Linux Analysis Report
http://31.214.243.29/Demon.mips

Overview

General Information

Sample URL: http://31.214.243.29/Demon.mips
Analysis ID: 831144
Infos:

Detection

Gafgyt, Mirai
Score: 72
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Yara detected Gafgyt
Writes ELF files to disk
Yara signature match
Creates hidden files and/or directories
Uses the "uname" system call to query kernel version information (possible evasion)
Queries the installed Ubuntu/CentOS release

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: http://31.214.243.29/Demon.mips Avira URL Cloud: detection malicious, Label: malware
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.23:57056 version: TLS 1.2
Source: unknown DNS traffic detected: queries for: content-signature-2.cdn.mozilla.net
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 43386
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 38690
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 39582
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 39200
Source: unknown Network traffic detected: HTTP traffic on port 39200 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57864
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57056
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57870
Source: unknown Network traffic detected: HTTP traffic on port 57862 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 39214 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 38248 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57056 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 38246 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57870 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 57864 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 39214
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 38246
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 38248
Source: unknown Network traffic detected: HTTP traffic on port 43386 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 57862
Source: unknown Network traffic detected: HTTP traffic on port 38690 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 39582 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: unknown TCP traffic detected without corresponding DNS query: 31.214.243.29
Source: global traffic HTTP traffic detected: GET /chains/remote-settings.content-signature.mozilla.org-2021-09-19-15-17-11.chain HTTP/1.1Host: content-signature-2.cdn.mozilla.netUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: cross-siteIf-Modified-Since: Sat, 31 Jul 2021 15:17:12 GMTIf-None-Match: "8cfd2c8fe1fb0bc900759661d7a6ee89"
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: push.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brSec-WebSocket-Version: 13Origin: wss://push.services.mozilla.com/Sec-WebSocket-Protocol: push-notificationSec-WebSocket-Extensions: permessage-deflateSec-WebSocket-Key: /HsD9zTc2lDu1K9P7e79lw==Connection: keep-alive, UpgradeSec-Fetch-Dest: websocketSec-Fetch-Mode: websocketSec-Fetch-Site: cross-sitePragma: no-cacheCache-Control: no-cacheUpgrade: websocket
Source: global traffic HTTP traffic detected: GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1Host: firefox.settings.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: application/jsonAccept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brContent-Type: application/jsonConnection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: cross-siteIf-Modified-Since: Tue, 01 Jun 2021 14:28:23 GMTIf-None-Match: "1622557703112"
Source: global traffic HTTP traffic detected: GET /v1/ HTTP/1.1Host: firefox.settings.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: cross-site
Source: global traffic HTTP traffic detected: GET /main-workspace/ms-language-packs/4f1bcaa0-ddf9-43ef-aca3-8378c4d05582.ftl HTTP/1.1Host: firefox-settings-attachments.cdn.mozilla.netUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: cross-site
Source: global traffic HTTP traffic detected: GET /update/3/GMP/91.0.1/20210816143654/Linux_x86_64-gcc3/null/release-cck-ubuntu/Linux%205.4.0-72-generic%20(GTK%203.24.20%2Clibpulse%2013.99.0)/canonical/1.0/update.xml HTTP/1.1Host: aus5.mozilla.orgUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brCache-Control: no-cachePragma: no-cacheConnection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: no-corsSec-Fetch-Site: cross-site
Source: global traffic HTTP traffic detected: GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1Host: firefox.settings.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: application/jsonAccept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brContent-Type: application/jsonConnection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: cross-siteIf-Modified-Since: Fri, 25 Mar 2022 17:45:46 GMTIf-None-Match: "1648230346554"
