Edit tour

Linux Analysis Report
2DbzKHhgOH

Overview

General Information

Sample Name:	2DbzKHhgOH
Analysis ID:	680657
MD5:	91e1ba2317dac69005bd8f5494297730
SHA1:	314ac7afbe482e1a412632950bc03f5d00bd6e0a
SHA256:	7610f435e009a531631ad480f342b21b87e56c05ac55d66ad99a1a3e5523fad2
Tags:	32elfmiraisparc
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Uses known network protocols on non-standard ports

Yara signature match

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	680657
Start date and time: 08/08/202223:35:59	2022-08-08 23:35:59 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 36s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	2DbzKHhgOH
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal76.troj.lin@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100

Runtime Messages

Command:	/tmp/2DbzKHhgOH
PID:	6223
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

2DbzKHhgOH (PID: 6223, Parent: 6120, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/2DbzKHhgOH

2DbzKHhgOH New Fork (PID: 6226, Parent: 6223)

2DbzKHhgOH New Fork (PID: 6242, Parent: 6226)

2DbzKHhgOH New Fork (PID: 6244, Parent: 6226)

2DbzKHhgOH New Fork (PID: 6246, Parent: 6244)

2DbzKHhgOH New Fork (PID: 6256, Parent: 6246)

2DbzKHhgOH New Fork (PID: 6257, Parent: 6246)

2DbzKHhgOH New Fork (PID: 6251, Parent: 6244)

2DbzKHhgOH New Fork (PID: 6253, Parent: 6244)

2DbzKHhgOH New Fork (PID: 6227, Parent: 6223)

2DbzKHhgOH New Fork (PID: 6229, Parent: 6223)

2DbzKHhgOH New Fork (PID: 6232, Parent: 6229)

2DbzKHhgOH New Fork (PID: 6260, Parent: 6232)

2DbzKHhgOH New Fork (PID: 6262, Parent: 6232)

2DbzKHhgOH New Fork (PID: 6234, Parent: 6229)

2DbzKHhgOH New Fork (PID: 6236, Parent: 6229)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
2DbzKHhgOH	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
2DbzKHhgOH	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1034c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1039c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1043c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1048c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
2DbzKHhgOH	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10870:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6223.1.00007f4910011000.00007f4910023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6223.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1034c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1039c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1043c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1048c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6223.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10870:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6242.1.00007f4910011000.00007f4910023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6242.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1034c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1039c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1043c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1048c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6242.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10870:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6256.1.00007f4910011000.00007f4910023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6256.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1034c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1039c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1043c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1048c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6256.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10870:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6226.1.00007f4910011000.00007f4910023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6226.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1034c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1039c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1043c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1048c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6226.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10870:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6260.1.00007f4910011000.00007f4910023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6260.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1034c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1039c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1043c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1048c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6260.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10870:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6227.1.00007f4910011000.00007f4910023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6227.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1034c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1039c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1043c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1048c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6227.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10870:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6234.1.00007f4910011000.00007f4910023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6234.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1034c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1039c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1043c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1048c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6234.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10870:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6251.1.00007f4910011000.00007f4910023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6251.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1034c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1039c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1043c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1048c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6251.1.00007f4910011000.00007f4910023000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10870:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 2DbzKHhgOH PID: 6223	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x138:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x160:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 2DbzKHhgOH PID: 6223	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x506:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 2DbzKHhgOH PID: 6226	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x23bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x240b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x241f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2433:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2447:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x245b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x246f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2483:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2497:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x250f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2523:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2537:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x254b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 2DbzKHhgOH PID: 6226	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x2879:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 2DbzKHhgOH PID: 6227	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ad4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ae8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4afc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 2DbzKHhgOH PID: 6227	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x4e52:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 2DbzKHhgOH PID: 6234	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4bd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4bea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4bfe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 2DbzKHhgOH PID: 6234	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x5094:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 2DbzKHhgOH PID: 6242	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x124:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x138:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x160:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x174:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 2DbzKHhgOH PID: 6242	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x506:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 2DbzKHhgOH PID: 6256	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x513:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x527:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x53b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x54f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x563:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x577:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x58b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x59f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x603:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x617:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x62b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x63f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x653:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 2DbzKHhgOH PID: 6256	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x981:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: 2DbzKHhgOH PID: 6260	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xed90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xede0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeebc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeed0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeee4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeef8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xef20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 2DbzKHhgOH PID: 6260	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xf24e:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 33 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2DbzKHhgOH	Virustotal: Detection: 56%			Perma Link
Source: 2DbzKHhgOH	ReversingLabs: Detection: 53%

