Edit tour

Linux Analysis Report
cundi.mips.elf

Overview

General Information

Sample Name:	cundi.mips.elf
Analysis ID:	1297953
MD5:	05c54df435b31fbe2176d4e06338a936
SHA1:	d22f9bfa445bf474d92494667a53ba8f98e315f6
SHA256:	8277b507e209e119fcfcd332a3036aaf0e04b20774cf46bb6a79126a9f9fa8ee
Infos:

Detection

Mirai

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Detected Mirai

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Found strings indicative of a multi-platform dropper

Connects to many ports of the same IP (likely port scanning)

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Detected TCP or UDP traffic on non-standard ports

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1297953
Start date and time:	2023-08-26 23:23:12 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	cundi.mips.elf
Detection:	MAL
Classification:	mal88.spre.troj.linELF@0/1025@22/0

Runtime Messages

Command:	/tmp/cundi.mips.elf
PID:	5449
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

cundi.mips.elf (PID: 5449, Parent: 5348, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/cundi.mips.elf

cundi.mips.elf New Fork (PID: 5451, Parent: 5449)

cundi.mips.elf New Fork (PID: 5453, Parent: 5451)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
cundi.mips.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5449.1.00007f624c400000.00007f624c423000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: cundi.mips.elf PID: 5449	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748590439572030490 08/26/23-23:25:51.592484
SID:	2030490
Source Port:	48590
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748570439572030490 08/26/23-23:24:57.273248
SID:	2030490
Source Port:	48570
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748580439572030490 08/26/23-23:25:25.490964
SID:	2030490
Source Port:	48580
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748564439572030490 08/26/23-23:24:29.383015
SID:	2030490
Source Port:	48564
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748586439572030490 08/26/23-23:25:47.768125
SID:	2030490
Source Port:	48586
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748576439572030490 08/26/23-23:25:12.674809
SID:	2030490
Source Port:	48576
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748566439572030490 08/26/23-23:24:33.795094
SID:	2030490
Source Port:	48566
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748596439572030490 08/26/23-23:26:03.835082
SID:	2030490
Source Port:	48596
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748598439572030490 08/26/23-23:26:08.241189
SID:	2030490
Source Port:	48598
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748574439572030490 08/26/23-23:25:09.131875
SID:	2030490
Source Port:	48574
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748578439572030490 08/26/23-23:25:17.085040
SID:	2030490
Source Port:	48578
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748556439572030490 08/26/23-23:24:05.689064
SID:	2030490
Source Port:	48556
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748584439572030490 08/26/23-23:25:44.335434
SID:	2030490
Source Port:	48584
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748588439572030490 08/26/23-23:25:49.179660
SID:	2030490
Source Port:	48588
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748572439572030490 08/26/23-23:25:04.704899
SID:	2030490
Source Port:	48572
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748562439572030490 08/26/23-23:24:20.976877
SID:	2030490
Source Port:	48562
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748592439572030490 08/26/23-23:25:55.000049
SID:	2030490
Source Port:	48592
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748594439572030490 08/26/23-23:25:59.407507
SID:	2030490
Source Port:	48594
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748560439572030490 08/26/23-23:24:14.549440
SID:	2030490
Source Port:	48560
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748558439572030490 08/26/23-23:24:13.095196
SID:	2030490
Source Port:	48558
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.189.202.187

Timestamp:	192.168.2.13103.189.202.18748582439572030490 08/26/23-23:25:35.902796
SID:	2030490
Source Port:	48582
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: cundi.mips.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: cundi.mips.elf	ReversingLabs: Detection: 47%
Source: cundi.mips.elf	Virustotal: Detection: 48%			Perma Link

Spreading

Found strings indicative of a multi-platform dropper

Source: cundi.mips.elf

String: HTTP/1.1 200 OKcundi.armcundi.arm5cundi.arm6cundi.arm7cundi.mipscundi.mpslcundi.x86_64cundi.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48556 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48558 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48560 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48562 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48564 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48566 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48570 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48572 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48574 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48576 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48578 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48580 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48582 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48584 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48586 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48588 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48590 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48592 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48594 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48596 -> 103.189.202.187:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:48598 -> 103.189.202.187:43957

Source: global traffic	TCP traffic: 103.16.161.29 ports 43957,3,4,5,7,9
Source: global traffic	TCP traffic: 103.189.202.187 ports 43957,3,4,5,7,9

