Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
f03XBkpBK6.elf

Overview

General Information

Sample Name:f03XBkpBK6.elf
Analysis ID:755689
MD5:55d542dcd32aee3788c86ab2ae634ca6
SHA1:2d8927726e1c34cd6355c8095aef1dd27c5e86ae
SHA256:815804338b816bf198769f53a3962dd33a04b16dffef46a87ac89e9775adae6b
Tags:32elfmipsmirai
Infos:

Detection

Mirai
Score:80
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:36.0.0 Rainbow Opal
Analysis ID:755689
Start date and time:2022-11-29 02:11:38 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 41s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:f03XBkpBK6.elf
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal80.troj.evad.linELF@0/0@0/0

Warnings

  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Runtime Messages

Command:/tmp/f03XBkpBK6.elf
PID:6226
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    6226.1.00007fc8b8455000.00007fc8b8457000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x1584:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x15f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x166c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x16e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1754:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19d4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a2c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a84:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1adc:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1b34:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6229.1.00007fc8b8455000.00007fc8b8457000.rw-.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x1584:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x15f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x166c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x16e0:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1754:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x19d4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a2c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1a84:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1adc:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x1b34:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmpSUSP_XORed_MozillaDetects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.Florian Roth
    • 0x145b8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14628:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14698:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14708:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14778:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x149e8:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14a3c:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14a90:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14ae4:$xo1: oMXKNNC\x0D\x17\x0C\x12
    • 0x14b38:$xo1: oMXKNNC\x0D\x17\x0C\x12
    6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmpMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
    • 0x13e50:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
    6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmpJoeSecurity_Mirai_5Yara detected MiraiJoe Security
      Click to see the 7 entries

      Snort Signatures

      ⊘No Snort rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Multi AV Scanner detection for submitted file
      Source: f03XBkpBK6.elfReversingLabs: Detection: 52%
      Source: f03XBkpBK6.elfVirustotal: Detection: 41%Perma Link

      Networking

      barindex
      Uses known network protocols on non-standard ports
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51072
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51074
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51076
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51080
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51082
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51090
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51092
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51096
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51102
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51106
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39808
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39818
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39822
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39824
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39826
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39828
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39834
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39836
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39838
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39844
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40012
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40014
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40016
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40018
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40020
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40022
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40024
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40034
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40038
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40040
      Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
      Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
      Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
      Source: global trafficTCP traffic: 192.168.2.23:35708 -> 51.81.138.210:1312
      Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
      Source: unknownTCP traffic detected without corresponding DNS query: 51.81.138.210
      Source: unknownTCP traffic detected without corresponding DNS query: 187.4.90.207
      Source: unknownTCP traffic detected without corresponding DNS query: 152.205.18.207
      Source: unknownTCP traffic detected without corresponding DNS query: 159.88.249.87
      Source: unknownTCP traffic detected without corresponding DNS query: 106.246.13.74
      Source: unknownTCP traffic detected without corresponding DNS query: 211.53.224.181
      Source: unknownTCP traffic detected without corresponding DNS query: 203.175.26.121
      Source: unknownTCP traffic detected without corresponding DNS query: 122.86.122.44
      Source: unknownTCP traffic detected without corresponding DNS query: 70.32.69.1
      Source: unknownTCP traffic detected without corresponding DNS query: 223.192.30.122
      Source: unknownTCP traffic detected without corresponding DNS query: 97.120.249.55
      Source: unknownTCP traffic detected without corresponding DNS query: 73.175.72.101
      Source: unknownTCP traffic detected without corresponding DNS query: 174.11.108.60
      Source: unknownTCP traffic detected without corresponding DNS query: 208.17.24.140
      Source: unknownTCP traffic detected without corresponding DNS query: 192.201.102.224
      Source: unknownTCP traffic detected without corresponding DNS query: 162.94.40.160
      Source: unknownTCP traffic detected without corresponding DNS query: 161.203.222.193
      Source: unknownTCP traffic detected without corresponding DNS query: 216.213.38.55
      Source: unknownTCP traffic detected without corresponding DNS query: 44.192.72.116
      Source: unknownTCP traffic detected without corresponding DNS query: 119.105.21.129
      Source: unknownTCP traffic detected without corresponding DNS query: 148.6.93.108
      Source: unknownTCP traffic detected without corresponding DNS query: 251.98.141.90
      Source: unknownTCP traffic detected without corresponding DNS query: 2.221.189.68
      Source: unknownTCP traffic detected without corresponding DNS query: 176.56.11.138
      Source: unknownTCP traffic detected without corresponding DNS query: 63.189.62.154
      Source: unknownTCP traffic detected without corresponding DNS query: 98.85.211.155
      Source: unknownTCP traffic detected without corresponding DNS query: 1.242.97.191
      Source: unknownTCP traffic detected without corresponding DNS query: 71.148.30.157
      Source: unknownTCP traffic detected without corresponding DNS query: 69.47.8.124
      Source: unknownTCP traffic detected without corresponding DNS query: 197.150.216.82
      Source: unknownTCP traffic detected without corresponding DNS query: 111.58.90.37
      Source: unknownTCP traffic detected without corresponding DNS query: 31.206.179.135
      Source: unknownTCP traffic detected without corresponding DNS query: 12.223.120.48
      Source: unknownTCP traffic detected without corresponding DNS query: 5.65.68.90
      Source: unknownTCP traffic detected without corresponding DNS query: 53.4.78.219
      Source: unknownTCP traffic detected without corresponding DNS query: 152.121.84.156
      Source: unknownTCP traffic detected without corresponding DNS query: 211.231.188.135
      Source: unknownTCP traffic detected without corresponding DNS query: 153.175.99.220
      Source: unknownTCP traffic detected without corresponding DNS query: 249.174.63.51
      Source: unknownTCP traffic detected without corresponding DNS query: 19.79.6.61
      Source: unknownTCP traffic detected without corresponding DNS query: 254.186.207.97
      Source: unknownTCP traffic detected without corresponding DNS query: 96.23.24.83
      Source: unknownTCP traffic detected without corresponding DNS query: 60.85.212.54
      Source: unknownTCP traffic detected without corresponding DNS query: 86.253.65.233
      Source: unknownTCP traffic detected without corresponding DNS query: 144.42.38.156
      Source: unknownTCP traffic detected without corresponding DNS query: 211.29.40.219
      Source: unknownTCP traffic detected without corresponding DNS query: 53.103.62.2
      Source: unknownTCP traffic detected without corresponding DNS query: 9.35.68.16
      Source: unknownTCP traffic detected without corresponding DNS query: 112.86.91.46
      Source: unknownTCP traffic detected without corresponding DNS query: 191.18.48.23
      Source: f03XBkpBK6.elfString found in binary or memory: http://upx.sf.net

