tmp/CLqMCUCXCO (PID: 6229)	File opened: /proc/904/fd

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34898
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34902
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34904
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34906
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34908
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34910
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34914
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34920
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34922
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34924
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47468
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33356
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47476
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33364
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47490
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33382
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47510
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33398
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47526
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33416
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47544
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33434
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47558
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33452
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47576
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47592
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47610
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33468

Source: CLqMCUCXCO

Submission file: segment LOAD with 7.8712 entropy (max. 8.0)

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6320.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6322.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6230.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6327.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6226.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
CLqMCUCXCO	39%	Virustotal		Browse
CLqMCUCXCO	56%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	CLqMCUCXCO	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
42.69.171.161	unknown	Taiwan; Republic of China (ROC)	4249	LILLY-ASUS	false
172.38.84.30	unknown	United States	21928	T-MOBILE-AS21928US	false
34.59.214.73	unknown	United States	2686	ATGS-MMD-ASUS	false
209.27.25.134	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
114.3.148.80	unknown	Indonesia	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
4.69.47.238	unknown	United States	3356	LEVEL3US	false
177.153.108.0	unknown	Brazil	27715	LocawebServicosdeInternetSABR	false
73.12.240.93	unknown	United States	7922	COMCAST-7922US	false
111.18.78.21	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
145.149.36.228	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
174.146.78.98	unknown	United States	10507	SPCSUS	false
219.56.55.60	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
119.167.80.219	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
162.40.95.242	unknown	United States	7029	WINDSTREAMUS	false
67.114.131.14	unknown	United States	7018	ATT-INTERNET4US	false
42.63.8.28	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
179.187.164.239	unknown	Brazil	18881	TELEFONICABRASILSABR	false
199.15.84.104	unknown	Canada	21775	AS-AFILIAS-REGISTRY-SERVICESCA	false
104.126.211.58	unknown	United States	16625	AKAMAI-ASUS	false
44.11.16.27	unknown	United States	7377	UCSDUS	false
20.220.220.209	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
24.226.21.21	unknown	Canada	7992	COGECOWAVECA	false
252.235.157.209	unknown	Reserved	unknown	unknown	false
185.119.218.28	unknown	Czech Republic	198167	APPTOCLOUDAppToCloudserversvpsCZ	false
116.188.238.145	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
196.24.228.7	unknown	South Africa	36982	UCTZA	false
169.9.204.201	unknown	United States	203	CENTURYLINK-LEGACY-LVLT-203US	false
185.110.97.136	unknown	France	21212	SIGFOXFR	false
126.73.1.19	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
112.236.34.178	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
255.15.2.172	unknown	Reserved	unknown	unknown	false
