Edit tour

Linux Analysis Report
bot.arm.elf

Overview

General Information

Sample Name:	bot.arm.elf
Analysis ID:	1352211
MD5:	94a71ac5e9de72dce88c016a6b81e6fd
SHA1:	5035532bb64c9aadb592a7caee135bd65d17c074
SHA256:	8f9c61ceeb82d905af63ca98edef36ee91c021402ebbd62e95a73e66a21afadd
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Detected Mirai

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Connects to many ports of the same IP (likely port scanning)

Yara signature match

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Found strings indicative of a multi-platform dropper

Enumerates processes within the "proc" file system

Detected TCP or UDP traffic on non-standard ports

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1352211
Start date and time:	2023-12-02 19:45:16 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	bot.arm.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/1025@19/0

Runtime Messages

Command:	/tmp/bot.arm.elf
PID:	5507
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

bot.arm.elf (PID: 5507, Parent: 5433, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/bot.arm.elf

bot.arm.elf New Fork (PID: 5509, Parent: 5507)

bot.arm.elf New Fork (PID: 5511, Parent: 5509)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
bot.arm.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
bot.arm.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x18ec4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ed8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18eec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1902c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5507.1.00007f6cbc017000.00007f6cbc033000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5507.1.00007f6cbc017000.00007f6cbc033000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x18ec4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ed8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18eec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1902c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: bot.arm.elf PID: 5507	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: bot.arm.elf PID: 5507	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x38d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3911:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3925:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3939:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x394d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3961:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3975:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3989:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x399d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x39ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534964439572030490 12/02/23-19:45:58.134821
SID:	2030490
Source Port:	34964
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534996439572030490 12/02/23-19:47:40.728680
SID:	2030490
Source Port:	34996
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534986439572030490 12/02/23-19:47:10.359975
SID:	2030490
Source Port:	34986
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534966439572030490 12/02/23-19:46:08.607333
SID:	2030490
Source Port:	34966
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534984439572030490 12/02/23-19:47:01.887711
SID:	2030490
Source Port:	34984
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534988439572030490 12/02/23-19:47:20.832145
SID:	2030490
Source Port:	34988
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534974439572030490 12/02/23-19:46:32.510263
SID:	2030490
Source Port:	34974
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534968439572030490 12/02/23-19:46:17.081612
SID:	2030490
Source Port:	34968
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534992439572030490 12/02/23-19:47:30.780292
SID:	2030490
Source Port:	34992
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534978439572030490 12/02/23-19:46:43.461913
SID:	2030490
Source Port:	34978
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534982439572030490 12/02/23-19:46:56.412395
SID:	2030490
Source Port:	34982
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534994439572030490 12/02/23-19:47:35.253834
SID:	2030490
Source Port:	34994
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9535000439572030490 12/02/23-19:47:57.675432
SID:	2030490
Source Port:	35000
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534972439572030490 12/02/23-19:46:30.035059
SID:	2030490
Source Port:	34972
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534980439572030490 12/02/23-19:46:45.937906
SID:	2030490
Source Port:	34980
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534970439572030490 12/02/23-19:46:27.559587
SID:	2030490
Source Port:	34970
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534990439572030490 12/02/23-19:47:22.309213
SID:	2030490
Source Port:	34990
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534998439572030490 12/02/23-19:47:51.206422
SID:	2030490
Source Port:	34998
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.1545.142.182.9534976439572030490 12/02/23-19:46:36.984700
SID:	2030490
Source Port:	34976
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: bot.arm.elf	ReversingLabs: Detection: 67%
Source: bot.arm.elf	Virustotal: Detection: 51%			Perma Link

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34964 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34966 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34968 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34970 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34972 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34974 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34976 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34978 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34980 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34982 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34984 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34986 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34988 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34990 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34992 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34994 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34996 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:34998 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:35000 -> 45.142.182.95:43957

Source: bot.arm.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5507.1.00007f6cbc017000.00007f6cbc033000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: bot.arm.elf PID: 5507, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/3883/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/bot.arm.elf (PID: 5511)	File opened: /proc/270/cmdline	Jump to behavior