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54828
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39698
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39834
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55020
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39992
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55224
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40170
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55448
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40338
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55666
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40516
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40672
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55858
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40822
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56052
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40984
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56248
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41152
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56440
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56628
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57026
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57174
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57320
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57462
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57602
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57758
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57912
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58058
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58194
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58346

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:35686 -> 208.67.106.33:1312

Source: /tmp/2DbzKHhgOH (PID: 6226)	Socket: 0.0.0.0::0
Source: /tmp/2DbzKHhgOH (PID: 6226)	Socket: 0.0.0.0::23
Source: /tmp/2DbzKHhgOH (PID: 6226)	Socket: 0.0.0.0::53413
Source: /tmp/2DbzKHhgOH (PID: 6226)	Socket: 0.0.0.0::80
Source: /tmp/2DbzKHhgOH (PID: 6226)	Socket: 0.0.0.0::52869
Source: /tmp/2DbzKHhgOH (PID: 6226)	Socket: 0.0.0.0::37215
Source: /tmp/2DbzKHhgOH (PID: 6232)	Socket: 0.0.0.0::0

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.106.33
Source: unknown	TCP traffic detected without corresponding DNS query: 103.192.46.127
Source: unknown	TCP traffic detected without corresponding DNS query: 34.201.192.127
Source: unknown	TCP traffic detected without corresponding DNS query: 37.34.203.231
Source: unknown	TCP traffic detected without corresponding DNS query: 59.155.217.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.0.81.169
Source: unknown	TCP traffic detected without corresponding DNS query: 187.127.228.76
Source: unknown	TCP traffic detected without corresponding DNS query: 47.195.84.144
Source: unknown	TCP traffic detected without corresponding DNS query: 59.4.192.49
Source: unknown	TCP traffic detected without corresponding DNS query: 20.96.18.204
Source: unknown	TCP traffic detected without corresponding DNS query: 84.144.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 19.37.51.49
Source: unknown	TCP traffic detected without corresponding DNS query: 208.233.144.26
Source: unknown	TCP traffic detected without corresponding DNS query: 54.41.170.171
Source: unknown	TCP traffic detected without corresponding DNS query: 217.171.83.43
Source: unknown	TCP traffic detected without corresponding DNS query: 179.26.154.158
Source: unknown	TCP traffic detected without corresponding DNS query: 98.60.144.40
Source: unknown	TCP traffic detected without corresponding DNS query: 181.156.238.221
Source: unknown	TCP traffic detected without corresponding DNS query: 13.46.186.171
Source: unknown	TCP traffic detected without corresponding DNS query: 27.77.33.53
Source: unknown	TCP traffic detected without corresponding DNS query: 186.197.181.157
Source: unknown	TCP traffic detected without corresponding DNS query: 221.253.219.9
Source: unknown	TCP traffic detected without corresponding DNS query: 86.23.243.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.134.208.149
Source: unknown	TCP traffic detected without corresponding DNS query: 112.1.0.103
Source: unknown	TCP traffic detected without corresponding DNS query: 176.25.19.129
Source: unknown	TCP traffic detected without corresponding DNS query: 203.64.177.206
Source: unknown	TCP traffic detected without corresponding DNS query: 89.62.238.247
Source: unknown	TCP traffic detected without corresponding DNS query: 38.46.34.49
Source: unknown	TCP traffic detected without corresponding DNS query: 193.195.180.86
Source: unknown	TCP traffic detected without corresponding DNS query: 172.69.227.236
Source: unknown	TCP traffic detected without corresponding DNS query: 85.253.53.57
Source: unknown	TCP traffic detected without corresponding DNS query: 108.31.39.77
Source: unknown	TCP traffic detected without corresponding DNS query: 203.231.234.124
Source: unknown	TCP traffic detected without corresponding DNS query: 169.201.242.166
Source: unknown	TCP traffic detected without corresponding DNS query: 5.104.148.237
Source: unknown	TCP traffic detected without corresponding DNS query: 165.76.161.13
Source: unknown	TCP traffic detected without corresponding DNS query: 31.37.123.68
Source: unknown	TCP traffic detected without corresponding DNS query: 211.128.4.190
Source: unknown	TCP traffic detected without corresponding DNS query: 253.49.98.164
Source: unknown	TCP traffic detected without corresponding DNS query: 145.149.166.190
Source: unknown	TCP traffic detected without corresponding DNS query: 105.246.16.77
Source: unknown	TCP traffic detected without corresponding DNS query: 122.34.230.107
Source: unknown	TCP traffic detected without corresponding DNS query: 83.113.136.199
Source: unknown	TCP traffic detected without corresponding DNS query: 74.141.227.216
Source: unknown	TCP traffic detected without corresponding DNS query: 191.241.145.50
Source: unknown	TCP traffic detected without corresponding DNS query: 143.31.39.206
Source: unknown	TCP traffic detected without corresponding DNS query: 172.42.75.157
Source: unknown	TCP traffic detected without corresponding DNS query: 250.49.180.16
Source: unknown	TCP traffic detected without corresponding DNS query: 254.6.5.190