161.79.55.185	unknown	Brazil	2715	FundacaoCarlosChagasFilhodeAmparoaPesquisaBR	false
44.155.182.240	unknown	United States	1213	HEANETIE	false
153.74.2.118	unknown	United States	14962	NCR-252US	false
177.227.216.188	unknown	Mexico	13999	MegaCableSAdeCVMX	false
208.240.166.235	unknown	United States	4208	THE-ISERV-COMPANYUS	false
105.219.30.252	unknown	South Africa	16637	MTNNS-ASZA	false
101.161.253.77	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
146.150.30.12	unknown	United States	15169	GOOGLEUS	false
111.75.79.72	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
44.135.83.109	unknown	United States	7377	UCSDUS	false
69.1.193.170	unknown	United States	26091	INDDCUS	false
74.218.42.85	unknown	United States	10796	TWC-10796-MIDWESTUS	false
211.106.91.154	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
206.52.224.241	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
48.11.106.104	unknown	United States	2686	ATGS-MMD-ASUS	false
46.205.80.66	unknown	Poland	12912	TMPL	false
107.5.192.223	unknown	United States	7922	COMCAST-7922US	false
45.106.6.110	unknown	Egypt	37069	MOBINILEG	false
184.193.182.209	unknown	United States	10507	SPCSUS	false
1.17.85.122	unknown	Korea Republic of	45996	GNJ-AS-KRDAOUTECHNOLOGYKR	false
167.97.21.240	unknown	United States	2055	LSU-1US	false
103.232.214.0	unknown	China	137443	ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	false
105.230.56.164	unknown	Kenya	36926	CKL1-ASNKE	false
96.135.51.166	unknown	United States	7922	COMCAST-7922US	false
180.21.226.128	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
86.55.160.156	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
144.28.237.126	unknown	United States	58541	CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN	false
84.26.62.18	unknown	Netherlands	33915	TNF-ASNL	false
251.66.133.29	unknown	Reserved	unknown	unknown	false
251.150.175.57	unknown	Reserved	unknown	unknown	false
86.158.230.107	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
112.175.44.174	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
120.63.148.81	unknown	India	17813	MTNL-APMahanagarTelephoneNigamLimitedIN	false
167.170.59.192	unknown	United States	59447	SAYFANETTR	false
218.159.110.4	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
172.198.108.117	unknown	Australia	18747	IFX18747US	false
209.95.232.103	unknown	United States	10676	GLOBALECUS	false
221.130.31.143	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
202.175.229.220	unknown	Philippines	9658	ETPI-IDS-AS-APEasternTelecomsPhilsIncPH	false
125.255.115.5	unknown	Japan	1221	ASN-TELSTRATelstraCorporationLtdAU	false
207.63.247.0	unknown	United States	6325	ILLINOIS-CENTURYUS	false
253.80.95.162	unknown	Reserved	unknown	unknown	false
80.221.104.15	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
48.239.46.98	unknown	United States	2686	ATGS-MMD-ASUS	false
102.216.30.96	unknown	unknown	36926	CKL1-ASNKE	false
71.62.22.214	unknown	United States	7922	COMCAST-7922US	false
187.18.78.229	unknown	Brazil	22689	SercomtelParticipacoesSABR	false
79.19.93.106	unknown	Italy	3269	ASN-IBSNAZIT	false
158.220.98.173	unknown	Switzerland	8556	LEVANTISCH	false
166.177.101.119	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
123.13.43.130	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
219.179.242.156	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
249.172.233.233	unknown	Reserved	unknown	unknown	false
212.167.96.87	unknown	European Union	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
188.23.65.155	unknown	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
23.33.161.135	unknown	United States	16625	AKAMAI-ASUS	false
118.193.69.175	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
205.176.123.6	unknown	United States	8103	STATE-OF-FLAUS	false
27.72.190.215	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
156.14.91.243	unknown	Italy	137	ASGARRConsortiumGARREU	false
144.91.156.168	unknown	Japan	131952	POTATO-NETAsahikawaCableTelevisionCoLtdJP	false
245.115.229.77	unknown	Reserved	unknown	unknown	false
71.69.198.211	unknown	United States	11426	TWC-11426-CAROLINASUS	false
42.139.61.221	unknown	China	4249	LILLY-ASUS	false
155.25.247.223	unknown	United States	1556	DNIC-ASBLK-01550-01601US	false
203.153.248.73	unknown	Australia	9822	AMNET-AU-APAmnetITServicesPtyLtdAU	false