Source: bot.arm.elf, 5507.1.00007ffdb4c05000.00007ffdb4c26000.rw-.sdmp	Binary or memory string: `x86_64/usr/bin/qemu-arm/tmp/bot.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/bot.arm.elf
Source: bot.arm.elf, 5507.1.000055a50bb3e000.000055a50bc6c000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: bot.arm.elf, 5507.1.000055a50bb3e000.000055a50bc6c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: bot.arm.elf, 5507.1.00007ffdb4c05000.00007ffdb4c26000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Yara match	File source: bot.arm.elf, type: SAMPLE
Source: Yara match	File source: 5507.1.00007f6cbc017000.00007f6cbc033000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bot.arm.elf PID: 5507, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Scripting	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses

Source	Detection	Scanner	Label	Link
bot.arm.elf	68%	ReversingLabs	Linux.Trojan.Mirai
bot.arm.elf	52%	Virustotal		Browse
bot.arm.elf	100%	Avira	EXP/ELF.Mirai.Gen.Z.A

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
45.142.182.95	bot.x86_64.elf	Get hash	malicious	Mirai	Browse
	bot.arm7.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai	Browse
	bot.mpsl.elf	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
botnet.shoprbx.com	bot.x86_64.elf	Get hash	malicious	Mirai	Browse	45.142.182.95
	bot.arm7.elf	Get hash	malicious	Mirai	Browse	45.142.182.95
	bot.arm5.elf	Get hash	malicious	Mirai	Browse	45.142.182.95
	bot.mpsl.elf	Get hash	malicious	Mirai	Browse	45.142.182.95
	6tD7vXVSda.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	gsFxMe3HhC.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	bApst4aAEZ.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.mips.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.mpsl.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.x86.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.x86_64.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.arm7.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.arm.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	top1hbt.arm5.elf	Get hash	malicious	Mirai	Browse	91.92.244.70
	4dxWfgCK6v.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.mpsl.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.x86.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.arm7.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.arm.elf	Get hash	malicious	Mirai	Browse	194.180.49.237
	top1hbt.arm5.elf	Get hash	malicious	Mirai	Browse	194.180.49.237

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
XSSERVERNL	bot.x86.elf	Get hash	malicious	Mirai	Browse	45.142.182.95
	bot.x86_64.elf	Get hash	malicious	Mirai	Browse	45.142.182.95
	bot.arm7.elf	Get hash	malicious	Mirai	Browse	45.142.182.95
	bot.arm5.elf	Get hash	malicious	Mirai	Browse	45.142.182.95
	bot.mpsl.elf	Get hash	malicious	Mirai	Browse	45.142.182.95
	I3jWg7oPwM.exe	Get hash	malicious	Xmrig	Browse	45.142.182.146
	file.exe	Get hash	malicious	Unknown	Browse	45.142.182.146
	http://www.ttin1.blogspot.hu	Get hash	malicious	Unknown	Browse	195.62.46.135
	http://www.jjiklo9988.blogspot.fi	Get hash	malicious	Unknown	Browse	195.62.46.135
	mipsel-20221002-2102.elf	Get hash	malicious	Moobot	Browse	45.142.182.116
	x86_64-20221002-2102.elf	Get hash	malicious	Moobot	Browse	45.142.182.116
	mips-20221002-2102.elf	Get hash	malicious	Moobot	Browse	45.142.182.116
	i686-20221002-2102.elf	Get hash	malicious	Moobot	Browse	45.142.182.116
	arm6-20221002-2102.elf	Get hash	malicious	Mirai, Moobot	Browse	45.142.182.116
	arm7-20221002-2102.elf	Get hash	malicious	Mirai, Moobot	Browse	45.142.182.116
	arm-20221002-2102.elf	Get hash	malicious	Moobot	Browse	45.142.182.116
	x86	Get hash	malicious	Mirai	Browse	195.62.33.226
	59716B314BA0D53B7E8DE32A73AF01B7B383834BF038C.exe	Get hash	malicious	RedLine Socelars	Browse	45.142.182.152
	FE3AE99417E0D632995AD5CEECCC4C0B308B8A30D2C93.exe	Get hash	malicious	Nitol RedLine SmokeLoader Socelars Vidar	Browse	45.142.182.152
	lr11Y0eF0m.exe	Get hash	malicious	Metasploit Raccoon RedLine Socelars Vidar	Browse	45.142.182.152