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: push.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brSec-WebSocket-Version: 13Origin: wss://push.services.mozilla.com/Sec-WebSocket-Protocol: push-notificationSec-WebSocket-Extensions: permessage-deflateSec-WebSocket-Key: Pv/Zvfj6YW6T57Phu897Ug==Connection: keep-alive, UpgradeSec-Fetch-Dest: websocketSec-Fetch-Mode: websocketSec-Fetch-Site: cross-sitePragma: no-cacheCache-Control: no-cacheUpgrade: websocket
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: push.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brSec-WebSocket-Version: 13Origin: wss://push.services.mozilla.com/Sec-WebSocket-Protocol: push-notificationSec-WebSocket-Extensions: permessage-deflateSec-WebSocket-Key: U4qUgcEAUSmpmIII+0JwlQ==Connection: keep-alive, UpgradeSec-Fetch-Dest: websocketSec-Fetch-Mode: websocketSec-Fetch-Site: cross-sitePragma: no-cacheCache-Control: no-cacheUpgrade: websocket
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: push.services.mozilla.comUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brSec-WebSocket-Version: 13Origin: wss://push.services.mozilla.com/Sec-WebSocket-Protocol: push-notificationSec-WebSocket-Extensions: permessage-deflateSec-WebSocket-Key: xcYDBoWaCBwQWORghw2Mew==Connection: keep-alive, UpgradeSec-Fetch-Dest: websocketSec-Fetch-Mode: websocketSec-Fetch-Site: cross-sitePragma: no-cacheCache-Control: no-cacheUpgrade: websocket
Source: global traffic HTTP traffic detected: GET /Demon.mips HTTP/1.1Host: 31.214.243.29User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-aliveUpgrade-Insecure-Requests: 1
Source: 134714F2DF01B21FA934AB16898B0583114E19B0.42.dr String found in binary or memory: http://31.214.243.29/
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr String found in binary or memory: http://31.214.243.29/Demon.mips
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr String found in binary or memory: http://31.214.243.29/Demon.mipsstrongly-framed1request-methodGETresponse-headHTTP/1.1
Source: 134714F2DF01B21FA934AB16898B0583114E19B0.42.dr String found in binary or memory: http://31.214.243.29/predictor::seen1
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: khk19L2S.mips.part.42.dr String found in binary or memory: http://fast.no/support/crawler.asp)
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr, khk19L2S.mips.part.42.dr String found in binary or memory: http://feedback.redkolibri.com/
Source: scriptCache-new.bin.42.dr String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr String found in binary or memory: http://kinto.readthedocs.io/en/latest/tutorials/synchronisation.html#polling-for-remote-changes
Source: asrouter.ftl.tmp.42.dr, DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3.42.dr String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: cert9.db-journal.42.dr String found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://ocsp.digicert.com0K
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr, khk19L2S.mips.part.42.dr String found in binary or memory: http://www.baidu.com/search/spider.htm)
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr, khk19L2S.mips.part.42.dr String found in binary or memory: http://www.baidu.com/search/spider.html)
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr, khk19L2S.mips.part.42.dr String found in binary or memory: http://www.billybobbot.com/crawler/)
Source: scriptCache-new.bin.42.dr String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: scriptCache-new.bin.42.dr String found in binary or memory: http://www.mozilla.org/newlayout/xml/parsererror.xml
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://x1.c.lencr.org/0
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: http://x1.i.lencr.org/0
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://amazon.com
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://baidu.com
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=921157
Source: 5FFD69415953BE9CE9C07B2E9C26DA959ADEA6CB.42.dr String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: scriptCache-child-new.bin.42.dr String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://developer.mozilla.org/en-US/docs/JavaScript_OS.File/OS.File.Info#Cross-platform_Attributes
Source: 3870112724rsegmnoittet-es.sqlite-wal.42.dr, 3870112724rsegmnoittet-es.sqlite.42.dr String found in binary or memory: https://doh.xfinity.com/dns-query
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://duckduckgo.com
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://ebay.com
Source: F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/
Source: DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3.42.dr String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-language-packs/4f1bcaa0-ddf9-