      System Summary

      barindex
      Malicious sample detected (through community Yara rule)
      Source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
      Source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
      Source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
      Source: LOAD without section mappingsProgram segment: 0x100000
      Source: 6226.1.00007fc8b8455000.00007fc8b8457000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6229.1.00007fc8b8455000.00007fc8b8457000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
      Source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
      Source: 6235.1.00007fc8b8455000.00007fc8b8457000.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
      Source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
      Source: classification engineClassification label: mal80.troj.evad.linELF@0/0@0/0

      Data Obfuscation

      barindex
      Sample is packed with UPX
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1582/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2033/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2275/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/3088/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/6191/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/6190/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1612/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1579/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1699/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1335/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1698/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2028/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1334/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1576/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2302/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/3236/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2025/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2146/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/910/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/912/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/517/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/759/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/6228/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2307/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/918/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/6240/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1594/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2285/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2281/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1349/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1623/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/761/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1622/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/884/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1983/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2038/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1344/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1465/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1586/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1860/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1463/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2156/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/800/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/801/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/6237/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1629/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1627/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1900/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4470/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/3021/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/491/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2294/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2050/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1877/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/772/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1633/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1599/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1632/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/774/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1477/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/654/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/896/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1476/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1872/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2048/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/655/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1475/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2289/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/656/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/777/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/657/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/658/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4467/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4468/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4469/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4502/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/419/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/936/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1639/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1638/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2208/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2180/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1809/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1494/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1890/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2063/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2062/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1888/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1886/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/420/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1489/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/785/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1642/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/788/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/667/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/789/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/1648/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4491/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/6155/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/4498/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2078/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2077/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2074/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/2195/exe
      Source: /tmp/f03XBkpBK6.elf (PID: 6234)File opened: /proc/670/exe