Source: global traffic	TCP traffic: 192.168.2.13:48556 -> 103.189.202.187:43957
Source: global traffic	TCP traffic: 192.168.2.13:58572 -> 103.16.161.29:43957

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKcundi.armcundi.arm5cundi.arm6cundi.arm7cundi.mipscundi.mpslcundi.x86_64cundi.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/5276/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/5148/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/cundi.mips.elf (PID: 5453)	File opened: /proc/816/cmdline	Jump to behavior

Source: cundi.mips.elf, 5449.1.000056184391f000.00005618439a6000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/mips
Source: cundi.mips.elf, 5449.1.000056184391f000.00005618439a6000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: cundi.mips.elf, 5449.1.00007fff14fd4000.00007fff14ff5000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: cundi.mips.elf, 5449.1.00007fff14fd4000.00007fff14ff5000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/cundi.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/cundi.mips.elf

Source: Yara match	File source: cundi.mips.elf, type: SAMPLE
Source: Yara match	File source: 5449.1.00007f624c400000.00007f624c423000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cundi.mips.elf PID: 5449, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Scripting	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Non-Standard Port	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Source	Detection	Scanner	Label	Link
cundi.mips.elf	47%	ReversingLabs	Linux.Trojan.Mirai
cundi.mips.elf	48%	Virustotal		Browse
cundi.mips.elf	100%	Avira	EXP/ELF.Agent.Gen.J

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.16.161.29	unknown	Japan		133159	MAMMOTHMEDIA-AS-APMammothMediaPtyLtdAU	true
103.189.202.187	galaxybotnet.site	unknown		7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	true

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.16.161.29	cundi.arm7.elf	Get hash	malicious	Mirai	Browse
103.16.161.29	cundi.arm.elf	Get hash	malicious	Mirai	Browse
103.189.202.187	cundi.arm5.elf	Get hash	malicious	Mirai	Browse
	cundi.arm7.elf	Get hash	malicious	Mirai	Browse
	cundi.arm.elf	Get hash	malicious	Mirai	Browse

Process:	/tmp/cundi.mips.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.8219280948873617
Encrypted:	false
SSDEEP:	3:TgHLgIURn:TgrKR
MD5:	D380162193403B6C1E853F59C801A933
SHA1:	4B2F77438F8E2E55A8524E7516A3444F7ABBA9F2
SHA-256:	81BDC0B15F143F9479943258385525D2A6357FF66CCA58F348C4C470C5CDD4F3
SHA-512:	51866225F0F50C5979EDC85AF7EFC0DA065883C786D310DA0A1C081A5D6CE17CB7344F1EE0FC2CF5E16568B4B9E7727810DB81B88229FF2B3ACB55EA60D6A440
Malicious:	false
Reputation:	low
Preview:	/tmp/cundi.mips.elf.

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	4.968140761658991
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	cundi.mips.elf
File size:	165'528 bytes
MD5:	05c54df435b31fbe2176d4e06338a936
SHA1:	d22f9bfa445bf474d92494667a53ba8f98e315f6
SHA256:	8277b507e209e119fcfcd332a3036aaf0e04b20774cf46bb6a79126a9f9fa8ee
SHA512:	2f24be4276482bad732f1f86f6819e0a90b0cdb92452334e49f5cfe8639de890fcdf6a137f30744185818b1eae3449de81416a8c0535b8c3545dd6aac51a5bcf
SSDEEP:	3072:JynVVZZYn+ge7FW4mPb5MPy3F5lPPpQ9J:JW/ZrpW3z5dFDny9J
TLSH:	C5F3995E6E228F6DF668873147F74925A75D23DA22E1D684D2ACC1102F2029E641FFEC
File Content Preview:	.ELF.....................@.`...4...h.....4. ...(.............@...@....-0..-0..............0..F0..F0...T.............dt.Q............................<...'......!'.......................<...'......!...$....'9... ......................<...'......!... ....'9.