Process:	/tmp/bot.arm.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.6168746059562227
Encrypted:	false
SSDEEP:	3:Tgu0J5:TgpJ5
MD5:	C56BF9C8364E2613C06382F290DC4D92
SHA1:	D659F6ECF8BD53F2FA657667D98CCFB47C450DB8
SHA-256:	847403AF7A6B9BC316FBD8D72041A495C845A220ADD8A5AE72B656EB63574E9A
SHA-512:	EADF54158F0632AED5C358B3AB37FCC1FB0301B919B4A69183268AA0858990A3F13596EC9433BB55056FAE02839D253C9DE9957A7F0B0A85980EEF94B8F437BB
Malicious:	false
Reputation:	low
Preview:	/tmp/bot.arm.elf.

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.463532647320175
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	bot.arm.elf
File size:	133'888 bytes
MD5:	94a71ac5e9de72dce88c016a6b81e6fd
SHA1:	5035532bb64c9aadb592a7caee135bd65d17c074
SHA256:	8f9c61ceeb82d905af63ca98edef36ee91c021402ebbd62e95a73e66a21afadd
SHA512:	e8a739fe8cd5592b786d2fa4947486b04f8630c79b230c14a34dde3a63f69f8668834fdd57ecc8e0cf6f5873b63cf842af22b384577a3003be07a9a0ead25579
SSDEEP:	3072:gHZ+X7AouxFOV48wlP1z0RraPuk8d+Ow9L3sibY:gHZcARAV48MP1zuQ9Lsis
TLSH:	D3D3F845FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0D36A42
File Content Preview:	.ELF...a..........(.........4...p.......4. ...(.....................P...P...........................0I..............Q.td..................................-...L."...;c..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	133488
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x18d24	0x0	0x6	AX	16
.fini	PROGBITS	0x20dd4	0x18dd4	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x20de8	0x18de8	0x2868	0x0	0x2	A	4
.ctors	PROGBITS	0x2c000	0x1c000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x2c00c	0x1c00c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2c020	0x1c020	0x4910	0x0	0x3	WA	32
.bss	NOBITS	0x30930	0x20930	0x46bc	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x20930	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1b650	0x1b650	6.0616	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x1c000	0x2c000	0x2c000	0x4930	0x8fec	0.3972	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2023 19:45:57.948132992 CET	34964	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:45:58.134450912 CET	43957	34964	45.142.182.95	192.168.2.15
Dec 2, 2023 19:45:58.134541988 CET	34964	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:45:58.134820938 CET	34964	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:45:58.321696043 CET	43957	34964	45.142.182.95	192.168.2.15
Dec 2, 2023 19:45:58.321708918 CET	43957	34964	45.142.182.95	192.168.2.15
Dec 2, 2023 19:45:58.321975946 CET	34964	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:45:58.510179043 CET	43957	34964	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:08.421125889 CET	34966	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:08.607152939 CET	43957	34966	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:08.607244968 CET	34966	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:08.607332945 CET	34966	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:08.793040991 CET	43957	34966	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:08.793189049 CET	43957	34966	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:08.793298006 CET	34966	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:08.979007959 CET	43957	34966	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:16.892092943 CET	34968	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:17.081398010 CET	43957	34968	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:17.081496954 CET	34968	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:17.081612110 CET	34968	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:17.270880938 CET	43957	34968	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:17.271018028 CET	43957	34968	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:17.271188021 CET	34968	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:17.460633039 CET	43957	34968	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:27.371165037 CET	34970	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:27.559278965 CET	43957	34970	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:27.559442997 CET	34970	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:27.559587002 CET	34970	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:27.747173071 CET	43957	34970	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:27.747236013 CET	43957	34970	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:27.747466087 CET	34970	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:27.936288118 CET	43957	34970	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:29.847120047 CET	34972	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:30.034799099 CET	43957	34972	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:30.034972906 CET	34972	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:30.035058975 CET	34972	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:30.222481012 CET	43957	34972	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:30.222552061 CET	43957	34972	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:30.222661018 CET	34972	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:30.410229921 CET	43957	34972	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:32.322232962 CET	34974	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:32.509947062 CET	43957	34974	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:32.510147095 CET	34974	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:32.510262966 CET	34974	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:32.697649956 CET	43957	34974	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:32.697684050 CET	43957	34974	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:32.697819948 CET	34974	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:32.885550022 CET	43957	34974	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:36.796552896 CET	34976	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:36.984519958 CET	43957	34976	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:36.984638929 CET	34976	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:36.984699965 CET	34976	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:37.172410011 CET	43957	34976	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:37.172488928 CET	43957	34976	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:37.172631979 CET	34976	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:37.361474037 CET	43957	34976	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:43.272670984 CET	34978	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:43.461642981 CET	43957	34978	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:43.461776972 CET	34978	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:43.461913109 CET	34978	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:43.649328947 CET	43957	34978	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:43.649398088 