System Summary

Malicious sample detected (through community Yara rule)

Source: 2DbzKHhgOH, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 2DbzKHhgOH, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6223.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6223.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6242.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6242.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6256.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6256.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6226.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6226.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6260.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6260.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6227.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6227.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6234.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6234.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6251.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6251.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6223, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6223, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6226, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6226, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6227, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6227, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6234, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6234, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6242, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6242, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6256, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6256, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6260, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 2DbzKHhgOH PID: 6260, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: 2DbzKHhgOH, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 2DbzKHhgOH, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6223.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6223.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6242.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6242.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6256.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6256.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6226.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6226.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6260.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6260.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6227.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6227.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6234.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6234.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6251.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6251.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6223, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6223, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6226, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6226, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6227, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6227, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6234, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6234, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6242, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6242, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6256, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6256, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6260, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 2DbzKHhgOH PID: 6260, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/2DbzKHhgOH (PID: 6226)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/2DbzKHhgOH (PID: 6232)	SIGKILL sent: pid: 936, result: successful

Source: classification engine

Classification label: mal76.troj.lin@0/0@0/0

Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/491/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/793/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/772/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/796/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/774/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/797/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/777/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/799/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/658/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/912/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/759/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/936/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/918/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/1/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/761/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/785/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/884/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/720/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/721/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/788/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/789/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/800/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/801/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/847/fd
Source: /tmp/2DbzKHhgOH (PID: 6232)	File opened: /proc/904/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/491/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/793/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/772/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/796/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/774/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/797/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/777/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/799/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/658/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/912/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/759/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/936/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/918/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/1/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/761/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/785/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/884/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/720/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/721/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/788/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/789/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/800/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/801/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/847/fd
Source: /tmp/2DbzKHhgOH (PID: 6226)	File opened: /proc/904/fd

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 54828
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39698
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39834
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55020
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39992
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55224
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40170
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55448
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40338
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55666
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40516
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40672
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55858
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40822
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56052
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 40984
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56248
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 41152
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56440
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56628
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57026
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57174
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57320
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57462
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57602
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57758
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 57912
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58058
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58194
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 58346

Source: /tmp/2DbzKHhgOH (PID: 6223)

Queries kernel information via 'uname':

Source: 2DbzKHhgOH, 6223.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6226.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6242.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6256.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6251.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6227.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6260.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6234.1.00005636a8392000.00005636a8417000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: 2DbzKHhgOH, 6223.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6226.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6242.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6256.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6251.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6227.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6260.1.00005636a8392000.00005636a8417000.rw-.sdmp, 2DbzKHhgOH, 6234.1.00005636a8392000.00005636a8417000.rw-.sdmp	Binary or memory string: 6V!/etc/qemu-binfmt/sparc
Source: 2DbzKHhgOH, 6223.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6226.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6242.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6256.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6251.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6227.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6260.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6234.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc
Source: 2DbzKHhgOH, 6223.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6226.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6242.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6256.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6251.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6227.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6260.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp, 2DbzKHhgOH, 6234.1.00007ffdbfea2000.00007ffdbfec3000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/2DbzKHhgOHSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/2DbzKHhgOH