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	164968
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x20a90	0x0	0x6	AX	16
.fini	PROGBITS	0x420bb0	0x20bb0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x420c10	0x20c10	0x2120	0x0	0x2	A	16
.ctors	PROGBITS	0x463000	0x23000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x46300c	0x2300c	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x463018	0x23018	0xcc	0x0	0x3	WA	4
.data	PROGBITS	0x463100	0x23100	0x4998	0x0	0x3	WA	32
.got	PROGBITS	0x467aa0	0x27aa0	0x964	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x468404	0x28404	0x4c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x468450	0x28404	0x4840	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x126c	0x28404	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x28404	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x22d30	0x22d30	5.3829	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x23000	0x463000	0x463000	0x5404	0x9c90	1.1547	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 26, 2023 23:24:05.494097948 CEST	48556	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:05.688460112 CEST	43957	48556	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:05.688571930 CEST	48556	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:05.689064026 CEST	48556	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:05.883040905 CEST	43957	48556	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:05.883074045 CEST	43957	48556	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:12.900371075 CEST	48558	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:13.094949007 CEST	43957	48558	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:13.095087051 CEST	48558	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:13.095196009 CEST	48558	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:13.289653063 CEST	43957	48558	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:13.289684057 CEST	43957	48558	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:13.289845943 CEST	48558	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:13.484330893 CEST	43957	48558	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:14.355370045 CEST	48560	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:14.549246073 CEST	43957	48560	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:14.549345970 CEST	48560	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:14.549439907 CEST	48560	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:14.743556023 CEST	43957	48560	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:14.743604898 CEST	43957	48560	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:14.743697882 CEST	48560	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:14.939692974 CEST	43957	48560	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:20.780976057 CEST	48562	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:20.975827932 CEST	43957	48562	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:20.976728916 CEST	48562	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:20.976876974 CEST	48562	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:21.171303988 CEST	43957	48562	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:21.171339035 CEST	43957	48562	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:21.171489000 CEST	48562	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:21.365931988 CEST	43957	48562	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:29.187846899 CEST	48564	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:29.382745028 CEST	43957	48564	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:29.382941008 CEST	48564	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:29.383014917 CEST	48564	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:29.578093052 CEST	43957	48564	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:29.578166008 CEST	43957	48564	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:29.578356981 CEST	48564	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:29.773835897 CEST	43957	48564	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:33.599442005 CEST	48566	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:33.794845104 CEST	43957	48566	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:33.794951916 CEST	48566	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:33.795094013 CEST	48566	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:33.990489006 CEST	43957	48566	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:33.990550995 CEST	43957	48566	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:41.028322935 CEST	58572	43957	192.168.2.13	103.16.161.29
Aug 26, 2023 23:24:42.038851023 CEST	58572	43957	192.168.2.13	103.16.161.29
Aug 26, 2023 23:24:44.055074930 CEST	58572	43957	192.168.2.13	103.16.161.29
Aug 26, 2023 23:24:48.311597109 CEST	58572	43957	192.168.2.13	103.16.161.29
Aug 26, 2023 23:24:57.079168081 CEST	48570	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:57.272922039 CEST	43957	48570	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:57.273186922 CEST	48570	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:57.273247957 CEST	48570	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:57.466846943 CEST	43957	48570	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:57.466959000 CEST	43957	48570	103.189.202.187	192.168.2.13
Aug 26, 2023 23:24:57.467159033 CEST	48570	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:24:57.660851955 CEST	43957	48570	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:04.509972095 CEST	48572	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:04.704585075 CEST	43957	48572	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:04.704821110 CEST	48572	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:04.704899073 CEST	48572	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:04.899555922 CEST	43957	48572	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:04.899605036 CEST	43957	48572	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:04.899806976 CEST	48572	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:05.095097065 CEST	43957	48572	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:08.937242031 CEST	48574	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:09.131608009 CEST	43957	48574	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:09.131808043 CEST	48574	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:09.131875038 CEST	48574	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:09.326057911 CEST	43957	48574	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:09.326195955 CEST	43957	48574	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:12.479180098 CEST	48576	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:12.674487114 CEST	43957	48576	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:12.674717903 CEST	48576	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:12.674808979 CEST	48576	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:12.869426966 CEST	43957	48576	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:12.869497061 CEST	43957	48576	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:12.869674921 CEST	48576	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:13.064727068 CEST	43957	48576	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:16.890489101 CEST	48578	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:17.084733009 CEST	43957	48578	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:17.084948063 CEST	48578	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:17.085040092 CEST	48578	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:17.279443979 CEST	43957	48578	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:17.279522896 CEST	43957	48578	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:17.279695988 CEST	48578	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:17.474059105 CEST	43957	48578	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:25.296226978 CEST	48580	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:25.490658998 CEST	43957	48580	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:25.490962982 CEST	48580	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:25.490963936 CEST	48580	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:25.685458899 CEST	43957	48580	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:25.685525894 CEST	43957	48580	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:25.685767889 CEST	48580	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:25.887573004 CEST	43957	48580	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:35.708281994 CEST	48582	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:35.902501106 CEST	43957	48582	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:35.902713060 CEST	48582	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:35.902796030 CEST	48582	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:36.096642971 CEST	43957	48582	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:36.097023010 CEST	43957	48582	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:36.097213984 CEST	48582	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:36.291661978 CEST	43957	48582	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:44.140424967 CEST	48584	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:44.334913969 CEST	43957	48584	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:44.335154057 CEST	48584	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:44.335433960 CEST	48584	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:44.529828072 CEST	43957	48584	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:44.529906988 CEST	43957	48584	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:44.530126095 CEST	48584	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:44.724410057 CEST	43957	48584	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:47.572978973 CEST	48586	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:47.767843008 CEST	43957	48586	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:47.768033981 CEST	48586	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:47.768125057 CEST	48586	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:47.963236094 CEST	43957	48586	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:47.963304996 CEST	43957	48586	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:48.984684944 CEST	48588	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:49.179321051 CEST	43957	48588	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:49.179564953 CEST	48588	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:49.179660082 CEST	48588	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:49.374419928 CEST	43957	48588	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:49.374468088 CEST	43957	48588	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:49.374713898 CEST	48588	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:49.569430113 CEST	43957	48588	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:51.396461010 CEST	48590	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:51.592138052 CEST	43957	48590	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:51.592375040 CEST	48590	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:51.592483997 CEST	48590	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:51.788070917 CEST	43957	48590	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:51.788244963 CEST	43957	48590	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:51.788605928 CEST	48590	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:51.984628916 CEST	43957	48590	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:54.804193020 CEST	48592	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:54.999759912 CEST	43957	48592	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:54.999946117 CEST	48592	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:55.000049114 CEST	48592	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:55.195360899 CEST	43957	48592	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:55.195391893 CEST	43957	48592	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:59.211661100 CEST	48594	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:59.406230927 CEST	43957	48594	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:59.406512022 CEST	48594	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:59.407506943 CEST	48594	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:25:59.601876020 CEST	43957	48594	103.189.202.187	192.168.2.13
Aug 26, 2023 23:25:59.601910114 CEST	43957	48594	103.189.202.187	192.168.2.13
Aug 26, 2023 23:26:03.639663935 CEST	48596	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:26:03.834753990 CEST	43957	48596	103.189.202.187	192.168.2.13
Aug 26, 2023 23:26:03.835033894 CEST	48596	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:26:03.835082054 CEST	48596	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:26:04.029978037 CEST	43957	48596	103.189.202.187	192.168.2.13
Aug 26, 2023 23:26:04.030054092 CEST	43957	48596	103.189.202.187	192.168.2.13
Aug 26, 2023 23:26:04.030246973 CEST	48596	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:26:04.225239992 CEST	43957	48596	103.189.202.187	192.168.2.13
Aug 26, 2023 23:26:08.045800924 CEST	48598	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:26:08.240700960 CEST	43957	48598	103.189.202.187	192.168.2.13
Aug 26, 2023 23:26:08.240987062 CEST	48598	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:26:08.241189003 CEST	48598	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:26:08.435638905 CEST	43957	48598	103.189.202.187	192.168.2.13
Aug 26, 2023 23:26:08.435911894 CEST	43957	48598	103.189.202.187	192.168.2.13
Aug 26, 2023 23:26:08.435925961 CEST	48598	43957	192.168.2.13	103.189.202.187
Aug 26, 2023 23:26:08.631150007 CEST	43957	48598	103.189.202.187	192.168.2.13

