Edit tour

Linux Analysis Report
sora.x86.elf

Overview

General Information

Sample Name:	sora.x86.elf
Analysis ID:	831207
MD5:	ed1472168cdeb8c93dd3f03c3c8fdba8
SHA1:	647657a97916d4db8ade0115a6fb5b3de3c02f77
SHA256:	17492e1447ec32d450601db269a687e058fab102b0bd35763e93483c755921cd
Tags:	elfmirai
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample is packed with UPX

Uses known network protocols on non-standard ports

Sample contains only a LOAD segment without any section mappings

Yara signature match

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample tries to kill a process (SIGKILL)

ELF contains segments with high entropy indicating compressed/encrypted content

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	831207
Start date and time:	2023-03-21 09:35:09 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 41s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	sora.x86.elf
Detection:	MAL
Classification:	mal80.troj.evad.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100

Runtime Messages

Command:	/tmp/sora.x86.elf
PID:	6222
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

sora.x86.elf (PID: 6222, Parent: 6124, MD5: ed1472168cdeb8c93dd3f03c3c8fdba8) Arguments: /tmp/sora.x86.elf

sora.x86.elf New Fork (PID: 6224, Parent: 6222)

sora.x86.elf New Fork (PID: 6317, Parent: 6224)

sora.x86.elf New Fork (PID: 6319, Parent: 6224)

sora.x86.elf New Fork (PID: 6320, Parent: 6319)

sora.x86.elf New Fork (PID: 6326, Parent: 6320)

sora.x86.elf New Fork (PID: 6327, Parent: 6320)

sora.x86.elf New Fork (PID: 6321, Parent: 6319)

sora.x86.elf New Fork (PID: 6322, Parent: 6319)

sora.x86.elf New Fork (PID: 6225, Parent: 6222)

sora.x86.elf New Fork (PID: 6226, Parent: 6222)

sora.x86.elf New Fork (PID: 6227, Parent: 6226)

sora.x86.elf New Fork (PID: 6316, Parent: 6227)

sora.x86.elf New Fork (PID: 6318, Parent: 6227)

sora.x86.elf New Fork (PID: 6228, Parent: 6226)

sora.x86.elf New Fork (PID: 6229, Parent: 6226)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6316.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6316.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6316.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6316.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6316.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6316.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6316.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6316.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6316.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6222.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6222.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6321.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6317.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6321.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6321.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6321.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6321.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6321.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6321.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6321.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6321.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6317.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6326.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6326.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6326.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6326.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6326.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6326.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6326.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6326.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6326.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6228.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6224.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6225.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6228.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6228.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6228.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6228.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6228.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6228.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6228.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6228.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xd2a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd32c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xd7f8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6224.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5710:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xa482:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc38b:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xaec2:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6225.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xa452:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 67 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: sora.x86.elf	ReversingLabs: Detection: 69%
Source: sora.x86.elf	Virustotal: Detection: 58%			Perma Link

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56422
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56440
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56448
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56450
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56456
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56458
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56460
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56462
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56464
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56462
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56466
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51572
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51588
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51592
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51612
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51628
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51632
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51642
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51654
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51662
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51668
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49566
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49570
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49572
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49574
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49578
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49580
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49582
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49586
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49590
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49592
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43136
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43150
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43156
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43162
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43232
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43238
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43242
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43258
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43274
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43300
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39466
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39508
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39514
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39524
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39544
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39570
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39584
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39598
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39602
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39622