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2DbzKHhgOH, type: SAMPLE
Source: Yara match	File source: 6223.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6242.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6226.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6260.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6234.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6251.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2DbzKHhgOH, type: SAMPLE
Source: Yara match	File source: 6223.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6242.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6226.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6260.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6234.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6251.1.00007f4910011000.00007f4910023000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
2DbzKHhgOH	56%	Virustotal		Browse
2DbzKHhgOH	54%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
168.232.195.12	unknown	Brazil	264947	LUIZLIMAECIALTDA-MEBR	false
172.242.149.102	unknown	United States	7155	VIASAT-SP-BACKBONEUS	false
244.20.66.52	unknown	Reserved	unknown	unknown	false
171.113.147.143	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
19.169.88.87	unknown	United States	3	MIT-GATEWAYSUS	false
63.89.37.172	unknown	United States	701	UUNETUS	false
57.250.79.115	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
17.187.225.236	unknown	United States	714	APPLE-ENGINEERINGUS	false
179.178.200.39	unknown	Brazil	18881	TELEFONICABRASILSABR	false
212.236.166.35	unknown	Austria	8245	VIDEOBROADCAST-ASAT	false
156.111.211.80	unknown	United States	395139	NYP-INTERNETUS	false
172.249.237.250	unknown	United States	20001	TWC-20001-PACWESTUS	false
154.141.21.12	unknown	Egypt	37069	MOBINILEG	false
172.78.20.231	unknown	United States	5650	FRONTIER-FRTRUS	false
242.114.167.34	unknown	Reserved	unknown	unknown	false
250.72.175.183	unknown	Reserved	unknown	unknown	false
12.33.245.124	unknown	United States	7018	ATT-INTERNET4US	false
92.100.198.12	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
148.183.118.63	unknown	United States	11529	NGUS-ASUS	false
74.164.154.157	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
187.0.44.224	unknown	unknown	270589	MarcioHenriqueMalaquiasJuniorBR	false
101.91.3.194	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
162.41.243.8	unknown	United States	53984	AS-WELLSTARUS	false
76.251.40.142	unknown	United States	7018	ATT-INTERNET4US	false
9.234.214.193	unknown	United States	3356	LEVEL3US	false
210.55.200.75	unknown	New Zealand	4648	SPARK-NZGlobal-GatewayInternetNZ	false
210.151.57.163	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
146.35.171.49	unknown	United States	197938	TRAVIANGAMESDE	false
130.1.17.5	unknown	United States	6908	DATAHOPDatahop-SixDegreesGB	false
242.60.251.65	unknown	Reserved	unknown	unknown	false
193.215.94.85	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
69.241.251.91	unknown	United States	7922	COMCAST-7922US	false
5.248.220.111	unknown	Ukraine	15895	KSNET-ASUA	false
53.70.141.206	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
145.161.131.179	unknown	Netherlands	59524	KPN-IAASNL	false
255.235.153.74	unknown	Reserved	unknown	unknown	false
124.168.11.239	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	false
12.238.112.74	unknown	United States	11085	PDI-HQ-INETUS	false
81.156.178.92	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
112.58.214.171	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
16.122.9.243	unknown	United States	unknown	unknown	false
142.148.79.137	unknown	Canada	808	GONET-ASN-1CA	false
171.117.63.31	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
105.237.204.73	unknown	South Africa	16637	MTNNS-ASZA	false
84.228.172.237	unknown	Israel	9116	GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste	false
41.143.104.16	unknown	Morocco	36903	MT-MPLSMA	false
255.108.118.255	unknown	Reserved	unknown	unknown	false
91.220.198.112	unknown	Ukraine	50304	BLIXNO	false