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 26, 2023 23:24:05.475538015 CEST	36448	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:24:05.490744114 CEST	53	36448	8.8.8.8	192.168.2.13
Aug 26, 2023 23:24:12.885024071 CEST	34525	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:24:12.900194883 CEST	53	34525	8.8.8.8	192.168.2.13
Aug 26, 2023 23:24:14.290179014 CEST	40723	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:24:14.355182886 CEST	53	40723	8.8.8.8	192.168.2.13
Aug 26, 2023 23:24:20.744684935 CEST	50396	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:24:20.780702114 CEST	53	50396	8.8.8.8	192.168.2.13
Aug 26, 2023 23:24:29.172683954 CEST	33418	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:24:29.187571049 CEST	53	33418	8.8.8.8	192.168.2.13
Aug 26, 2023 23:24:33.579021931 CEST	47350	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:24:33.599209070 CEST	53	47350	8.8.8.8	192.168.2.13
Aug 26, 2023 23:24:40.991621971 CEST	56931	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:24:41.027973890 CEST	53	56931	8.8.8.8	192.168.2.13
Aug 26, 2023 23:24:57.036999941 CEST	36655	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:24:57.078876019 CEST	53	36655	8.8.8.8	192.168.2.13
Aug 26, 2023 23:25:04.468133926 CEST	38401	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:25:04.509676933 CEST	53	38401	8.8.8.8	192.168.2.13
Aug 26, 2023 23:25:08.900486946 CEST	47903	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:25:08.936983109 CEST	53	47903	8.8.8.8	192.168.2.13
Aug 26, 2023 23:25:11.326898098 CEST	42311	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:25:12.478893995 CEST	53	42311	8.8.8.8	192.168.2.13
Aug 26, 2023 23:25:16.870313883 CEST	57258	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:25:16.890191078 CEST	53	57258	8.8.8.8	192.168.2.13
Aug 26, 2023 23:25:25.280817032 CEST	48695	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:25:25.295881987 CEST	53	48695	8.8.8.8	192.168.2.13
Aug 26, 2023 23:25:35.687166929 CEST	50884	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:25:35.707870960 CEST	53	50884	8.8.8.8	192.168.2.13
Aug 26, 2023 23:25:44.098381996 CEST	36860	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:25:44.139933109 CEST	53	36860	8.8.8.8	192.168.2.13
Aug 26, 2023 23:25:47.530786991 CEST	45833	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:25:47.572644949 CEST	53	45833	8.8.8.8	192.168.2.13
Aug 26, 2023 23:25:48.964034081 CEST	35264	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:25:48.984282017 CEST	53	35264	8.8.8.8	192.168.2.13
Aug 26, 2023 23:25:51.375328064 CEST	46127	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:25:51.396090984 CEST	53	46127	8.8.8.8	192.168.2.13
Aug 26, 2023 23:25:54.789179087 CEST	46367	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:25:54.803881884 CEST	53	46367	8.8.8.8	192.168.2.13
Aug 26, 2023 23:25:59.196250916 CEST	38961	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:25:59.211312056 CEST	53	38961	8.8.8.8	192.168.2.13
Aug 26, 2023 23:26:03.602859974 CEST	34587	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:26:03.639374018 CEST	53	34587	8.8.8.8	192.168.2.13
Aug 26, 2023 23:26:08.030915976 CEST	35563	53	192.168.2.13	8.8.8.8
Aug 26, 2023 23:26:08.045567989 CEST	53	35563	8.8.8.8	192.168.2.13