Source: 3870112724rsegmnoittet-es.sqlite-wal.42.dr, 3870112724rsegmnoittet-es.sqlite.42.dr String found in binary or memory: https://firefox.dns.next
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://firefox.dns.nextdns.io/
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://firefox.settings.services.mozilla.com/v1
Source: F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: 254256B27E0C48CF9B80B695F0B3B8CA84610495.42.dr String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr String found in binary or memory: https://github.com/Kinto/kinto-attachment/
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://google.com
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/7dafd5f51c0afd1ae627bb4762ac0c140a6cd5f5
Source: 68B780A709FB903C666EF08F51EF5985A89FE446.42.dr String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/deletion-request/1/7c4c3d68-b8c8-44e6-
Source: 3870112724rsegmnoittet-es.sqlite-wal.42.dr, 3870112724rsegmnoittet-es.sqlite.42.dr String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: https://pki.goog/repository/0
Source: 3870112724rsegmnoittet-es.sqlite-wal.42.dr, 3870112724rsegmnoittet-es.sqlite.42.dr String found in binary or memory: https://private.canadianshield.cira.ca/dns-query
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://profiler.firefox.com
Source: F8CBD54DDA10F4286A41EC6A537240712D6C2308.42.dr String found in binary or memory: https://remote-settings.readthedocs.io
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://settings.stage.mozaws.net/v1/buckets/main-preview/collections/search-config/records
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://settings.stage.mozaws.net/v1/buckets/main/collections/search-config/records
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://support.mozilla.org/kb/
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://support.mozilla.org/kb/flash-protected-mode-autodisabled
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://trr.dns.nextdns.io/
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://twitter.com
Source: cert9.db.42.dr, cert9.db-journal.42.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://www.google.com/policies/privacy/
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://www.openh264.org/
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://www.widevine.com/
Source: scriptCache-new.bin.42.dr String found in binary or memory: https://yandex.com
Source: unknown HTTP traffic detected: POST /submit/firefox-desktop/deletion-request/1/7c4c3d68-b8c8-44e6-a714-345a0583faf2 HTTP/1.1Host: incoming.telemetry.mozilla.orgUser-Agent: Glean/39.0.0 (Rust on Linux)Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brx-client-type: Gleanx-client-version: 39.0.0content-type: application/json; charset=utf-8date: Tue, 21 Mar 2023 06:17:35 GMTcontent-encoding: gzipcontent-length: 284Connection: keep-aliveSec-Fetch-Dest: emptySec-Fetch-Mode: no-corsSec-Fetch-Site: nonePragma: no-cacheCache-Control: no-cache
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.23:57056 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: dump.pcap, type: PCAP Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: dump.pcap, type: PCAP Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: /tmp/khk19L2S.mips.part, type: DROPPED Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: /tmp/khk19L2S.mips.part, type: DROPPED Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Yara signature match
Source: dump.pcap, type: PCAP Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: dump.pcap, type: PCAP Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: /tmp/khk19L2S.mips.part, type: DROPPED Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: /tmp/khk19L2S.mips.part, type: DROPPED Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal72.troj.lin@0/45@31/0
Source: khk19L2S.mips.part.42.dr ELF static info symbol of dropped file: libc/string/mips/memcpy.S
Source: khk19L2S.mips.part.42.dr ELF static info symbol of dropped file: libc/string/mips/memset.S
Source: khk19L2S.mips.part.42.dr ELF static info symbol of dropped file: libc/sysdeps/linux/mips/crt1.S
Source: khk19L2S.mips.part.42.dr ELF static info symbol of dropped file: libc/sysdeps/linux/mips/crti.S
Source: khk19L2S.mips.part.42.dr ELF static info symbol of dropped file: libc/sysdeps/linux/mips/crtn.S
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr ELF static info symbol of dropped file: libc/string/mips/memcpy.S
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr ELF static info symbol of dropped file: libc/string/mips/memset.S
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr ELF static info symbol of dropped file: libc/sysdeps/linux/mips/crt1.S
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr ELF static info symbol of dropped file: libc/sysdeps/linux/mips/crti.S
Source: 730FA68718E69A9EC1DE4154BF49B2A37241C7B1.42.dr ELF static info symbol of dropped file: libc/sysdeps/linux/mips/crtn.S
Writes ELF files to disk
Source: /usr/lib/firefox/firefox (PID: 6247) File written: /tmp/khk19L2S.mips.part Jump to dropped file
Source: /usr/lib/firefox/firefox (PID: 6247) File written: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1 Jump to dropped file
Creates hidden files and/or directories
Source: /usr/bin/exo-open (PID: 6242) Directory: /home/saturnino/.cache Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-2/exo-helper-2 (PID: 6244) Directory: /home/saturnino/.cache Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-2/exo-helper-2 (PID: 6244) Directory: /home/saturnino/.local Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-2/exo-helper-2 (PID: 6244) Directory: /home/saturnino/.config Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 6247) Directory: /home/saturnino/.cache Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /usr/bin/exo-open (PID: 6242) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/exo-2/exo-helper-2 (PID: 6244) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 6247) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 6252) Queries kernel information via 'uname': Jump to behavior
Source: /usr/bin/dbus-launch (PID: 6295) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 6340) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 6383) Queries kernel information via 'uname': Jump to behavior
Source: /usr/lib/firefox/firefox (PID: 6434) Queries kernel information via 'uname': Jump to behavior
Queries the installed Ubuntu/CentOS release
Source: /usr/lib/firefox/firefox (PID: 6270) Arguments: /usr/bin/lsb_release -> /usr/bin/lsb_release -idrc Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: /tmp/khk19L2S.mips.part, type: DROPPED
Source: Yara match File source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED
Yara detected Gafgyt
Source: Yara match File source: /tmp/khk19L2S.mips.part, type: DROPPED
Source: Yara match File source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: /tmp/khk19L2S.mips.part, type: DROPPED
Source: Yara match File source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED
Yara detected Gafgyt
Source: Yara match File source: /tmp/khk19L2S.mips.part, type: DROPPED
Source: Yara match File source: /home/saturnino/.cache/mozilla/firefox/a3xevaya.default-release/cache2/entries/730FA68718E69A9EC1DE4154BF49B2A37241C7B1, type: DROPPED
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
35.244.181.201
 prod.balrog.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
44.231.103.117
 unknown United States
16509 AMAZON-02US false
52.25.208.227
 unknown United States
16509 AMAZON-02US false
31.214.243.29
 unknown Germany
197071 ACTIVE-SERVERSactive-serverscomDE false
34.160.144.191
 prod.content-signature-chains.prod.webservices.mozgcp.net United States
2686 ATGS-MMD-ASUS false
109.202.202.202
 unknown Switzerland
13030 INIT7CH false
91.189.91.43
 unknown United Kingdom
41231 CANONICAL-ASGB false
34.120.208.123
 prod.ingestion-edge.prod.dataops.mozgcp.net United States
15169 GOOGLEUS false
34.111.73.144
 fennec-catalog-cdn.prod.mozaws.net United States
15169 GOOGLEUS false
91.189.91.42
 unknown United Kingdom
41231 CANONICAL-ASGB false
35.241.9.150
 firefox.settings.services.mozilla.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
star-mini.c10r.facebook.com 157.240.20.35 true
fennec-catalog-cdn.prod.mozaws.net 34.111.73.144 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
twitter.com 104.244.42.129 true
youtube-ui.l.google.com 142.250.185.142 true
autopush.prod.mozaws.net 52.10.254.200 true
reddit.map.fastly.net 151.101.65.140 true
firefox.settings.services.mozilla.com 35.241.9.150 true
prod.ingestion-edge.prod.dataops.mozgcp.net 34.120.208.123 true
dyna.wikimedia.org 91.198.174.192 true
www.example.com 93.184.216.34 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
www.facebook.com unknown unknown
www.reddit.com unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown
push.services.mozilla.com unknown unknown
www.youtube.com unknown unknown
www.wikipedia.org unknown unknown
firefox-settings-attachments.cdn.mozilla.net unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://firefox.settings.services.mozilla.com/v1/ false
    		high
    http://31.214.243.29/Demon.mips true
      		unknown
      https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-language-packs/4f1bcaa0-ddf9-43ef-aca3-8378c4d05582.ftl false
        		high
        https://push.services.mozilla.com/ false
          		high
          https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US false
            		high
            https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2021-09-19-15-17-11.chain false
              		high