      Hooking and other Techniques for Hiding and Protection

      barindex
      Uses known network protocols on non-standard ports
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51072
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51074
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51076
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51080
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51082
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51090
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51092
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51096
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51102
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 51106
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39808
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39818
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39822
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39824
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39826
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39828
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39834
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39836
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39838
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 39844
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40012
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40014
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40016
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40018
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40020
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40022
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40024
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40034
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40038
      Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 40040
      Source: f03XBkpBK6.elfSubmission file: segment LOAD with 7.9039 entropy (max. 8.0)
      Source: /tmp/f03XBkpBK6.elf (PID: 6226)Queries kernel information via 'uname':
      Source: f03XBkpBK6.elf, 6226.1.000055975821d000.00005597582c4000.rw-.sdmp, f03XBkpBK6.elf, 6229.1.000055975821d000.00005597582a4000.rw-.sdmp, f03XBkpBK6.elf, 6235.1.000055975821d000.00005597582a4000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
      Source: f03XBkpBK6.elf, 6226.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp, f03XBkpBK6.elf, 6229.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp, f03XBkpBK6.elf, 6235.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmpBinary or memory string: 5x86_64/usr/bin/qemu-mipsel/tmp/f03XBkpBK6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/f03XBkpBK6.elf
      Source: f03XBkpBK6.elf, 6226.1.000055975821d000.00005597582c4000.rw-.sdmp, f03XBkpBK6.elf, 6229.1.000055975821d000.00005597582a4000.rw-.sdmp, f03XBkpBK6.elf, 6235.1.000055975821d000.00005597582a4000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
      Source: f03XBkpBK6.elf, 6226.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp, f03XBkpBK6.elf, 6229.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmp, f03XBkpBK6.elf, 6235.1.00007ffdd4bd1000.00007ffdd4bf2000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

      Stealing of Sensitive Information

      barindex
      Yara detected Mirai
      Source: Yara matchFile source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: dump.pcap, type: PCAP

      Remote Access Functionality

      barindex
      Yara detected Mirai
      Source: Yara matchFile source: 6226.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6235.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 6229.1.00007fc8b8400000.00007fc8b8415000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: dump.pcap, type: PCAP

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
      Obfuscated Files or Information      		1
      OS Credential Dumping      		11
      Security Software Discovery      		Remote ServicesData from Local SystemExfiltration Over Other Network Medium1
      Encrypted Channel      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth11
      Non-Standard Port      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
      Application Layer Protocol      		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

      Malware Configuration

      ⊘No configs have been found

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 755689 Sample: f03XBkpBK6.elf Startdate: 29/11/2022 Architecture: LINUX Score: 80 22 66.236.63.185 XO-AS15US United States 2->22 24 196.130.79.57 Vodafone-EG Egypt 2->24 26 98 other IPs or domains 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Yara detected Mirai 2->32 34 2 other signatures 2->34 8 f03XBkpBK6.elf 2->8         started        signatures3 process4 process5 10 f03XBkpBK6.elf 8->10         started        12 f03XBkpBK6.elf 8->12         started        14 f03XBkpBK6.elf 8->14         started        process6 16 f03XBkpBK6.elf 10->16         started        18 f03XBkpBK6.elf 10->18         started        20 f03XBkpBK6.elf 10->20         started       

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      f03XBkpBK6.elf52%ReversingLabsLinux.Trojan.Mirai
      f03XBkpBK6.elf41%VirustotalBrowse

      Dropped Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Contacted Domains

      ⊘No contacted domains info

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://upx.sf.netf03XBkpBK6.elffalse
        		high