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:37654 -> 46.3.197.29:1312

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 46.3.197.29
Source: unknown	TCP traffic detected without corresponding DNS query: 24.195.66.43
Source: unknown	TCP traffic detected without corresponding DNS query: 40.9.237.43
Source: unknown	TCP traffic detected without corresponding DNS query: 115.252.171.174
Source: unknown	TCP traffic detected without corresponding DNS query: 200.94.5.160
Source: unknown	TCP traffic detected without corresponding DNS query: 80.246.13.159
Source: unknown	TCP traffic detected without corresponding DNS query: 8.181.119.247
Source: unknown	TCP traffic detected without corresponding DNS query: 71.79.189.121
Source: unknown	TCP traffic detected without corresponding DNS query: 243.120.20.51
Source: unknown	TCP traffic detected without corresponding DNS query: 169.240.26.79
Source: unknown	TCP traffic detected without corresponding DNS query: 74.8.66.172
Source: unknown	TCP traffic detected without corresponding DNS query: 16.44.198.121
Source: unknown	TCP traffic detected without corresponding DNS query: 145.199.66.230
Source: unknown	TCP traffic detected without corresponding DNS query: 194.93.212.255
Source: unknown	TCP traffic detected without corresponding DNS query: 88.32.231.57
Source: unknown	TCP traffic detected without corresponding DNS query: 185.105.174.161
Source: unknown	TCP traffic detected without corresponding DNS query: 5.162.47.93
Source: unknown	TCP traffic detected without corresponding DNS query: 93.85.243.117
Source: unknown	TCP traffic detected without corresponding DNS query: 91.70.231.88
Source: unknown	TCP traffic detected without corresponding DNS query: 221.14.68.227
Source: unknown	TCP traffic detected without corresponding DNS query: 48.179.21.219
Source: unknown	TCP traffic detected without corresponding DNS query: 61.138.53.131
Source: unknown	TCP traffic detected without corresponding DNS query: 159.193.200.64
Source: unknown	TCP traffic detected without corresponding DNS query: 241.134.182.79
Source: unknown	TCP traffic detected without corresponding DNS query: 98.205.95.2
Source: unknown	TCP traffic detected without corresponding DNS query: 47.229.140.94
Source: unknown	TCP traffic detected without corresponding DNS query: 209.195.177.186
Source: unknown	TCP traffic detected without corresponding DNS query: 16.124.55.24
Source: unknown	TCP traffic detected without corresponding DNS query: 117.111.95.152
Source: unknown	TCP traffic detected without corresponding DNS query: 124.81.139.215
Source: unknown	TCP traffic detected without corresponding DNS query: 82.217.39.130
Source: unknown	TCP traffic detected without corresponding DNS query: 5.230.163.179
Source: unknown	TCP traffic detected without corresponding DNS query: 31.30.49.195
Source: unknown	TCP traffic detected without corresponding DNS query: 84.122.220.136
Source: unknown	TCP traffic detected without corresponding DNS query: 167.136.25.35
Source: unknown	TCP traffic detected without corresponding DNS query: 32.195.164.204
Source: unknown	TCP traffic detected without corresponding DNS query: 34.66.15.115
Source: unknown	TCP traffic detected without corresponding DNS query: 106.50.138.199
Source: unknown	TCP traffic detected without corresponding DNS query: 240.221.19.150
Source: unknown	TCP traffic detected without corresponding DNS query: 183.45.22.130
Source: unknown	TCP traffic detected without corresponding DNS query: 174.46.26.37
Source: unknown	TCP traffic detected without corresponding DNS query: 154.21.189.208
Source: unknown	TCP traffic detected without corresponding DNS query: 31.109.96.72
Source: unknown	TCP traffic detected without corresponding DNS query: 104.183.135.60
Source: unknown	TCP traffic detected without corresponding DNS query: 12.89.41.164
Source: unknown	TCP traffic detected without corresponding DNS query: 203.48.122.82
Source: unknown	TCP traffic detected without corresponding DNS query: 250.49.137.203
Source: unknown	TCP traffic detected without corresponding DNS query: 57.174.2.110
Source: unknown	TCP traffic detected without corresponding DNS query: 206.106.47.180
Source: unknown	TCP traffic detected without corresponding DNS query: 53.184.45.203

Source: sora.x86.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Source: LOAD without section mappings