57.184.201.154	unknown	Belgium	2686	ATGS-MMD-ASUS	false
212.225.90.64	unknown	United Kingdom	2529	DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide	false
14.251.158.152	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
167.185.27.193	unknown	United States	15071	BAX-BGPUS	false
70.46.78.210	unknown	United States	7029	WINDSTREAMUS	false
188.201.177.170	unknown	Netherlands	1136	KPNKPNNationalEU	false
129.6.93.246	unknown	United States	49	US-NATIONAL-INSTITUTE-OF-STANDARDS-AND-TECHNOLOGYUS	false
44.80.25.38	unknown	United States	7377	UCSDUS	false
190.14.82.129	unknown	Bolivia	22541	MegaLinkBO	false
91.118.21.149	unknown	Austria	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
246.114.251.206	unknown	Reserved	unknown	unknown	false
98.33.199.221	unknown	United States	7922	COMCAST-7922US	false
76.240.155.100	unknown	United States	7018	ATT-INTERNET4US	false
175.227.77.55	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
216.217.214.98	unknown	United States	7029	WINDSTREAMUS	false
154.40.28.102	unknown	United States	174	COGENT-174US	false
210.77.15.166	unknown	China	7497	CSTNET-AS-APComputerNetworkInformationCenterCN	false
207.218.72.98	unknown	United States	3549	LVLT-3549US	false
244.239.113.71	unknown	Reserved	unknown	unknown	false
199.55.108.184	unknown	United States	398192	ARDOT-NET-01US	false
219.111.80.29	unknown	Japan	2497	IIJInternetInitiativeJapanIncJP	false
109.35.142.232	unknown	Netherlands	15480	VFNL-ASVodafoneNLAutonomousSystemNL	false
240.58.79.8	unknown	Reserved	unknown	unknown	false
218.19.201.2	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
161.210.39.255	unknown	United States	14513	DMACCUS	false
223.30.216.212	unknown	India	9583	SIFY-AS-INSifyLimitedIN	false
14.88.182.111	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
177.67.65.0	unknown	Brazil	53011	KARCHERINDECOMLTDABR	false
85.144.20.7	unknown	Netherlands	50266	TMOBILE-THUISNL	false
220.53.144.208	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
2.64.113.156	unknown	Sweden	44034	HI3GSE	false
202.153.150.34	unknown	Indonesia	10208	THENET-AS-ID-APPTMilleniumInternetindoID	false
42.42.63.189	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
65.195.47.35	unknown	United States	701	UUNETUS	false
57.62.64.150	unknown	Belgium	2686	ATGS-MMD-ASUS	false
165.176.234.90	unknown	United States	7046	RFC2270-UUNET-CUSTOMERUS	false
184.178.190.91	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
91.19.165.16	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
122.102.168.192	unknown	Japan	9617	ZAQJupiterTelecommunicationsCoLtdJP	false
174.92.228.99	unknown	Canada	577	BACOMCA	false
79.156.170.130	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
204.151.108.241	unknown	United States	11303	DATARETURNUS	false
246.235.249.98	unknown	Reserved	unknown	unknown	false
212.127.114.0	unknown	Turkey	12729	HSBC_TR_BANK_INTERNETTR	false
176.28.39.79	unknown	Germany	35329	GD-EMEA-DC-CGN3DE	false
254.151.225.92	unknown	Reserved	unknown	unknown	false
182.133.200.190	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
216.60.3.85	unknown	United States	7018	ATT-INTERNET4US	false
173.207.5.161	unknown	United States	6407	PRIMUS-AS6407CA	false
12.15.64.253	unknown	United States	32328	ALASCOM-IP-MANAGED-NETWORKUS	false
198.119.252.109	unknown	United States	297	AS297US	false
253.179.129.161	unknown	Reserved	unknown	unknown	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.008811747351218
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	2DbzKHhgOH
File size:	74752
MD5:	91e1ba2317dac69005bd8f5494297730
SHA1:	314ac7afbe482e1a412632950bc03f5d00bd6e0a
SHA256:	7610f435e009a531631ad480f342b21b87e56c05ac55d66ad99a1a3e5523fad2
SHA512:	526e6ae27f06027083d7d0eb5c1b02bd0c5d3aae35769ba19fd15371a5c6b7bc1ce047c071c2b112cd9d0069094f29ca323cd1929ca6510723a7345babc27bec
SSDEEP:	1536:hD/B6f6UD5hAS7mo0DCCAXESKV6v3G78nN9WV:927jqCe8v3GI/W
TLSH:	82732A26B97A1E26C0D4B57E60FB8B11F5E1278E26B4C50A7D720E5EEF147006502EF7