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        155.35.98.213
        		unknownUnited States
        		24324KORDIA-TRANSIT-AS-APKordiaLimitedNZfalse
        101.228.227.91
        		unknownChina
        		4812CHINANET-SH-APChinaTelecomGroupCNfalse
        204.30.147.16
        		unknownUnited States
        		3356LEVEL3USfalse
        40.83.2.247
        		unknownUnited States
        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
        35.231.235.136
        		unknownUnited States
        		15169GOOGLEUSfalse
        158.151.234.190
        		unknownUnited States
        		26442DNB-USfalse
        20.132.231.191
        		unknownUnited States
        		206CSC-IGN-AMERUSfalse
        32.250.225.133
        		unknownUnited States
        		2686ATGS-MMD-ASUSfalse
        212.246.61.101
        		unknownFinland
        		719ELISA-ASHelsinkiFinlandEUfalse
        197.204.101.52
        		unknownAlgeria
        		36947ALGTEL-ASDZfalse
        101.8.222.161
        		unknownTaiwan; Republic of China (ROC)
        		701UUNETUSfalse
        70.202.90.164
        		unknownUnited States
        		22394CELLCOUSfalse
        172.123.164.243
        		unknownJapan2497IIJInternetInitiativeJapanIncJPfalse
        104.235.30.136
        		unknownUnited States
        		22379MANIFOLDUSfalse
        242.150.57.1
        		unknownReserved
        		unknownunknownfalse
        144.80.148.191
        		unknownUnited States
        		62989IUPUSfalse
        97.45.39.141
        		unknownUnited States
        		22394CELLCOUSfalse
        80.36.110.218
        		unknownSpain
        		3352TELEFONICA_DE_ESPANAESfalse
        31.48.217.190
        		unknownUnited Kingdom
        		2856BT-UK-ASBTnetUKRegionalnetworkGBfalse
        90.217.222.125
        		unknownUnited Kingdom
        		5607BSKYB-BROADBAND-ASGBfalse
        187.121.39.106
        		unknownBrazil
        		19182TELEFONICABRASILSABRfalse
        66.236.63.185
        		unknownUnited States
        		2828XO-AS15USfalse
        145.116.23.144
        		unknownNetherlands
        		1103SURFNET-NLSURFnetTheNetherlandsNLfalse
        122.117.147.238
        		unknownTaiwan; Republic of China (ROC)
        		3462HINETDataCommunicationBusinessGroupTWfalse
        248.77.126.194
        		unknownReserved
        		unknownunknownfalse
        253.254.230.97
        		unknownReserved
        		unknownunknownfalse
        218.193.82.71
        		unknownChina
        		4538ERX-CERNET-BKBChinaEducationandResearchNetworkCenterfalse
        142.31.170.14
        		unknownCanada
        		3633PROVINCE-OF-BRITISH-COLUMBIACAfalse
        107.127.53.141
        		unknownUnited States
        		7018ATT-INTERNET4USfalse
        223.245.245.95
        		unknownChina
        		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
        123.63.98.82
        		unknownIndia
        		55410VIL-AS-APVodafoneIdeaLtdINfalse
        80.50.183.227
        		unknownPoland
        		5617TPNETPLfalse
        65.248.145.171
        		unknownUnited States
        		701UUNETUSfalse
        133.195.181.231
        		unknownJapan2497IIJInternetInitiativeJapanIncJPfalse
        73.83.162.186
        		unknownUnited States
        		7922COMCAST-7922USfalse
        76.41.20.91
        		unknownUnited States
        		18494CENTURYLINK-LEGACY-EMBARQ-WRBGUSfalse
        185.216.12.42
        		unknownRussian Federation
        		41161REALWEB-ASRUfalse
        59.180.5.108
        		unknownIndia
        		17813MTNL-APMahanagarTelephoneNigamLimitedINfalse
        60.121.113.4
        		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
        75.9.72.18
        		unknownUnited States
        		7018ATT-INTERNET4USfalse
        133.98.75.26
        		unknownJapan2907SINET-ASResearchOrganizationofInformationandSystemsNfalse
        172.131.55.193
        		unknownUnited States
        		7018ATT-INTERNET4USfalse
        12.203.71.89
        		unknownUnited States
        		22983FISERV-INCUSfalse
        249.33.223.198
        		unknownReserved
        		unknownunknownfalse
        85.77.171.140
        		unknownFinland
        		719ELISA-ASHelsinkiFinlandEUfalse
        156.63.125.11
        		unknownUnited States
        		19902NET-STATE-OHIOUSfalse
        153.119.253.101
        		unknownChina
        		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
        154.95.51.164
        		unknownSeychelles
        		54600PEGTECHINCUSfalse
        253.238.149.215
        		unknownReserved
        		unknownunknownfalse
        87.143.249.130
        		unknownGermany
        		3320DTAGInternetserviceprovideroperationsDEfalse
        250.246.178.84
        		unknownReserved
        		unknownunknownfalse
        82.204.20.201
        		unknownNetherlands
        		15670BBNED-AS1NLfalse
        200.175.108.106
        		unknownBrazil
        		18881TELEFONICABRASILSABRfalse
        105.88.235.219
        		unknownEgypt
        		36992ETISALAT-MISREGfalse
        190.87.62.2
        		unknownEl Salvador
        		14754TelguaGTfalse
        240.156.18.94
        		unknownReserved
        		unknownunknownfalse
        90.80.141.126
        		unknownFrance
        		3215FranceTelecom-OrangeFRfalse
        253.173.143.152
        		unknownReserved
        		unknownunknownfalse
        246.33.49.77
        		unknownReserved
        		unknownunknownfalse
        102.63.100.89
        		unknownEgypt
        		36992ETISALAT-MISREGfalse
        241.141.146.48
        		unknownReserved
        		unknownunknownfalse
        133.25.175.80
        		unknownJapan55379HOSEI-NETHoseiUniversityJPfalse
        158.49.59.106
        		unknownSpain
        		766REDIRISRedIRISAutonomousSystemESfalse
        158.128.204.184
        		unknownCanada
        		721DNIC-ASBLK-00721-00726USfalse
        196.130.79.57
        		unknownEgypt
        		36935Vodafone-EGfalse
        171.60.231.176
        		unknownIndia
        		24560AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServicesfalse
        100.149.110.121
        		unknownUnited States
        		21928T-MOBILE-AS21928USfalse
        23.196.34.233
        		unknownUnited States
        		20940AKAMAI-ASN1EUfalse
        125.120.126.142
        		unknownChina
        		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
        58.65.191.26
        		unknownPakistan
        		23674NAYATEL-PKNayatelPvtLtdPKfalse
        12.150.234.90
        		unknownUnited States
        		2386INS-ASUSfalse
        240.9.25.12
        		unknownReserved
        		unknownunknownfalse
        88.211.88.51
        		unknownUnited Kingdom
        		35575VAIONIGBfalse
        140.230.5.22
        		unknownCanada
        		8111DALUNIVCAfalse
        160.18.19.56
        		unknownJapan9370SAKURA-BSAKURAInternetIncJPfalse
        126.1.101.35
        		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
        160.168.12.233
        		unknownMorocco
        		6713IAM-ASMAfalse
        147.144.77.90
        		unknownUnited States
        		2152CSUNET-NWUSfalse
        85.231.153.146
        		unknownSweden
        		2119TELENOR-NEXTELTelenorNorgeASNOfalse
        87.120.3.93
        		unknownBulgaria
        		34577SKATTV-ASBGfalse
        42.176.235.4
        		unknownChina
        		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
        2.209.235.24
        		unknownGermany
        		6805TDDE-ASN1DEfalse
        156.134.58.77
        		unknownUnited States
        		51964ORANGE-BUSINESS-SERVICES-IPSN-ASNFRfalse
        168.181.68.212
        		unknownBrazil
        		265357KDINTERNETBRfalse
        179.68.220.84
        		unknownBrazil
        		7738TelemarNorteLesteSABRfalse
        73.244.217.200
        		unknownUnited States
        		7922COMCAST-7922USfalse
        145.170.88.101
        		unknownNetherlands
        		59524KPN-IAASNLfalse
        114.140.203.30
        		unknownTaiwan; Republic of China (ROC)
        		9674FET-TWFarEastToneTelecommunicationCoLtdTWfalse
        45.222.232.161
        		unknownGhana
        		37282MAINONENGfalse
        153.51.249.240
        		unknownUnited States
        		14962NCR-252USfalse
        206.70.233.170
        		unknownUnited States
        		2914NTT-COMMUNICATIONS-2914USfalse
        217.230.103.141
        		unknownGermany
        		3320DTAGInternetserviceprovideroperationsDEfalse
        120.13.218.124
        		unknownChina
        		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
        192.110.155.171
        		unknownUnited States
        		393835CCS-COLOUSfalse
        169.255.104.242
        		unknownKenya
        		327906EMBARQKEfalse
        124.5.1.168
        		unknownKorea Republic of
        		10036CNM-AS-KRDLIVEKRfalse
        117.180.195.198
        		unknownChina
        		9808CMNET-GDGuangdongMobileCommunicationCoLtdCNfalse
        147.177.133.237
        		unknownUnited States
        		243HARRIS-ATD-ASUSfalse
        161.50.51.158
        		unknownAustralia
        		7575AARNET-AS-APAustralianAcademicandResearchNetworkAARNefalse
        58.192.78.190
        		unknownChina
        		4538ERX-CERNET-BKBChinaEducationandResearchNetworkCenterfalse