Program segment: 0xc01000

Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: /tmp/sora.x86.elf (PID: 6224)	SIGKILL sent: pid: 936, result: successful
Source: /tmp/sora.x86.elf (PID: 6227)	SIGKILL sent: pid: 936, result: successful

Source: classification engine

Classification label: mal80.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/491/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/793/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/772/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/796/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/774/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/797/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/777/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/799/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/658/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/912/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/759/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/936/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/918/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/6224/exe
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/1/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/761/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/785/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/884/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/720/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/721/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/788/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/789/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/800/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/801/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/847/fd
Source: /tmp/sora.x86.elf (PID: 6224)	File opened: /proc/904/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/491/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/793/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/772/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/796/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/774/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/797/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/777/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/799/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/6227/exe
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/658/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/912/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/759/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/936/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/918/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/1/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/761/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/785/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/884/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/720/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/721/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/788/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/789/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/800/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/801/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/847/fd
Source: /tmp/sora.x86.elf (PID: 6227)	File opened: /proc/904/fd

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56422
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56440
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56448
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56450
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56456
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56458
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56460
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56462
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56464
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56462
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56466
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51572
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51588
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51592
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51612
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51628
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51632
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51642
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51654
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51662
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51668
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49566
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49570
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49572
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49574
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49578
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49580
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49582
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49586
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49590
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49592
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43136
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43150
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43156
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43162
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43232
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43238
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43242
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43258
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43274
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43300
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39466
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39508
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39514
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39524
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39544
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39570
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39584
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39598
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39602
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39622

Source: sora.x86.elf

Submission file: segment LOAD with 7.874 entropy (max. 8.0)