Start time:	23:24:04
Start date:	26/08/2023
Path:	/tmp/cundi.mips.elf
Arguments:	/tmp/cundi.mips.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report cundi.mips.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00OmKy (deleted)

/tmp/qemu-open.01C7ew (deleted)

/tmp/qemu-open.0BFnmv (deleted)

/tmp/qemu-open.0DBxtw (deleted)

/tmp/qemu-open.0Ncjaw (deleted)

/tmp/qemu-open.0OCKGx (deleted)

/tmp/qemu-open.0PCJCx (deleted)

/tmp/qemu-open.0RiSNv (deleted)

/tmp/qemu-open.0Ywj2v (deleted)

/tmp/qemu-open.0Zg77y (deleted)

/tmp/qemu-open.0bYhdy (deleted)

/tmp/qemu-open.0cgCOv (deleted)

/tmp/qemu-open.0d4fbx (deleted)

/tmp/qemu-open.0dUnTx (deleted)

/tmp/qemu-open.0dXivw (deleted)

/tmp/qemu-open.0fyySy (deleted)

/tmp/qemu-open.0gJF0y (deleted)

/tmp/qemu-open.0i3SFw (deleted)

/tmp/qemu-open.0mioJu (deleted)

/tmp/qemu-open.0qOIOv (deleted)

/tmp/qemu-open.0wNJ4w (deleted)

/tmp/qemu-open.0wVy8x (deleted)

/tmp/qemu-open.0xvl2x (deleted)

/tmp/qemu-open.13qGpw (deleted)

/tmp/qemu-open.14F13y (deleted)

/tmp/qemu-open.1A262u (deleted)

/tmp/qemu-open.1F1fAy (deleted)

/tmp/qemu-open.1FMTwv (deleted)

/tmp/qemu-open.1G62tv (deleted)

/tmp/qemu-open.1PfaIv (deleted)

Linux Analysis Report
cundi.mips.elf

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre