Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

z0r0.x86

Status: finished
Submission Time: 2022-01-29 00:10:20 +01:00
Malicious
Spreader
Trojan
Evader
Mirai

Comments

Tags

  • Mirai

Details

  • Analysis ID:
    562526
  • API (Web) ID:
    930046
  • Analysis Started:
    2022-01-29 00:18:13 +01:00
  • Analysis Finished:
    2022-01-29 00:24:58 +01:00
  • MD5:
    fa4a347c55a6a848e983905a97c543fc
  • SHA1:
    8e45ccab0b7a7fc634e907d73695ddf7318161f6
  • SHA256:
    398d3fac4ae377a2806e21197f1012e22d808a3008ac579cc5fd21b97167c403
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
Full Report Management Report IOC Report
malicious
Score: 100
System: Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)

Third Party Analysis Engines

Open Full Report
malicious
Score: 22/61

IPs

IP Country Detection
66.186.77.212
 Canada
206.10.80.221
 United States
106.13.224.214
 China
Click to see the 97 hidden entries
84.185.121.95
 Germany
18.146.208.68
 United States
156.190.100.171
 Egypt
62.172.94.176
 United Kingdom
124.87.251.45
 Japan
44.171.139.242
 United States
66.207.229.176
 United States
156.58.162.97
 Austria
41.127.111.254
 South Africa
76.170.239.11
 United States
197.96.225.179
 South Africa
197.217.101.191
 Angola
166.7.141.227
 United States
156.208.176.31
 Egypt
73.32.177.127
 United States
41.138.189.47
 Nigeria
68.215.154.109
 United States
31.16.120.163
 Germany
207.94.133.255
 United States
122.141.255.42
 China
41.143.204.140
 Morocco
156.89.9.156
 United States
190.20.147.200
 Chile
132.164.250.209
 Reserved
156.48.59.165
 United Kingdom
168.169.255.193
 United States
197.173.74.81
 South Africa
191.181.205.151
 Brazil
203.190.131.47
 India
156.141.177.84
 United States
14.116.97.206
 China
50.70.203.81
 Canada
4.251.198.187
 United States
122.71.101.88
 China
8.32.64.58
 United States
96.212.9.184
 United States
221.213.77.169
 China
126.109.252.246
 Japan
181.43.42.92
 Chile
172.114.72.193
 United States
4.90.40.253
 United States
179.192.226.37
 Brazil
41.160.135.141
 South Africa
41.123.62.217
 South Africa
209.15.177.54
 Canada
132.30.220.68
 United States
147.8.60.244
 Hong Kong
176.221.54.107
 Ukraine
176.180.120.167
 France
173.225.253.187
 Jamaica
156.83.202.20
 Netherlands
84.200.222.104
 Germany
41.97.15.204
 Algeria
41.53.197.191
 South Africa
193.68.97.197
 Bulgaria
76.238.67.197
 United States
197.202.110.200
 Algeria
136.37.83.5
 United States
53.140.88.47
 Germany
197.149.52.178
 Madagascar
197.217.236.111
 Angola
156.158.50.81
 Tanzania United Republic of
115.75.75.217
 Viet Nam
96.119.45.83
 United States
65.72.176.168
 United States
125.140.138.141
 Korea Republic of
43.18.191.110
 Japan
128.1.181.203
 United States
75.168.14.254
 United States
156.92.118.106
 United States
92.100.198.10
 Russian Federation
197.169.172.181
 South Africa
9.221.26.165
 United States
156.182.145.25
 Egypt
178.40.197.78
 Slovakia (SLOVAK Republic)
76.17.80.137
 United States
222.111.11.164
 Korea Republic of
197.220.189.16
 Ghana
165.119.251.47
 United States
220.241.36.15
 Hong Kong
49.29.178.107
 Korea Republic of
132.63.145.245
 United States
168.55.91.18
 United States
38.89.204.185
 United States
156.56.101.208
 United States
50.181.162.95
 United States
90.47.216.176
 France
197.73.219.49
 South Africa
156.72.230.178
 United States
41.108.83.63
 Algeria
197.0.78.200
 Tunisia
41.188.184.69
 Tanzania United Republic of
49.52.78.43
 China
41.69.166.104
 Egypt
118.138.25.191
 Australia
41.240.121.73
 Sudan
4.81.105.214
 United States

Domains

Name IP Detection
botnet.punisher-stresser.eu
 78.47.58.57

URLs

Name Detection
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+
http://upx.sf.net
http://schemas.xmlsoap.org/soap/encoding/
Click to see the 2 hidden entries
https://ubuntu.com/blog/microk8s-memory-optimisation
http://schemas.xmlsoap.org/soap/envelope/

Dropped files

Name File Type Hashes Detection
/var/cache/man/sr/index.db.rjgwoT
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/nl/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/nl/index.db.uEYHmT
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
Click to see the 51 hidden entries
/var/cache/man/pl/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/pl/index.db.15VDtW
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/pt/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/pt/index.db.AJv2IV
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/pt_BR/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/pt_BR/index.db.tktNdV
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/ru/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/ru/index.db.c5YTAS
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/sl/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/sl/index.db.7NCiLU
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/sr/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/ko/index.db.JIzmMW
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/sv/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/sv/index.db.dGjlIV
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/tr/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/tr/index.db.PCmHrT
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/zh_CN/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/zh_CN/index.db.7wRfIU
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/zh_TW/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/zh_TW/index.db.MHFjDS
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/motd-news
 ASCII text
 #
/var/lib/logrotate/status.tmp
 ASCII text
 #
/var/log/cups/access_log.1.gz
 gzip compressed data, last modified: Fri Jan 28 23:18:19 2022, from Unix
 #
/var/log/syslog.1.gz
 gzip compressed data, last modified: Fri Jan 28 23:18:19 2022, from Unix
 #
/var/cache/man/fr.UTF-8/index.db.wwboAS
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/cs/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/cs/index.db.PJqWEW
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/da/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/da/index.db.YsUJSV
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/de/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/de/index.db.0nTKwU
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/es/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/es/index.db.bMpfsT
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/fi/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/fi/index.db.BZXkKV
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/fr.ISO8859-1/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/fr.ISO8859-1/index.db.pcsQIU
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/fr.UTF-8/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/fr/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/fr/index.db.cjnjXU
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/hu/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/hu/index.db.7jZNmV
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/id/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/id/index.db.u9AwOU
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/index.db.3RbErS
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/it/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/it/index.db.iw6zxT
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/ja/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/ja/index.db.nSXPhU
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #
/var/cache/man/ko/5220
 GNU dbm 1.x or ndbm database, little endian, 64-bit
 #