Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
f03XBkpBK6.elf

Overview

General Information

Sample Name:f03XBkpBK6.elf
Analysis ID:755689
MD5:55d542dcd32aee3788c86ab2ae634ca6
SHA1:2d8927726e1c34cd6355c8095aef1dd27c5e86ae
SHA256:815804338b816bf198769f53a3962dd33a04b16dffef46a87ac89e9775adae6b
Tags:32elfmipsmirai
Infos:

Detection

Mirai
Score:80
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.
Joe Sandbox Version:36.0.0 Rainbow Opal
Analysis ID:755689
Start date and time:2022-11-29 02:11:38 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 41s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:f03XBkpBK6.elf
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal80.troj.evad.linELF@0/0@0/0
  • Report size exceeded maximum capacity and may have missing network information.
Command:/tmp/f03XBkpBK6.elf
PID:6226
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:
  • system is lnxubuntu20
  • cleanup
SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security
    SourceRuleDescriptionAuthorStrings
    6226.1.00007fc8b8455000.00007fc8b8457000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x1584:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x15f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x166c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x16e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1754:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19d4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a2c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a84:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1adc:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1b34:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6229.1.00007fc8b8455000.00007fc8b8457000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x1584:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x15f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x166c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x16e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1754:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19d4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a2c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a84:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1adc:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1b34:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x145b8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14628:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14698:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14708:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14778:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x149e8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14a3c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14a90:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14ae4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14b38:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmpMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
    • 0x13e50:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
    6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmpJoeSecurity_Mirai_5Yara detected MiraiJoe Security
      Click to see the 7 entries
      No Snort rule has matched

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: f03XBkpBK6.elfReversingLabs: Detection: 52%
      Source: f03XBkpBK6.elfVirustotal: Detection: 41%Perma Link

      Networking

      barindex
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51072
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51074
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51076
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51080
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51082
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51090
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51092
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51096
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51102
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51106
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39808
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39818
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39822
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39824
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39826
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39828
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39834
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39836
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39838
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39844
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40012
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40014
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40016
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40018
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40020
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40022
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40024
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40034
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40038
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40040
      Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
      Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
      Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
      Source: global trafficTCP traffic: 192.168.2.23:35708 -> 51.81.138.210:1312
      Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
      Source: unknownTCP traffic detected without corresponding DNS query: 51.81.138.210
      Source: unknownTCP traffic detected without corresponding DNS query: 187.4.90.207
      Source: unknownTCP traffic detected without corresponding DNS query: 152.205.18.207
      Source: unknownTCP traffic detected without corresponding DNS query: 159.88.249.87
      Source: unknownTCP traffic detected without corresponding DNS query: 106.246.13.74
      Source: unknownTCP traffic detected without corresponding DNS query: 211.53.224.181
      Source: unknownTCP traffic detected without corresponding DNS query: 203.175.26.121
      Source: unknownTCP traffic detected without corresponding DNS query: 122.86.122.44
      Source: unknownTCP traffic detected without corresponding DNS query: 70.32.69.1
      Source: unknownTCP traffic detected without corresponding DNS query: 223.192.30.122
      Source: unknownTCP traffic detected without corresponding DNS query: 97.120.249.55
      Source: unknownTCP traffic detected without corresponding DNS query: 73.175.72.101
      Source: unknownTCP traffic detected without corresponding DNS query: 174.11.108.60
      Source: unknownTCP traffic detected without corresponding DNS query: 208.17.24.140
      Source: unknownTCP traffic detected without corresponding DNS query: 192.201.102.224
      Source: unknownTCP traffic detected without corresponding DNS query: 162.94.40.160
      Source: unknownTCP traffic detected without corresponding DNS query: 161.203.222.193
      Source: unknownTCP traffic detected without corresponding DNS query: 216.213.38.55
      Source: unknownTCP traffic detected without corresponding DNS query: 44.192.72.116
      Source: unknownTCP traffic detected without corresponding DNS query: 119.105.21.129
      Source: unknownTCP traffic detected without corresponding DNS query: 148.6.93.108
      Source: unknownTCP traffic detected without corresponding DNS query: 251.98.141.90
      Source: unknownTCP traffic detected without corresponding DNS query: 2.221.189.68
      Source: unknownTCP traffic detected without corresponding DNS query: 176.56.11.138
      Source: unknownTCP traffic detected without corresponding DNS query: 63.189.62.154
      Source: unknownTCP traffic detected without corresponding DNS query: 98.85.211.155
      Source: unknownTCP traffic detected without corresponding DNS query: 1.242.97.191
      Source: unknownTCP traffic detected without corresponding DNS query: 71.148.30.157
      Source: unknownTCP traffic detected without corresponding DNS query: 69.47.8.124
      Source: unknownTCP traffic detected without corresponding DNS query: 197.150.216.82
      Source: unknownTCP traffic detected without corresponding DNS query: 111.58.90.37
      Source: unknownTCP traffic detected without corresponding DNS query: 31.206.179.135
      Source: unknownTCP traffic detected without corresponding DNS query: 12.223.120.48
      Source: unknownTCP traffic detected without corresponding DNS query: 5.65.68.90
      Source: unknownTCP traffic detected without corresponding DNS query: 53.4.78.219
      Source: unknownTCP traffic detected without corresponding DNS query: 152.121.84.156
      Source: unknownTCP traffic detected without corresponding DNS query: 211.231.188.135
      Source: unknownTCP traffic detected without corresponding DNS query: 153.175.99.220
      Source: unknownTCP traffic detected without corresponding DNS query: 249.174.63.51
      Source: unknownTCP traffic detected without corresponding DNS query: 19.79.6.61
      Source: unknownTCP traffic detected without corresponding DNS query: 254.186.207.97
      Source: unknownTCP traffic detected without corresponding DNS query: 96.23.24.83
      Source: unknownTCP traffic detected without corresponding DNS query: 60.85.212.54
      Source: unknownTCP traffic detected without corresponding DNS query: 86.253.65.233
      Source: unknownTCP traffic detected without corresponding DNS query: 144.42.38.156
      Source: unknownTCP traffic detected without corresponding DNS query: 211.29.40.219
      Source: unknownTCP traffic detected without corresponding DNS query: 53.103.62.2
      Source: unknownTCP traffic detected without corresponding DNS query: 9.35.68.16
      Source: unknownTCP traffic detected without corresponding DNS query: 112.86.91.46
      Source: unknownTCP traffic detected without corresponding DNS query: 191.18.48.23
      Source: f03XBkpBK6.elfString found in binary or memory: http://upx.sf.net

      System Summary

      barindex
      Source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
      Source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
      Source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
      Source: LOAD without section mappingsProgram segment: 0x100000
      Source: 6226.1.00007fc8b8455000.00007fc8b8457000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6229.1.00007fc8b8455000.00007fc8b8457000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
      Source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
      Source: 6235.1.00007fc8b8455000.00007fc8b8457000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
      Source: classification engineClassification label: mal80.troj.evad.linELF@0/0@0/0

      Data Obfuscation

      barindex
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1582/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2033/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2275/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/3088/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/6191/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/6190/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1612/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1579/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1699/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1335/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1698/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2028/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1334/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1576/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2302/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/3236/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2025/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2146/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/910/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/912/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/517/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/759/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/6228/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2307/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/918/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/6240/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1594/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2285/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2281/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1349/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1623/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/761/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1622/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/884/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1983/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2038/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1344/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1465/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1586/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1860/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1463/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2156/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/800/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/801/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/6237/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1629/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1627/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1900/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4470/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/3021/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/491/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2294/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2050/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1877/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/772/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1633/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1599/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1632/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/774/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1477/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/654/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/896/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1476/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1872/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2048/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/655/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1475/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2289/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/656/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/777/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/657/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/658/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4467/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4468/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4469/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4502/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/419/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/936/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1639/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1638/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2208/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2180/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1809/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1494/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1890/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2063/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2062/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1888/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1886/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/420/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1489/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/785/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1642/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/788/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/667/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/789/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1648/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4491/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/6155/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4498/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2078/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2077/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2074/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2195/exeJump to behavior
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/670/exeJump to behavior

      Hooking and other Techniques for Hiding and Protection

      barindex
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51072
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51074
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51076
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51080
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51082
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51090
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51092
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51096
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51102
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51106
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39808
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39818
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39822
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39824
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39826
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39828
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39834
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39836
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39838
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39844
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40012
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40014
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40016
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40018
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40020
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40022
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40024
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40034
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40038
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40040
      Source: f03XBkpBK6.elfSubmission file: segment LOAD with 7.9039 entropy (max. 8.0)
      Source: /tmp/f03XBkpBK6.elf (PID: 6226)Queries kernel information via 'uname': Jump to behavior
      Source: f03XBkpBK6.elf, 6226.1.000055975821d000.00005597582c4000.rw-.sdmp, f03XBkpBK6.elf, 6229.1.000055975821d000.00005597582a4000.rw-.sdmp, f03XBkpBK6.elf, 6235.1.000055975821d000.00005597582a4000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
      Source: f03XBkpBK6.elf, 6226.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp, f03XBkpBK6.elf, 6229.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp, f03XBkpBK6.elf, 6235.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmpBinary or memory string: 5x86_64/usr/bin/qemu-mipsel/tmp/f03XBkpBK6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/f03XBkpBK6.elf
      Source: f03XBkpBK6.elf, 6226.1.000055975821d000.00005597582c4000.rw-.sdmp, f03XBkpBK6.elf, 6229.1.000055975821d000.00005597582a4000.rw-.sdmp, f03XBkpBK6.elf, 6235.1.000055975821d000.00005597582a4000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
      Source: f03XBkpBK6.elf, 6226.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp, f03XBkpBK6.elf, 6229.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp, f03XBkpBK6.elf, 6235.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: dump.pcap, type: PCAP

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: dump.pcap, type: PCAP
      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
      Obfuscated Files or Information
      1
      OS Credential Dumping
      11
      Security Software Discovery
      Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
      Encrypted Channel
      Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
      Non-Standard Port
      Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
      Application Layer Protocol
      Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      No configs have been found
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 755689 Sample: f03XBkpBK6.elf Startdate: 29/11/2022 Architecture: LINUX Score: 80 22 66.236.63.185 XO-AS15US United States 2->22 24 196.130.79.57 Vodafone-EG Egypt 2->24 26 98 other IPs or domains 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Mirai 2->32 34 2 other signatures 2->34 8 f03XBkpBK6.elf 2->8         started        signatures3 process4 process5 10 f03XBkpBK6.elf 8->10         started        12 f03XBkpBK6.elf 8->12         started        14 f03XBkpBK6.elf 8->14         started        process6 16 f03XBkpBK6.elf