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        ⊘No context

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        ⊘No created / dropped files found

        Static File Info

        General

        File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
        Entropy (8bit):7.900277247917175
        TrID:
        • ELF Executable and Linkable format (generic) (4004/1) 100.00%
        File name:f03XBkpBK6.elf
        File size:30316
        MD5:55d542dcd32aee3788c86ab2ae634ca6
        SHA1:2d8927726e1c34cd6355c8095aef1dd27c5e86ae
        SHA256:815804338b816bf198769f53a3962dd33a04b16dffef46a87ac89e9775adae6b
        SHA512:282401d5563bcf39a65962730dd347a41ae3ec75f95cbf13adaeece28608d31c27d024b01485c166222cb040935ff060475f95ee19c592e5e62392305097bdb4
        SSDEEP:768:C1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNSJb8WUP:CbDs06t4BEub4sU/MbUSAP
        TLSH:EED2E12CD94D7D05DAAD3EBE50CE9AF5298C74C0A35DEACE07168448B617ACBEC071E4
        File Content Preview:.ELF.....................b..4...........4. ...(.....................Eu..Eu...............[...[E..[E.................u...UPX!`........Z...Z......S..........?.E.h;....#......b.L#8....&C........}+..ze.aw....2"ds...:.Z...;.g...l.D.....t6/..N...^.............+

        Static ELF Info

        ELF header

        Class:
        Data:
        Version:
        Machine:
        Version Number:
        Type:
        OS/ABI:
        ABI Version:
        Entry Point Address:
        Flags:
        ELF Header Size:
        Program Header Offset:
        Program Header Size:
        Number of Program Headers:
        Section Header Offset:
        Section Header Size:
        Number of Section Headers:
        Header String Table Index:

        Program Segments

        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
        LOAD0x00x1000000x1000000x75450x75457.90390x5R E0x10000
        LOAD0x5b000x455b000x455b000x00x00.00000x6RW 0x10000