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6316.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6222.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6321.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6317.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6326.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6224.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6225.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sora.x86.elf	69%	ReversingLabs	Linux.Trojan.Mirai
sora.x86.elf	58%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	sora.x86.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
178.81.141.6	unknown	Saudi Arabia	35819	MOBILY-ASEtihadEtisalatCompanyMobilySA	false
41.163.216.179	unknown	South Africa	36937	Neotel-ASZA	false
176.136.170.99	unknown	France	5410	BOUYGTEL-ISPFR	false
250.135.211.9	unknown	Reserved	unknown	unknown	false
48.10.80.145	unknown	United States	2686	ATGS-MMD-ASUS	false
177.110.72.108	unknown	Brazil	26615	TIMSABR	false
243.144.74.220	unknown	Reserved	unknown	unknown	false
106.129.53.72	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
222.12.163.124	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
70.89.111.222	unknown	United States	7922	COMCAST-7922US	false
38.71.40.64	unknown	United States	39988	INTELLIGENT-TECHNOLOGY-SOLUTIONSUS	false
105.217.152.42	unknown	South Africa	16637	MTNNS-ASZA	false
157.15.9.149	unknown	unknown	2512	TCP-NETTCPIncJP	false
201.43.167.94	unknown	Brazil	27699	TELEFONICABRASILSABR	false
188.67.250.32	unknown	Finland	16086	DNAFI	false
151.219.242.165	unknown	unknown	11003	PANDGUS	false
92.150.193.36	unknown	France	3215	FranceTelecom-OrangeFR	false
23.161.244.109	unknown	Reserved	19575	ISPNETUS	false
38.54.7.61	unknown	United States	174	COGENT-174US	false
142.106.230.185	unknown	Canada	808	GONET-ASN-1CA	false
5.73.143.151	unknown	Iran (ISLAMIC Republic Of)	57218	RIGHTELIR	false
118.16.75.14	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
247.179.52.153	unknown	Reserved	unknown	unknown	false
194.73.176.86	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
8.112.113.215	unknown	United States	3356	LEVEL3US	false
101.201.216.175	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
57.86.163.61	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
170.201.22.99	unknown	United States	10995	PNCBANKUS	false
92.111.42.8	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
23.1.146.96	unknown	United States	6762	SEABONE-NETTELECOMITALIASPARKLESpAIT	false
39.192.61.38	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
101.172.43.74	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
38.0.95.145	unknown	United States	174	COGENT-174US	false
34.199.228.243	unknown	United States	14618	AMAZON-AESUS	false
91.178.248.238	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
36.194.65.150	unknown	China	24138	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
23.21.46.155	unknown	United States	14618	AMAZON-AESUS	false
116.40.18.47	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
194.218.130.135	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
24.95.80.235	unknown	United States	10796	TWC-10796-MIDWESTUS	false
110.170.33.208	unknown	Thailand	7470	TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH	false
251.188.124.217	unknown	Reserved	unknown	unknown	false
103.133.113.47	unknown	India	138310	JUBILANT-ASJubilantFoodworksLimitedIN	false
44.53.238.50	unknown	United States	7377	UCSDUS	false
114.133.53.33	unknown	Malaysia	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
68.54.35.223	unknown	United States	7922	COMCAST-7922US	false
174.140.121.36	unknown	United States	11776	ATLANTICBB-JOHNSTOWNUS	false
223.248.70.160	unknown	China	9812	CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN	false
189.86.165.247	unknown	Brazil	4230	CLAROSABR	false
206.60.118.7	unknown	United States	8014	BATELNETBS	false
19.94.4.107	unknown	United States	3	MIT-GATEWAYSUS	false