CET	43957	34978	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:43.649523973 CET	34978	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:43.836746931 CET	43957	34978	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:45.749722004 CET	34980	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:45.937602997 CET	43957	34980	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:45.937768936 CET	34980	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:45.937906027 CET	34980	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:46.125447989 CET	43957	34980	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:46.125624895 CET	43957	34980	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:46.125787973 CET	34980	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:46.313749075 CET	43957	34980	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:56.224551916 CET	34982	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:56.412132025 CET	43957	34982	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:56.412306070 CET	34982	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:56.412395000 CET	34982	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:46:56.599963903 CET	43957	34982	45.142.182.95	192.168.2.15
Dec 2, 2023 19:46:56.600017071 CET	43957	34982	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:01.699259996 CET	34984	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:01.887504101 CET	43957	34984	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:01.887635946 CET	34984	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:01.887711048 CET	34984	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:02.075798035 CET	43957	34984	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:02.075944901 CET	43957	34984	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:02.076256990 CET	34984	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:02.264616013 CET	43957	34984	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:10.175128937 CET	34986	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:10.359786034 CET	43957	34986	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:10.359975100 CET	34986	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:10.359975100 CET	34986	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:10.545208931 CET	43957	34986	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:10.545363903 CET	43957	34986	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:10.545475960 CET	34986	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:10.729960918 CET	43957	34986	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:20.644258976 CET	34988	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:20.831809044 CET	43957	34988	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:20.832060099 CET	34988	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:20.832144976 CET	34988	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:21.019691944 CET	43957	34988	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:21.019783020 CET	43957	34988	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:21.019922018 CET	34988	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:21.207401037 CET	43957	34988	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:22.122191906 CET	34990	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:22.309073925 CET	43957	34990	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:22.309211969 CET	34990	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:22.309212923 CET	34990	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:22.495049953 CET	43957	34990	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:22.495100975 CET	43957	34990	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:22.495206118 CET	34990	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:22.681411982 CET	43957	34990	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:30.594029903 CET	34992	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:30.780049086 CET	43957	34992	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:30.780236006 CET	34992	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:30.780292034 CET	34992	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:30.966145039 CET	43957	34992	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:30.966284990 CET	43957	34992	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:30.966404915 CET	34992	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:31.152218103 CET	43957	34992	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:35.067917109 CET	34994	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:35.253598928 CET	43957	34994	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:35.253761053 CET	34994	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:35.253834009 CET	34994	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:35.439438105 CET	43957	34994	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:35.439481974 CET	43957	34994	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:40.539124966 CET	34996	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:40.728514910 CET	43957	34996	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:40.728627920 CET	34996	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:40.728679895 CET	34996	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:40.921369076 CET	43957	34996	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:40.921395063 CET	43957	34996	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:40.921523094 CET	34996	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:41.114116907 CET	43957	34996	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:51.021006107 CET	34998	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:51.206162930 CET	43957	34998	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:51.206326008 CET	34998	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:51.206422091 CET	34998	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:51.392121077 CET	43957	34998	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:51.392291069 CET	43957	34998	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:51.392575979 CET	34998	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:51.577277899 CET	43957	34998	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:57.492275953 CET	35000	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:57.675147057 CET	43957	35000	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:57.675321102 CET	35000	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:57.675431967 CET	35000	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:57.858117104 CET	43957	35000	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:57.858194113 CET	43957	35000	45.142.182.95	192.168.2.15
Dec 2, 2023 19:47:57.858334064 CET	35000	43957	192.168.2.15	45.142.182.95
Dec 2, 2023 19:47:58.041608095 CET	43957	35000	45.142.182.95	192.168.2.15