109.173.24.136	unknown	Russian Federation	42610	NCNET-ASRU	false
115.40.220.193	unknown	Korea Republic of	9845	CJCKN-AS-KRLGHelloVisionCorpKR	false
5.53.131.174	unknown	Bulgaria	13124	IBGCBG	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped
Entropy (8bit):	7.86648515722169
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	CLqMCUCXCO
File size:	27712
MD5:	0d9bef8f8f3122657c1861adf01c3eab
SHA1:	1f9e60bbbbf572cd3fb8f79004bacd0cdb624fc8
SHA256:	a0ef9bb1cde6cc4d41a0a4a594c631763bbfa93ee76879b372fd61a466f85590
SHA512:	4643472e4ef2edb069bdc7a8fd18528ecf2ecc639a5786c3b9e878039b3faf42fa1b9eb52e70c665d0cc7351df75c80a2619ccb2ac97977fe17e657b51646463
SSDEEP:	768:u5+Kcrb9VDJeS2KTgdTHOBcK5ZCAySapo:hlrb9ve2Tg9QB5VGq
TLSH:	1FC2E1A360F6CD03C4F2837A1E3D59A621606439634DDE2E77AA5BC837460E4657ECCB
File Content Preview:	.ELF....................Hs..4...........4. ...(.....................Ck..Ck...................~...~..................Q.td................................UPX!........P...P......._........?d..ELF.......d.......4....4. (.......k.-.#. ......sw....$..w..\.\..A.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc07348
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x6b43	0x6b43	7.8712	0x5	R E	0x1000
LOAD	0xe80	0x8057e80	0x8057e80	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 8, 2022 23:12:24.708820105 CEST	42836	443	192.168.2.23	91.189.91.43
Aug 8, 2022 23:12:25.310239077 CEST	35686	1312	192.168.2.23	208.67.106.33
Aug 8, 2022 23:12:25.311868906 CEST	50030	23	192.168.2.23	216.238.6.157
Aug 8, 2022 23:12:25.311927080 CEST	50030	23	192.168.2.23	193.222.225.203
Aug 8, 2022 23:12:25.311928034 CEST	50030	23	192.168.2.23	173.93.243.238
Aug 8, 2022 23:12:25.311928034 CEST	50030	23	192.168.2.23	14.142.27.238
Aug 8, 2022 23:12:25.311942101 CEST	50030	23	192.168.2.23	105.113.115.234
Aug 8, 2022 23:12:25.311953068 CEST	50030	23	192.168.2.23	194.108.126.192
Aug 8, 2022 23:12:25.311956882 CEST	50030	23	192.168.2.23	192.118.221.238
Aug 8, 2022 23:12:25.311989069 CEST	50030	23	192.168.2.23	88.194.28.101
Aug 8, 2022 23:12:25.311990976 CEST	50030	23	192.168.2.23	156.200.46.160
Aug 8, 2022 23:12:25.311995983 CEST	50030	23	192.168.2.23	182.186.55.42
Aug 8, 2022 23:12:25.312000990 CEST	50030	23	192.168.2.23	88.102.28.20
Aug 8, 2022 23:12:25.312004089 CEST	50030	23	192.168.2.23	76.150.75.232
Aug 8, 2022 23:12:25.312006950 CEST	50030	23	192.168.2.23	157.236.197.17
Aug 8, 2022 23:12:25.312005997 CEST	50030	23	192.168.2.23	242.62.26.3
Aug 8, 2022 23:12:25.312031984 CEST	50030	23	192.168.2.23	151.82.111.200
Aug 8, 2022 23:12:25.312120914 CEST	50030	23	192.168.2.23	255.93.218.27
Aug 8, 2022 23:12:25.312123060 CEST	50030	23	192.168.2.23	212.200.151.190
Aug 8, 2022 23:12:25.312125921 CEST	50030	23	192.168.2.23	85.45.75.175
Aug 8, 2022 23:12:25.312125921 CEST	50030	23	192.168.2.23	178.73.49.128
Aug 8, 2022 23:12:25.312130928 CEST	50030	23	192.168.2.23	73.227.125.113
Aug 8, 2022 23:12:25.312133074 CEST	50030	23	192.168.2.23	60.128.75.231
Aug 8, 2022 23:12:25.312138081 CEST	50030	23	192.168.2.23	4.50.213.103
Aug 8, 2022 23:12:25.312149048 CEST	50030	23	192.168.2.23	191.25.124.91
Aug 8, 2022 23:12:25.312153101 CEST	50030	23	192.168.2.23	5.187.160.20
Aug 8, 2022 23:12:25.312155008 CEST	50030	23	192.168.2.23	62.90.144.79
Aug 8, 2022 23:12:25.312165022 CEST	50030	23	192.168.2.23	241.15.202.109
Aug 8, 2022 23:12:25.312167883 CEST	50030	23	192.168.2.23	142.198.249.105
Aug 8, 2022 23:12:25.312172890 CEST	50030	23	192.168.2.23	182.144.241.148
Aug 8, 2022 23:12:25.312179089 CEST	50030	23	192.168.2.23	212.24.89.19
Aug 8, 2022 23:12:25.312180996 CEST	50030	23	192.168.2.23	193.163.154.242
Aug 8, 2022 23:12:25.312191963 CEST	50030	23	192.168.2.23	70.196.63.223
Aug 8, 2022 23:12:25.312196016 CEST	50030	23	192.168.2.23	19.98.196.122
Aug 8, 2022 23:12:25.312196970 CEST	50030	23	192.168.2.23	97.27.119.128
Aug 8, 2022 23:12:25.312199116 CEST	50030	23	192.168.2.23	97.209.93.176
Aug 8, 2022 23:12:25.312196970 CEST	50030	23	192.168.2.23	199.41.101.235
Aug 8, 2022 23:12:25.312215090 CEST	50030	23	192.168.2.23	60.0.192.116
Aug 8, 2022 23:12:25.312217951 CEST	50030	23	192.168.2.23	76.137.213.110
Aug 8, 2022 23:12:25.312221050 CEST	50030	23	192.168.2.23	8.254.207.131
Aug 8, 2022 23:12:25.312227964 CEST	50030	23	192.168.2.23	18.169.146.139
Aug 8, 2022 23:12:25.312232971 CEST	50030	23	192.168.2.23	72.234.45.186
Aug 8, 2022 23:12:25.312237978 CEST	50030	23	192.168.2.23	24.24.124.11
Aug 8, 2022 23:12:25.312243938 CEST	50030	23	192.168.2.23	4.223.42.138
Aug 8, 2022 23:12:25.312247992 CEST	50030	23	192.168.2.23	61.129.55.206
Aug 8, 2022 23:12:25.312252045 CEST	50030	23	192.168.2.23	109.107.180.59
Aug 8, 2022 23:12:25.312254906 CEST	50030	23	192.168.2.23	189.85.92.8
Aug 8, 2022 23:12:25.312256098 CEST	50030	23	192.168.2.23	12.92.82.171
Aug 8, 2022 23:12:25.312261105 CEST	50030	23	192.168.2.23	197.199.123.254
Aug 8, 2022 23:12:25.312264919 CEST	50030	23	192.168.2.23	35.206.96.107
Aug 8, 2022 23:12:25.312272072 CEST	50030	23	192.168.2.23	101.35.146.77
Aug 8, 2022 23:12:25.312273979 CEST	50030	23	192.168.2.23	34.166.201.203
Aug 8, 2022 23:12:25.312273979 CEST	50030	23	192.168.2.23	166.38.143.197
Aug 8, 2022 23:12:25.312278986 CEST	50030	23	192.168.2.23	142.92.55.144
Aug 8, 2022 23:12:25.312283993 CEST	50030	23	192.168.2.23	116.115.164.147
Aug 8, 2022 23:12:25.312289000 CEST	50030	23	192.168.2.23	44.99.139.63
Aug 8, 2022 23:12:25.312290907 CEST	50030	23	192.168.2.23	106.41.121.177
Aug 8, 2022 23:12:25.312294960 CEST	50030	23	192.168.2.23	105.138.13.14
Aug 8, 2022 23:12:25.312299013 CEST	50030	23	192.168.2.23	109.4.197.231
Aug 8, 2022 23:12:25.312308073 CEST	50030	23	192.168.2.23	151.120.246.219
Aug 8, 2022 23:12:25.312309027 CEST	50030	23	192.168.2.23	117.210.163.11
Aug 8, 2022 23:12:25.312309980 CEST	50030	23	192.168.2.23	221.0.154.178
Aug 8, 2022 23:12:25.312311888 CEST	50030	23	192.168.2.23	34.15.59.115
Aug 8, 2022 23:12:25.312314034 CEST	50030	23	192.168.2.23	57.9.123.183
Aug 8, 2022 23:12:25.312314987 CEST	50030	23	192.168.2.23	203.57.214.228
Aug 8, 2022 23:12:25.312316895 CEST	50030	23	192.168.2.23	160.162.243.107
Aug 8, 2022 23:12:25.312328100 CEST	50030	23	192.168.2.23	53.88.154.86
Aug 8, 2022 23:12:25.312334061 CEST	50030	23	192.168.2.23	16.154.79.246
Aug 8, 2022 23:12:25.312345028 CEST	50030	23	192.168.2.23	169.114.217.114
Aug 8, 2022 23:12:25.312346935 CEST	50030	23	192.168.2.23	174.202.99.200
Aug 8, 2022 23:12:25.312349081 CEST	50030	23	192.168.2.23	154.1.239.6
Aug 8, 2022 23:12:25.312359095 CEST	50030	23	192.168.2.23	65.129.72.40
Aug 8, 2022 23:12:25.312366962 CEST	50030	23	192.168.2.23	76.26.211.48
Aug 8, 2022 23:12:25.312370062 CEST	50030	23	192.168.2.23	198.21.106.22
Aug 8, 2022 23:12:25.312371969 CEST	50030	23	192.168.2.23	204.211.155.78
Aug 8, 2022 23:12:25.312378883 CEST	50030	23	192.168.2.23	163.46.125.223
Aug 8, 2022 23:12:25.312382936 CEST	50030	23	192.168.2.23	169.196.220.91
Aug 8, 2022 23:12:25.312392950 CEST	50030	23	192.168.2.23	163.207.244.201
Aug 8, 2022 23:12:25.312401056 CEST	50030	23	192.168.2.23	185.75.29.16
Aug 8, 2022 23:12:25.312417030 CEST	50030	23	192.168.2.23	135.68.0.191
Aug 8, 2022 23:12:25.312494040 CEST	50030	23	192.168.2.23	90.85.208.6
Aug 8, 2022 23:12:25.312546015 CEST	50030	23	192.168.2.23	249.75.207.5
Aug 8, 2022 23:12:25.312551975 CEST	50030	23	192.168.2.23	204.47.246.248
Aug 8, 2022 23:12:25.312557936 CEST	50030	23	192.168.2.23	139.222.73.113
Aug 8, 2022 23:12:25.312568903 CEST	50030	23	192.168.2.23	194.155.71.66
Aug 8, 2022 23:12:25.312575102 CEST	50030	23	192.168.2.23	32.4.61.100
Aug 8, 2022 23:12:25.312580109 CEST	50030	23	192.168.2.23	89.166.23.21
Aug 8, 2022 23:12:25.312581062 CEST	50030	23	192.168.2.23	125.217.251.80
Aug 8, 2022 23:12:25.312583923 CEST	50030	23	192.168.2.23	193.57.36.99
Aug 8, 2022 23:12:25.312597036 CEST	50030	23	192.168.2.23	176.73.18.160
Aug 8, 2022 23:12:25.312601089 CEST	50030	23	192.168.2.23	5.206.13.37
Aug 8, 2022 23:12:25.312603951 CEST	50030	23	192.168.2.23	81.164.159.221
Aug 8, 2022 23:12:25.312606096 CEST	50030	23	192.168.2.23	61.149.52.85
Aug 8, 2022 23:12:25.312607050 CEST	50030	23	192.168.2.23	66.31.66.146
Aug 8, 2022 23:12:25.312617064 CEST	50030	23	192.168.2.23	78.109.23.60
Aug 8, 2022 23:12:25.312624931 CEST	50030	23	192.168.2.23	141.45.89.140
Aug 8, 2022 23:12:25.312633038 CEST	50030	23	192.168.2.23	45.102.25.123
Aug 8, 2022 23:12:25.312686920 CEST	50030	23	192.168.2.23	160.104.112.134
Aug 8, 2022 23:12:25.312700033 CEST	50030	23	192.168.2.23	106.208.171.48
Aug 8, 2022 23:12:25.312714100 CEST	50030	23	192.168.2.23	151.0.37.132

System Behavior

Analysis Process: CLqMCUCXCO PID: 6225, Parent PID: 6124

General

Start time:	23:12:24
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	/tmp/CLqMCUCXCO
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6226, Parent PID: 6225

General

Start time:	23:12:24
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6317, Parent PID: 6226

General

Start time:	23:15:16
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6318, Parent PID: 6226

General

Start time:	23:15:16
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6319, Parent PID: 6318

General

Start time:	23:15:16
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6327, Parent PID: 6319

General

Start time:	23:15:21
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6328, Parent PID: 6319

General

Start time:	23:15:21
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6322, Parent PID: 6318

General

Start time:	23:15:16
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6323, Parent PID: 6318

General

Start time:	23:15:16
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6227, Parent PID: 6225

General

Start time:	23:12:24
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6228, Parent PID: 6225

General

Start time:	23:12:24
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6229, Parent PID: 6228

General

Start time:	23:12:24
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6320, Parent PID: 6229

General

Start time:	23:15:16
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6321, Parent PID: 6229

General

Start time:	23:15:16
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6230, Parent PID: 6228

General

Start time:	23:12:24
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Analysis Process: CLqMCUCXCO PID: 6231, Parent PID: 6228

General

Start time:	23:12:24
Start date:	08/08/2022
Path:	/tmp/CLqMCUCXCO
Arguments:	n/a
File size:	27712 bytes
MD5 hash:	0d9bef8f8f3122657c1861adf01c3eab

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report CLqMCUCXCO

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: CLqMCUCXCO PID: 6225, Parent PID: 6124

General

Analysis Process: CLqMCUCXCO PID: 6226, Parent PID: 6225

General

Analysis Process: CLqMCUCXCO PID: 6317, Parent PID: 6226

General

Analysis Process: CLqMCUCXCO PID: 6318, Parent PID: 6226

General

Analysis Process: CLqMCUCXCO PID: 6319, Parent PID: 6318

General

Analysis Process: CLqMCUCXCO PID: 6327, Parent PID: 6319

General

Analysis Process: CLqMCUCXCO PID: 6328, Parent PID: 6319

General

Analysis Process: CLqMCUCXCO PID: 6322, Parent PID: 6318

General

Analysis Process: CLqMCUCXCO PID: 6323, Parent PID: 6318

General

Analysis Process: CLqMCUCXCO PID: 6227, Parent PID: 6225

General

Linux Analysis Report
CLqMCUCXCO