176.65.3.11	unknown	Palestinian Territory Occupied	12975	PALTEL-ASPALTELAutonomousSystemPS	false
19.1.83.123	unknown	United States	3	MIT-GATEWAYSUS	false
143.39.115.88	unknown	United States	11003	PANDGUS	false
75.9.72.27	unknown	United States	7018	ATT-INTERNET4US	false
150.29.19.108	unknown	Japan	23793	AISTNationalInstituteofAdvancedIndustrialScienceandT	false
84.188.59.211	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
145.197.157.97	unknown	Netherlands	1101	IP-EEND-ASIP-EENDBVNL	false
78.165.175.187	unknown	Turkey	9121	TTNETTR	false
103.203.129.245	unknown	China	131599	WISTRONWistronCorporationTW	false
155.154.166.84	unknown	United States	1488	DNIC-ASBLK-01488-01489US	false
255.146.64.5	unknown	Reserved	unknown	unknown	false
181.52.29.241	unknown	Colombia	10620	TelmexColombiaSACO	false
58.178.161.35	unknown	Australia	9443	VOCUS-RETAIL-AUVocusRetailAU	false
75.146.144.230	unknown	United States	7922	COMCAST-7922US	false
254.14.158.74	unknown	Reserved	unknown	unknown	false
72.152.89.188	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
38.89.204.125	unknown	United States	174	COGENT-174US	false
152.248.210.113	unknown	Brazil	26599	TELEFONICABRASILSABR	false
98.243.159.97	unknown	United States	7922	COMCAST-7922US	false
97.195.200.70	unknown	United States	6167	CELLCO-PARTUS	false
2.203.197.72	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
143.16.24.77	unknown	United States	264008	LANCAMANTOANISERVICOSDEINFORMATICALTDA-MEBR	false
244.239.113.91	unknown	Reserved	unknown	unknown	false
150.108.123.75	unknown	United States	32531	FORDHAM-UNIVERSITYUS	false
147.134.215.195	unknown	United States	30569	CREIGHTON-ASUS	false
168.241.199.152	unknown	United States	21943	ASN-ITG-072618US	false
13.107.141.165	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
203.226.15.246	unknown	Korea Republic of	45385	DAELIMDAELIMCorporationKR	false
70.45.115.227	unknown	Puerto Rico	14638	LCPRLUS	false
145.240.163.248	unknown	France	1101	IP-EEND-ASIP-EENDBVNL	false
253.45.18.214	unknown	Reserved	unknown	unknown	false
82.127.24.59	unknown	France	3215	FranceTelecom-OrangeFR	false
249.181.214.51	unknown	Reserved	unknown	unknown	false
185.220.10.223	unknown	Spain	205390	TECTIQOM-ASDE	false
90.126.139.54	unknown	France	3215	FranceTelecom-OrangeFR	false
251.214.54.12	unknown	Reserved	unknown	unknown	false
254.194.255.52	unknown	Reserved	unknown	unknown	false
38.229.203.83	unknown	United States	23028	TEAM-CYMRUUS	false
213.33.211.152	unknown	Russian Federation	3216	SOVAM-ASRU	false
203.228.150.224	unknown	Korea Republic of	4664	HIT-KR-APShinbiroKR	false
145.103.13.187	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
125.252.63.134	unknown	Korea Republic of	17608	ABN-AS-KRABNKR	false
157.190.234.164	unknown	Ireland	1213	HEANETIE	false
196.178.177.179	unknown	Tunisia	37693	TUNISIANATN	false
166.242.49.101	unknown	United States	6614	USCC-ASNUS	false
253.196.194.66	unknown	Reserved	unknown	unknown	false
66.238.202.135	unknown	United States	2828	XO-AS15US	false
210.37.185.91	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
148.37.24.17	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.869234697100542
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	sora.x86.elf
File size:	27704
MD5:	ed1472168cdeb8c93dd3f03c3c8fdba8
SHA1:	647657a97916d4db8ade0115a6fb5b3de3c02f77
SHA256:	17492e1447ec32d450601db269a687e058fab102b0bd35763e93483c755921cd
SHA512:	298f355d1a894695b13a11f0de55f56d90b9f98ea568e0f7de280ad9da8feba50af74abb3c5505479af99c8b6e617f933a5e08391b4e089c3dcc8e689708175f
SSDEEP:	384:MRG/9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5cwd/DyZTYHHJC8oytPFnAqV/LlTf:/5+Kcrb9VDJeIwkTYTlPFnz/Qe
TLSH:	01C2E1A3A4E5CD15C863413B6F1F1AAB61386524134DEE1E323BEBDC63460B4A176DC7
File Content Preview:	.ELF....................@s..4...........4. ...(.....................;k..;k...................~...~..................Q.td................................UPX!........P...P......._........?d..ELF.......d.......4....4. (.......k.-.#. ......sw....$..w..\.\..A.

Static ELF Info

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0xc01000	0xc01000	0x6b3b	0x6b3b	7.8740	0x5	R E	0x1000
LOAD	0xe80	0x8057e80	0x8057e80	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2023 09:35:54.129697084 CET	37654	1312	192.168.2.23	46.3.197.29
Mar 21, 2023 09:35:54.129934072 CET	52344	23	192.168.2.23	24.195.66.43
Mar 21, 2023 09:35:54.129940033 CET	52344	23	192.168.2.23	40.9.237.43
Mar 21, 2023 09:35:54.129978895 CET	52344	23	192.168.2.23	115.252.171.174
Mar 21, 2023 09:35:54.129978895 CET	52344	23	192.168.2.23	14.210.106.105
Mar 21, 2023 09:35:54.129978895 CET	52344	23	192.168.2.23	200.94.5.160
Mar 21, 2023 09:35:54.130017996 CET	52344	23	192.168.2.23	80.246.13.159
Mar 21, 2023 09:35:54.130017996 CET	52344	23	192.168.2.23	8.181.119.247
Mar 21, 2023 09:35:54.130032063 CET	52344	23	192.168.2.23	71.79.189.121
Mar 21, 2023 09:35:54.130054951 CET	52344	23	192.168.2.23	243.120.20.51
Mar 21, 2023 09:35:54.130054951 CET	52344	23	192.168.2.23	169.240.26.79
Mar 21, 2023 09:35:54.130069017 CET	52344	23	192.168.2.23	74.8.66.172
Mar 21, 2023 09:35:54.130081892 CET	52344	23	192.168.2.23	16.44.198.121
Mar 21, 2023 09:35:54.130086899 CET	52344	23	192.168.2.23	145.199.66.230
Mar 21, 2023 09:35:54.130100965 CET	52344	23	192.168.2.23	194.93.212.255
Mar 21, 2023 09:35:54.130140066 CET	52344	23	192.168.2.23	88.32.231.57
Mar 21, 2023 09:35:54.130148888 CET	52344	23	192.168.2.23	185.105.174.161
Mar 21, 2023 09:35:54.130177021 CET	52344	23	192.168.2.23	5.162.47.93
Mar 21, 2023 09:35:54.130177021 CET	52344	23	192.168.2.23	93.85.243.117
Mar 21, 2023 09:35:54.130187988 CET	52344	23	192.168.2.23	91.70.231.88
Mar 21, 2023 09:35:54.130208969 CET	52344	23	192.168.2.23	110.85.3.6
Mar 21, 2023 09:35:54.130222082 CET	52344	23	192.168.2.23	221.14.68.227
Mar 21, 2023 09:35:54.130222082 CET	52344	23	192.168.2.23	48.179.21.219
Mar 21, 2023 09:35:54.130225897 CET	52344	23	192.168.2.23	61.138.53.131
Mar 21, 2023 09:35:54.130229950 CET	52344	23	192.168.2.23	159.193.200.64
Mar 21, 2023 09:35:54.130242109 CET	52344	23	192.168.2.23	40.141.10.55
Mar 21, 2023 09:35:54.130250931 CET	52344	23	192.168.2.23	241.134.182.79
Mar 21, 2023 09:35:54.130259991 CET	52344	23	192.168.2.23	98.205.95.2
Mar 21, 2023 09:35:54.130259991 CET	52344	23	192.168.2.23	47.229.140.94
Mar 21, 2023 09:35:54.130284071 CET	52344	23	192.168.2.23	209.195.177.186
Mar 21, 2023 09:35:54.130284071 CET	52344	23	192.168.2.23	16.124.55.24
Mar 21, 2023 09:35:54.130327940 CET	52344	23	192.168.2.23	117.111.95.152
Mar 21, 2023 09:35:54.130346060 CET	52344	23	192.168.2.23	124.81.139.215
Mar 21, 2023 09:35:54.130366087 CET	52344	23	192.168.2.23	82.217.39.130
Mar 21, 2023 09:35:54.130366087 CET	52344	23	192.168.2.23	5.230.163.179
Mar 21, 2023 09:35:54.130367994 CET	52344	23	192.168.2.23	210.19.152.19
Mar 21, 2023 09:35:54.130378008 CET	52344	23	192.168.2.23	31.30.49.195
Mar 21, 2023 09:35:54.130389929 CET	52344	23	192.168.2.23	84.122.220.136
Mar 21, 2023 09:35:54.130392075 CET	52344	23	192.168.2.23	167.136.25.35
Mar 21, 2023 09:35:54.130400896 CET	52344	23	192.168.2.23	32.195.164.204
Mar 21, 2023 09:35:54.130425930 CET	52344	23	192.168.2.23	34.66.15.115
Mar 21, 2023 09:35:54.130425930 CET	52344	23	192.168.2.23	106.50.138.199
Mar 21, 2023 09:35:54.130425930 CET	52344	23	192.168.2.23	240.221.19.150
Mar 21, 2023 09:35:54.130429983 CET	52344	23	192.168.2.23	183.45.22.130
Mar 21, 2023 09:35:54.130439043 CET	52344	23	192.168.2.23	174.46.26.37
Mar 21, 2023 09:35:54.130450964 CET	52344	23	192.168.2.23	154.21.189.208
Mar 21, 2023 09:35:54.130461931 CET	52344	23	192.168.2.23	31.109.96.72
Mar 21, 2023 09:35:54.130461931 CET	52344	23	192.168.2.23	104.183.135.60
Mar 21, 2023 09:35:54.130516052 CET	52344	23	192.168.2.23	12.89.41.164