File Content Preview:	.ELF...........................4.."p.....4. ...(.......................0...0.............. ... ... ....0............dt.Q................................@..(....@.@.................#.....b0..`.....!..... ...@.....".........`......$ ... ...@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	74352
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0x10248	0x0	0x6	AX	4
.fini	PROGBITS	0x202f8	0x102f8	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x20310	0x10310	0x1920	0x0	0x2	A	8
.ctors	PROGBITS	0x32000	0x12000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x32008	0x12008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x32018	0x12018	0x218	0x0	0x3	WA	8
.bss	NOBITS	0x32230	0x12230	0x288	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x12230	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x11c30	0x11c30	6.0760	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x12000	0x32000	0x32000	0x230	0x4b8	2.9317	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 8, 2022 23:36:45.717706919 CEST	35686	1312	192.168.2.23	208.67.106.33
Aug 8, 2022 23:36:45.738190889 CEST	63474	23	192.168.2.23	103.192.46.127
Aug 8, 2022 23:36:45.738291979 CEST	63474	23	192.168.2.23	34.201.192.127
Aug 8, 2022 23:36:45.738368988 CEST	63474	23	192.168.2.23	37.34.203.231
Aug 8, 2022 23:36:45.738465071 CEST	63474	23	192.168.2.23	59.155.217.82
Aug 8, 2022 23:36:45.738518000 CEST	63474	23	192.168.2.23	79.0.81.169
Aug 8, 2022 23:36:45.738531113 CEST	63474	23	192.168.2.23	187.127.228.76
Aug 8, 2022 23:36:45.738550901 CEST	63474	23	192.168.2.23	47.195.84.144
Aug 8, 2022 23:36:45.738552094 CEST	63474	23	192.168.2.23	59.4.192.49
Aug 8, 2022 23:36:45.738564014 CEST	63474	23	192.168.2.23	20.96.18.204
Aug 8, 2022 23:36:45.738595009 CEST	63474	23	192.168.2.23	84.144.162.32
Aug 8, 2022 23:36:45.738642931 CEST	63474	23	192.168.2.23	19.37.51.49
Aug 8, 2022 23:36:45.738646030 CEST	63474	23	192.168.2.23	208.233.144.26
Aug 8, 2022 23:36:45.738653898 CEST	63474	23	192.168.2.23	54.41.170.171
Aug 8, 2022 23:36:45.738656044 CEST	63474	23	192.168.2.23	217.171.83.43
Aug 8, 2022 23:36:45.738665104 CEST	63474	23	192.168.2.23	179.26.154.158
Aug 8, 2022 23:36:45.738688946 CEST	63474	23	192.168.2.23	98.60.144.40
Aug 8, 2022 23:36:45.738707066 CEST	63474	23	192.168.2.23	181.156.238.221
Aug 8, 2022 23:36:45.738739014 CEST	63474	23	192.168.2.23	13.46.186.171
Aug 8, 2022 23:36:45.738763094 CEST	63474	23	192.168.2.23	27.77.33.53
Aug 8, 2022 23:36:45.738775015 CEST	63474	23	192.168.2.23	186.197.181.157
Aug 8, 2022 23:36:45.738802910 CEST	63474	23	192.168.2.23	221.253.219.9
Aug 8, 2022 23:36:45.738805056 CEST	63474	23	192.168.2.23	86.23.243.141
Aug 8, 2022 23:36:45.738820076 CEST	63474	23	192.168.2.23	217.134.208.149
Aug 8, 2022 23:36:45.738837957 CEST	63474	23	192.168.2.23	112.1.0.103
Aug 8, 2022 23:36:45.738853931 CEST	63474	23	192.168.2.23	176.25.19.129
Aug 8, 2022 23:36:45.738888025 CEST	63474	23	192.168.2.23	203.64.177.206
Aug 8, 2022 23:36:45.738966942 CEST	63474	23	192.168.2.23	89.62.238.247
Aug 8, 2022 23:36:45.738970041 CEST	63474	23	192.168.2.23	38.46.34.49
Aug 8, 2022 23:36:45.738995075 CEST	63474	23	192.168.2.23	193.195.180.86
Aug 8, 2022 23:36:45.739022970 CEST	63474	23	192.168.2.23	172.69.227.236
Aug 8, 2022 23:36:45.739032984 CEST	63474	23	192.168.2.23	85.253.53.57
Aug 8, 2022 23:36:45.739048004 CEST	63474	23	192.168.2.23	181.210.159.110
Aug 8, 2022 23:36:45.739059925 CEST	63474	23	192.168.2.23	108.31.39.77
Aug 8, 2022 23:36:45.739131927 CEST	63474	23	192.168.2.23	203.231.234.124
Aug 8, 2022 23:36:45.739140987 CEST	63474	23	192.168.2.23	169.201.242.166
Aug 8, 2022 23:36:45.739159107 CEST	63474	23	192.168.2.23	5.104.148.237
Aug 8, 2022 23:36:45.739164114 CEST	63474	23	192.168.2.23	165.76.161.13
Aug 8, 2022 23:36:45.739192009 CEST	63474	23	192.168.2.23	31.37.123.68
Aug 8, 2022 23:36:45.739198923 CEST	63474	23	192.168.2.23	211.128.4.190
Aug 8, 2022 23:36:45.739209890 CEST	63474	23	192.168.2.23	253.49.98.164
Aug 8, 2022 23:36:45.739211082 CEST	63474	23	192.168.2.23	145.149.166.190
Aug 8, 2022 23:36:45.739217043 CEST	63474	23	192.168.2.23	105.246.16.77
Aug 8, 2022 23:36:45.739300966 CEST	63474	23	192.168.2.23	122.34.230.107
Aug 8, 2022 23:36:45.739316940 CEST	63474	23	192.168.2.23	83.113.136.199
Aug 8, 2022 23:36:45.739322901 CEST	63474	23	192.168.2.23	74.141.227.216
Aug 8, 2022 23:36:45.739351988 CEST	63474	23	192.168.2.23	191.241.145.50
Aug 8, 2022 23:36:45.739351988 CEST	63474	23	192.168.2.23	143.31.39.206
Aug 8, 2022 23:36:45.739353895 CEST	63474	23	192.168.2.23	172.42.75.157
Aug 8, 2022 23:36:45.739363909 CEST	63474	23	192.168.2.23	250.49.180.16
Aug 8, 2022 23:36:45.739367008 CEST	63474	23	192.168.2.23	254.6.5.190
Aug 8, 2022 23:36:45.739368916 CEST	63474	23	192.168.2.23	23.117.180.233
Aug 8, 2022 23:36:45.739377022 CEST	63474	23	192.168.2.23	250.87.178.37
Aug 8, 2022 23:36:45.739382029 CEST	63474	23	192.168.2.23	94.89.8.144
Aug 8, 2022 23:36:45.739389896 CEST	63474	23	192.168.2.23	248.181.33.119
Aug 8, 2022 23:36:45.739402056 CEST	63474	23	192.168.2.23	246.223.89.164
Aug 8, 2022 23:36:45.739403009 CEST	63474	23	192.168.2.23	77.23.19.199
Aug 8, 2022 23:36:45.739501953 CEST	63474	23	192.168.2.23	43.149.121.40
Aug 8, 2022 23:36:45.739504099 CEST	63474	23	192.168.2.23	85.41.14.40
Aug 8, 2022 23:36:45.739507914 CEST	63474	23	192.168.2.23	4.252.179.205
Aug 8, 2022 23:36:45.739517927 CEST	63474	23	192.168.2.23	175.85.82.245
Aug 8, 2022 23:36:45.739528894 CEST	63474	23	192.168.2.23	109.154.125.193
Aug 8, 2022 23:36:45.739535093 CEST	63474	23	192.168.2.23	104.136.31.31
Aug 8, 2022 23:36:45.739540100 CEST	63474	23	192.168.2.23	81.197.68.65
Aug 8, 2022 23:36:45.739551067 CEST	63474	23	192.168.2.23	253.113.184.108
Aug 8, 2022 23:36:45.739557981 CEST	63474	23	192.168.2.23	255.152.233.156
Aug 8, 2022 23:36:45.739557981 CEST	63474	23	192.168.2.23	12.151.117.43
Aug 8, 2022 23:36:45.739566088 CEST	63474	23	192.168.2.23	19.28.36.131
Aug 8, 2022 23:36:45.739604950 CEST	63474	23	192.168.2.23	95.147.200.216
Aug 8, 2022 23:36:45.739620924 CEST	63474	23	192.168.2.23	36.72.157.242
Aug 8, 2022 23:36:45.739639044 CEST	63474	23	192.168.2.23	81.5.47.53
Aug 8, 2022 23:36:45.739690065 CEST	63474	23	192.168.2.23	113.189.180.197
Aug 8, 2022 23:36:45.739691019 CEST	63474	23	192.168.2.23	17.160.156.216
Aug 8, 2022 23:36:45.739701986 CEST	63474	23	192.168.2.23	43.9.18.163
Aug 8, 2022 23:36:45.739702940 CEST	63474	23	192.168.2.23	200.110.32.170
Aug 8, 2022 23:36:45.739707947 CEST	63474	23	192.168.2.23	133.55.180.8
Aug 8, 2022 23:36:45.739713907 CEST	63474	23	192.168.2.23	14.246.203.170
Aug 8, 2022 23:36:45.739725113 CEST	63474	23	192.168.2.23	60.189.86.17
Aug 8, 2022 23:36:45.739726067 CEST	63474	23	192.168.2.23	96.63.206.67
Aug 8, 2022 23:36:45.739851952 CEST	63474	23	192.168.2.23	150.98.117.197
Aug 8, 2022 23:36:45.739859104 CEST	63474	23	192.168.2.23	63.177.86.228
Aug 8, 2022 23:36:45.739866972 CEST	63474	23	192.168.2.23	32.95.208.154
Aug 8, 2022 23:36:45.739869118 CEST	63474	23	192.168.2.23	154.248.164.238
Aug 8, 2022 23:36:45.739870071 CEST	63474	23	192.168.2.23	4.186.105.36
Aug 8, 2022 23:36:45.739880085 CEST	63474	23	192.168.2.23	186.132.211.102
Aug 8, 2022 23:36:45.739897013 CEST	63474	23	192.168.2.23	94.84.68.159
Aug 8, 2022 23:36:45.739902973 CEST	63474	23	192.168.2.23	31.53.168.253
Aug 8, 2022 23:36:45.739933968 CEST	63474	23	192.168.2.23	209.139.60.227
Aug 8, 2022 23:36:45.739996910 CEST	63474	23	192.168.2.23	123.35.41.96
Aug 8, 2022 23:36:45.739999056 CEST	63474	23	192.168.2.23	74.228.72.155
Aug 8, 2022 23:36:45.740039110 CEST	63474	23	192.168.2.23	86.91.231.147
Aug 8, 2022 23:36:45.740042925 CEST	63474	23	192.168.2.23	108.154.214.252
Aug 8, 2022 23:36:45.740042925 CEST	63474	23	192.168.2.23	12.155.121.220
Aug 8, 2022 23:36:45.740062952 CEST	63474	23	192.168.2.23	67.72.23.129
Aug 8, 2022 23:36:45.740092039 CEST	63474	23	192.168.2.23	147.213.146.100
Aug 8, 2022 23:36:45.740103006 CEST	63474	23	192.168.2.23	142.180.246.14
Aug 8, 2022 23:36:45.740108013 CEST	63474	23	192.168.2.23	191.161.76.41
Aug 8, 2022 23:36:45.740119934 CEST	63474	23	192.168.2.23	40.123.197.38
Aug 8, 2022 23:36:45.740134001 CEST	63474	23	192.168.2.23	60.241.221.183
Aug 8, 2022 23:36:45.740150928 CEST	63474	23	192.168.2.23	106.213.236.64

System Behavior

Analysis Process: 2DbzKHhgOH PID: 6223, Parent PID: 6120

General

Start time:	23:36:44
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	/tmp/2DbzKHhgOH
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6226, Parent PID: 6223

General

Start time:	23:36:44
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6242, Parent PID: 6226

General

Start time:	23:36:53
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6244, Parent PID: 6226

General

Start time:	23:36:53
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6246, Parent PID: 6244

General

Start time:	23:36:53
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6256, Parent PID: 6246

General

Start time:	23:36:53
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6257, Parent PID: 6246

General

Start time:	23:36:53
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6251, Parent PID: 6244

General

Start time:	23:36:53
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6253, Parent PID: 6244

General

Start time:	23:36:53
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6227, Parent PID: 6223

General

Start time:	23:36:44
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6229, Parent PID: 6223

General

Start time:	23:36:44
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6232, Parent PID: 6229

General

Start time:	23:36:44
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6260, Parent PID: 6232

General

Start time:	23:36:53
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6262, Parent PID: 6232

General

Start time:	23:36:53
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6234, Parent PID: 6229

General

Start time:	23:36:45
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: 2DbzKHhgOH PID: 6236, Parent PID: 6229

General

Start time:	23:36:45
Start date:	08/08/2022
Path:	/tmp/2DbzKHhgOH
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 2DbzKHhgOH

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: 2DbzKHhgOH PID: 6223, Parent PID: 6120

General

Analysis Process: 2DbzKHhgOH PID: 6226, Parent PID: 6223

General

Analysis Process: 2DbzKHhgOH PID: 6242, Parent PID: 6226

General

Analysis Process: 2DbzKHhgOH PID: 6244, Parent PID: 6226

General

Analysis Process: 2DbzKHhgOH PID: 6246, Parent PID: 6244

General

Analysis Process: 2DbzKHhgOH PID: 6256, Parent PID: 6246

General

Analysis Process: 2DbzKHhgOH PID: 6257, Parent PID: 6246

General

Analysis Process: 2DbzKHhgOH PID: 6251, Parent PID: 6244

General

Analysis Process: 2DbzKHhgOH PID: 6253, Parent PID: 6244

General

Analysis Process: 2DbzKHhgOH PID: 6227, Parent PID: 6223

Linux Analysis Report
2DbzKHhgOH