        Network Behavior

        Network Port Distribution

        TCP Packets

        TimestampSource PortDest PortSource IPDest IP
        Nov 29, 2022 02:12:24.979813099 CET357081312192.168.2.2351.81.138.210
        Nov 29, 2022 02:12:25.012173891 CET4325923192.168.2.23187.4.90.207
        Nov 29, 2022 02:12:25.012768984 CET4325923192.168.2.23152.205.18.207
        Nov 29, 2022 02:12:25.012885094 CET4325923192.168.2.23159.88.249.87
        Nov 29, 2022 02:12:25.014132023 CET4325923192.168.2.23106.246.13.74
        Nov 29, 2022 02:12:25.014200926 CET4325923192.168.2.23211.53.224.181
        Nov 29, 2022 02:12:25.014200926 CET4325923192.168.2.23203.175.26.121
        Nov 29, 2022 02:12:25.014262915 CET4325923192.168.2.23122.86.122.44
        Nov 29, 2022 02:12:25.014285088 CET4325923192.168.2.2370.32.69.1
        Nov 29, 2022 02:12:25.014457941 CET4325923192.168.2.23223.192.30.122
        Nov 29, 2022 02:12:25.014457941 CET4325923192.168.2.2397.120.249.55
        Nov 29, 2022 02:12:25.014462948 CET4325923192.168.2.23200.229.110.204
        Nov 29, 2022 02:12:25.014492989 CET4325923192.168.2.2373.175.72.101
        Nov 29, 2022 02:12:25.014492989 CET4325923192.168.2.23174.11.108.60
        Nov 29, 2022 02:12:25.014529943 CET4325923192.168.2.23208.17.24.140
        Nov 29, 2022 02:12:25.014540911 CET4325923192.168.2.23192.201.102.224
        Nov 29, 2022 02:12:25.014559031 CET4325923192.168.2.23162.94.40.160
        Nov 29, 2022 02:12:25.014566898 CET4325923192.168.2.23161.203.222.193
        Nov 29, 2022 02:12:25.014566898 CET4325923192.168.2.23216.213.38.55
        Nov 29, 2022 02:12:25.014638901 CET4325923192.168.2.2344.192.72.116
        Nov 29, 2022 02:12:25.014856100 CET4325923192.168.2.23119.105.21.129
        Nov 29, 2022 02:12:25.014863968 CET4325923192.168.2.23148.6.93.108
        Nov 29, 2022 02:12:25.014892101 CET4325923192.168.2.23251.98.141.90
        Nov 29, 2022 02:12:25.014894009 CET4325923192.168.2.232.221.189.68
        Nov 29, 2022 02:12:25.014974117 CET4325923192.168.2.23176.56.11.138
        Nov 29, 2022 02:12:25.015058994 CET4325923192.168.2.2363.189.62.154
        Nov 29, 2022 02:12:25.015059948 CET4325923192.168.2.2398.85.211.155
        Nov 29, 2022 02:12:25.015166044 CET4325923192.168.2.231.242.97.191
        Nov 29, 2022 02:12:25.015181065 CET4325923192.168.2.2371.148.30.157
        Nov 29, 2022 02:12:25.015182018 CET4325923192.168.2.2369.47.8.124
        Nov 29, 2022 02:12:25.015194893 CET4325923192.168.2.23197.150.216.82
        Nov 29, 2022 02:12:25.015197992 CET4325923192.168.2.23111.58.90.37
        Nov 29, 2022 02:12:25.015197992 CET4325923192.168.2.2331.206.179.135
        Nov 29, 2022 02:12:25.015197992 CET4325923192.168.2.2312.223.120.48
        Nov 29, 2022 02:12:25.015198946 CET4325923192.168.2.235.65.68.90
        Nov 29, 2022 02:12:25.015223980 CET4325923192.168.2.2353.4.78.219
        Nov 29, 2022 02:12:25.015229940 CET4325923192.168.2.23152.121.84.156
        Nov 29, 2022 02:12:25.015230894 CET4325923192.168.2.23211.231.188.135
        Nov 29, 2022 02:12:25.015283108 CET4325923192.168.2.23153.175.99.220
        Nov 29, 2022 02:12:25.015290022 CET4325923192.168.2.23249.174.63.51
        Nov 29, 2022 02:12:25.015297890 CET4325923192.168.2.2319.79.6.61
        Nov 29, 2022 02:12:25.015312910 CET4325923192.168.2.23254.186.207.97
        Nov 29, 2022 02:12:25.015314102 CET4325923192.168.2.2396.23.24.83
        Nov 29, 2022 02:12:25.015321970 CET4325923192.168.2.2360.85.212.54
        Nov 29, 2022 02:12:25.015321970 CET4325923192.168.2.2386.253.65.233
        Nov 29, 2022 02:12:25.015321970 CET4325923192.168.2.23144.42.38.156
        Nov 29, 2022 02:12:25.015383959 CET4325923192.168.2.23211.29.40.219
        Nov 29, 2022 02:12:25.015434027 CET4325923192.168.2.2353.103.62.2
        Nov 29, 2022 02:12:25.015434980 CET4325923192.168.2.239.35.68.16
        Nov 29, 2022 02:12:25.015436888 CET4325923192.168.2.23112.86.91.46
        Nov 29, 2022 02:12:25.015449047 CET4325923192.168.2.23191.18.48.23
        Nov 29, 2022 02:12:25.015475988 CET4325923192.168.2.23159.227.95.9
        Nov 29, 2022 02:12:25.015476942 CET4325923192.168.2.2346.242.60.170
        Nov 29, 2022 02:12:25.015476942 CET4325923192.168.2.23181.98.117.209
        Nov 29, 2022 02:12:25.015480995 CET4325923192.168.2.2353.83.224.157
        Nov 29, 2022 02:12:25.015516043 CET4325923192.168.2.2380.216.12.209
        Nov 29, 2022 02:12:25.015830040 CET4325923192.168.2.2323.46.52.230
        Nov 29, 2022 02:12:25.015870094 CET4325923192.168.2.23168.9.114.186
        Nov 29, 2022 02:12:25.016021013 CET4325923192.168.2.23110.111.99.148
        Nov 29, 2022 02:12:25.016022921 CET4325923192.168.2.23167.12.125.104
        Nov 29, 2022 02:12:25.016096115 CET4325923192.168.2.23146.204.132.75
        Nov 29, 2022 02:12:25.016174078 CET4325923192.168.2.23245.3.66.158
        Nov 29, 2022 02:12:25.016237974 CET4325923192.168.2.23153.234.248.124
        Nov 29, 2022 02:12:25.016258001 CET4325923192.168.2.23107.36.227.25
        Nov 29, 2022 02:12:25.016272068 CET4325923192.168.2.23160.248.5.204
        Nov 29, 2022 02:12:25.016314030 CET4325923192.168.2.23107.215.3.223
        Nov 29, 2022 02:12:25.016691923 CET4325923192.168.2.23248.25.200.93
        Nov 29, 2022 02:12:25.016693115 CET4325923192.168.2.23246.28.214.48
        Nov 29, 2022 02:12:25.016697884 CET4325923192.168.2.23202.89.91.205
        Nov 29, 2022 02:12:25.016699076 CET4325923192.168.2.2339.77.108.193
        Nov 29, 2022 02:12:25.016697884 CET4325923192.168.2.2334.87.5.132
        Nov 29, 2022 02:12:25.016707897 CET4325923192.168.2.2335.243.209.193
        Nov 29, 2022 02:12:25.016731024 CET4325923192.168.2.23122.203.66.248
        Nov 29, 2022 02:12:25.016758919 CET4325923192.168.2.23120.233.190.51
        Nov 29, 2022 02:12:25.016763926 CET4325923192.168.2.23181.38.54.48
        Nov 29, 2022 02:12:25.016796112 CET4325923192.168.2.23123.0.40.75
        Nov 29, 2022 02:12:25.016940117 CET4325923192.168.2.2339.248.82.87
        Nov 29, 2022 02:12:25.016993999 CET4325923192.168.2.23247.17.162.60
        Nov 29, 2022 02:12:25.017041922 CET4325923192.168.2.23151.63.167.68
        Nov 29, 2022 02:12:25.017227888 CET4325923192.168.2.23104.107.128.100
        Nov 29, 2022 02:12:25.017363071 CET4325923192.168.2.23199.53.105.81
        Nov 29, 2022 02:12:25.017364025 CET4325923192.168.2.23111.118.124.125
        Nov 29, 2022 02:12:25.017371893 CET4325923192.168.2.2385.175.201.196
        Nov 29, 2022 02:12:25.017378092 CET4325923192.168.2.2323.165.219.34
        Nov 29, 2022 02:12:25.017472029 CET4325923192.168.2.23100.212.47.172
        Nov 29, 2022 02:12:25.017472982 CET4325923192.168.2.2375.81.88.138
        Nov 29, 2022 02:12:25.017537117 CET4325923192.168.2.2317.142.168.240
        Nov 29, 2022 02:12:25.017538071 CET4325923192.168.2.23152.245.179.49
        Nov 29, 2022 02:12:25.017544985 CET4325923192.168.2.23182.60.31.104
        Nov 29, 2022 02:12:25.017559052 CET4325923192.168.2.23170.106.149.95
        Nov 29, 2022 02:12:25.017559052 CET4325923192.168.2.2367.227.99.20
        Nov 29, 2022 02:12:25.017559052 CET4325923192.168.2.23245.232.133.187
        Nov 29, 2022 02:12:25.017560959 CET4325923192.168.2.23122.250.198.11
        Nov 29, 2022 02:12:25.017563105 CET4325923192.168.2.23148.224.174.31
        Nov 29, 2022 02:12:25.017563105 CET4325923192.168.2.23218.236.182.44
        Nov 29, 2022 02:12:25.017564058 CET4325923192.168.2.2385.14.126.214
        Nov 29, 2022 02:12:25.017563105 CET4325923192.168.2.2338.112.178.29
        Nov 29, 2022 02:12:25.017565966 CET4325923192.168.2.23210.181.168.155
        Nov 29, 2022 02:12:25.017564058 CET4325923192.168.2.23192.127.146.178
        Nov 29, 2022 02:12:25.017565966 CET4325923192.168.2.23216.3.122.173

        System Behavior

        General

        Start time:02:12:24
        Start date:29/11/2022
        Path:/tmp/f03XBkpBK6.elf
        Arguments:/tmp/f03XBkpBK6.elf
        File size:5773336 bytes
        MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

        General

        Start time:02:12:24
        Start date:29/11/2022
        Path:/tmp/f03XBkpBK6.elf
        Arguments:n/a
        File size:5773336 bytes
        MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

        General

        Start time:02:12:24
        Start date:29/11/2022
        Path:/tmp/f03XBkpBK6.elf
        Arguments:n/a
        File size:5773336 bytes
        MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

        General

        Start time:02:12:24
        Start date:29/11/2022
        Path:/tmp/f03XBkpBK6.elf
        Arguments:n/a
        File size:5773336 bytes
        MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

        General

        Start time:02:12:24
        Start date:29/11/2022
        Path:/tmp/f03XBkpBK6.elf
        Arguments:n/a
        File size:5773336 bytes
        MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

        General

        Start time:02:12:24
        Start date:29/11/2022
        Path:/tmp/f03XBkpBK6.elf
        Arguments:n/a
        File size:5773336 bytes
        MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

        General

        Start time:02:12:24
        Start date:29/11/2022
        Path:/tmp/f03XBkpBK6.elf
        Arguments:n/a
        File size:5773336 bytes
        MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9