Mar 21, 2023 09:35:54.130525112 CET	52344	23	192.168.2.23	203.48.122.82
Mar 21, 2023 09:35:54.130528927 CET	52344	23	192.168.2.23	250.49.137.203
Mar 21, 2023 09:35:54.130549908 CET	52344	23	192.168.2.23	57.174.2.110
Mar 21, 2023 09:35:54.130553007 CET	52344	23	192.168.2.23	206.106.47.180
Mar 21, 2023 09:35:54.130553961 CET	52344	23	192.168.2.23	53.184.45.203
Mar 21, 2023 09:35:54.130573034 CET	52344	23	192.168.2.23	213.131.28.73
Mar 21, 2023 09:35:54.130579948 CET	52344	23	192.168.2.23	142.35.222.165
Mar 21, 2023 09:35:54.130584002 CET	52344	23	192.168.2.23	192.65.164.111
Mar 21, 2023 09:35:54.130604029 CET	52344	23	192.168.2.23	9.201.37.252
Mar 21, 2023 09:35:54.130614042 CET	52344	23	192.168.2.23	183.237.183.200
Mar 21, 2023 09:35:54.130620956 CET	52344	23	192.168.2.23	154.119.137.142
Mar 21, 2023 09:35:54.130620956 CET	52344	23	192.168.2.23	48.49.203.149
Mar 21, 2023 09:35:54.130640984 CET	52344	23	192.168.2.23	79.98.234.143
Mar 21, 2023 09:35:54.130641937 CET	52344	23	192.168.2.23	218.54.91.162
Mar 21, 2023 09:35:54.130676985 CET	52344	23	192.168.2.23	253.132.99.169
Mar 21, 2023 09:35:54.130712986 CET	52344	23	192.168.2.23	159.254.7.11
Mar 21, 2023 09:35:54.130733967 CET	52344	23	192.168.2.23	80.154.59.166
Mar 21, 2023 09:35:54.130737066 CET	52344	23	192.168.2.23	212.34.16.29
Mar 21, 2023 09:35:54.130737066 CET	52344	23	192.168.2.23	218.182.63.229
Mar 21, 2023 09:35:54.130742073 CET	52344	23	192.168.2.23	204.251.8.217
Mar 21, 2023 09:35:54.130742073 CET	52344	23	192.168.2.23	77.253.138.173
Mar 21, 2023 09:35:54.130742073 CET	52344	23	192.168.2.23	75.162.160.151
Mar 21, 2023 09:35:54.130753994 CET	52344	23	192.168.2.23	193.57.119.15
Mar 21, 2023 09:35:54.130795002 CET	52344	23	192.168.2.23	206.59.209.37
Mar 21, 2023 09:35:54.130814075 CET	52344	23	192.168.2.23	84.176.208.6
Mar 21, 2023 09:35:54.130820990 CET	52344	23	192.168.2.23	158.143.157.74
Mar 21, 2023 09:35:54.130820990 CET	52344	23	192.168.2.23	9.52.72.175
Mar 21, 2023 09:35:54.130842924 CET	52344	23	192.168.2.23	82.168.172.245
Mar 21, 2023 09:35:54.130851030 CET	52344	23	192.168.2.23	168.130.193.47
Mar 21, 2023 09:35:54.130856037 CET	52344	23	192.168.2.23	149.32.75.87
Mar 21, 2023 09:35:54.130865097 CET	52344	23	192.168.2.23	5.148.95.103
Mar 21, 2023 09:35:54.130876064 CET	52344	23	192.168.2.23	161.81.115.28
Mar 21, 2023 09:35:54.130881071 CET	52344	23	192.168.2.23	59.208.222.18
Mar 21, 2023 09:35:54.130898952 CET	52344	23	192.168.2.23	191.182.181.18
Mar 21, 2023 09:35:54.130898952 CET	52344	23	192.168.2.23	173.111.252.171
Mar 21, 2023 09:35:54.130908966 CET	52344	23	192.168.2.23	244.30.108.232
Mar 21, 2023 09:35:54.130927086 CET	52344	23	192.168.2.23	126.219.31.214
Mar 21, 2023 09:35:54.130928993 CET	52344	23	192.168.2.23	208.65.197.147
Mar 21, 2023 09:35:54.130930901 CET	52344	23	192.168.2.23	36.51.163.151
Mar 21, 2023 09:35:54.130954981 CET	52344	23	192.168.2.23	186.162.144.134
Mar 21, 2023 09:35:54.130990982 CET	52344	23	192.168.2.23	36.139.246.201
Mar 21, 2023 09:35:54.130995989 CET	52344	23	192.168.2.23	250.246.194.224
Mar 21, 2023 09:35:54.131006002 CET	52344	23	192.168.2.23	180.159.87.207
Mar 21, 2023 09:35:54.131015062 CET	52344	23	192.168.2.23	146.183.184.251
Mar 21, 2023 09:35:54.131038904 CET	52344	23	192.168.2.23	105.10.17.22
Mar 21, 2023 09:35:54.131038904 CET	52344	23	192.168.2.23	193.139.228.243
Mar 21, 2023 09:35:54.131052971 CET	52344	23	192.168.2.23	212.150.75.76
Mar 21, 2023 09:35:54.131072998 CET	52344	23	192.168.2.23	157.49.78.163
Mar 21, 2023 09:35:54.131098986 CET	52344	23	192.168.2.23	171.56.82.99
Mar 21, 2023 09:35:54.131098986 CET	52344	23	192.168.2.23	99.94.83.29
Mar 21, 2023 09:35:54.133594036 CET	52344	23	192.168.2.23	107.92.122.79

System Behavior

Analysis Process: sora.x86.elf PID: 6222, Parent PID: 6124

General

Start time:	09:35:53
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	/tmp/sora.x86.elf
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6224, Parent PID: 6222

General

Start time:	09:35:53
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6317, Parent PID: 6224

General

Start time:	09:38:45
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6319, Parent PID: 6224

General

Start time:	09:38:45
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6320, Parent PID: 6319

General

Start time:	09:38:45
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6326, Parent PID: 6320

General

Start time:	09:38:50
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6327, Parent PID: 6320

General

Start time:	09:38:50
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6321, Parent PID: 6319

General

Start time:	09:38:45
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6322, Parent PID: 6319

General

Start time:	09:38:45
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6225, Parent PID: 6222

General

Start time:	09:35:53
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6226, Parent PID: 6222

General

Start time:	09:35:53
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6227, Parent PID: 6226

General

Start time:	09:35:53
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6316, Parent PID: 6227

General

Start time:	09:38:45
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6318, Parent PID: 6227

General

Start time:	09:38:45
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6228, Parent PID: 6226

General

Start time:	09:35:53
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Analysis Process: sora.x86.elf PID: 6229, Parent PID: 6226

General

Start time:	09:35:53
Start date:	21/03/2023
Path:	/tmp/sora.x86.elf
Arguments:	n/a
File size:	27704 bytes
MD5 hash:	ed1472168cdeb8c93dd3f03c3c8fdba8

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report sora.x86.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: sora.x86.elf PID: 6222, Parent PID: 6124

General

Analysis Process: sora.x86.elf PID: 6224, Parent PID: 6222

General

Analysis Process: sora.x86.elf PID: 6317, Parent PID: 6224

General

Analysis Process: sora.x86.elf PID: 6319, Parent PID: 6224

General

Analysis Process: sora.x86.elf PID: 6320, Parent PID: 6319

General

Analysis Process: sora.x86.elf PID: 6326, Parent PID: 6320

General

Analysis Process: sora.x86.elf PID: 6327, Parent PID: 6320

General

Analysis Process: sora.x86.elf PID: 6321, Parent PID: 6319

General

Analysis Process: sora.x86.elf PID: 6322, Parent PID: 6319

General

Analysis Process: sora.x86.elf PID: 6225, Parent PID: 6222

Linux Analysis Report
sora.x86.elf