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2023 19:45:57.848994017 CET	42399	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:45:57.947578907 CET	53	42399	8.8.8.8	192.168.2.15
Dec 2, 2023 19:46:08.322314978 CET	40901	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:46:08.420958996 CET	53	40901	8.8.8.8	192.168.2.15
Dec 2, 2023 19:46:16.793276072 CET	42335	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:46:16.891807079 CET	53	42335	8.8.8.8	192.168.2.15
Dec 2, 2023 19:46:27.271315098 CET	60571	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:46:27.370814085 CET	53	60571	8.8.8.8	192.168.2.15
Dec 2, 2023 19:46:29.747714996 CET	47564	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:46:29.846915960 CET	53	47564	8.8.8.8	192.168.2.15
Dec 2, 2023 19:46:32.222915888 CET	60845	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:46:32.321820021 CET	53	60845	8.8.8.8	192.168.2.15
Dec 2, 2023 19:46:36.697917938 CET	55082	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:46:36.796369076 CET	53	55082	8.8.8.8	192.168.2.15
Dec 2, 2023 19:46:43.172890902 CET	44636	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:46:43.272253990 CET	53	44636	8.8.8.8	192.168.2.15
Dec 2, 2023 19:46:45.649741888 CET	60343	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:46:45.749517918 CET	53	60343	8.8.8.8	192.168.2.15
Dec 2, 2023 19:46:56.125783920 CET	45548	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:46:56.224402905 CET	53	45548	8.8.8.8	192.168.2.15
Dec 2, 2023 19:47:01.600270987 CET	51674	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:47:01.699075937 CET	53	51674	8.8.8.8	192.168.2.15
Dec 2, 2023 19:47:10.076323986 CET	58360	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:47:10.174875975 CET	53	58360	8.8.8.8	192.168.2.15
Dec 2, 2023 19:47:20.545433044 CET	44485	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:47:20.644112110 CET	53	44485	8.8.8.8	192.168.2.15
Dec 2, 2023 19:47:22.020150900 CET	36976	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:47:22.122019053 CET	53	36976	8.8.8.8	192.168.2.15
Dec 2, 2023 19:47:30.495274067 CET	39949	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:47:30.593861103 CET	53	39949	8.8.8.8	192.168.2.15
Dec 2, 2023 19:47:34.966566086 CET	36132	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:47:35.067673922 CET	53	36132	8.8.8.8	192.168.2.15
Dec 2, 2023 19:47:40.439718962 CET	33730	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:47:40.538976908 CET	53	33730	8.8.8.8	192.168.2.15
Dec 2, 2023 19:47:50.921683073 CET	46173	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:47:51.020812988 CET	53	46173	8.8.8.8	192.168.2.15
Dec 2, 2023 19:47:57.392735958 CET	58021	53	192.168.2.15	8.8.8.8
Dec 2, 2023 19:47:57.491971970 CET	53	58021	8.8.8.8	192.168.2.15

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report bot.arm.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0153GV (deleted)

/tmp/qemu-open.05CgWW (deleted)

/tmp/qemu-open.084kTV (deleted)

/tmp/qemu-open.09AHLV (deleted)

/tmp/qemu-open.0GkjmT (deleted)

/tmp/qemu-open.0I16UW (deleted)

/tmp/qemu-open.0IJIYW (deleted)

/tmp/qemu-open.0JVxTV (deleted)

/tmp/qemu-open.0Jb8TV (deleted)

/tmp/qemu-open.0QC1MT (deleted)

/tmp/qemu-open.0XsphW (deleted)

/tmp/qemu-open.0YpGhV (deleted)

/tmp/qemu-open.0k3P0V (deleted)

/tmp/qemu-open.0lLEDT (deleted)

/tmp/qemu-open.0meNeT (deleted)

/tmp/qemu-open.0ontEW (deleted)

/tmp/qemu-open.0rV4VT (deleted)

/tmp/qemu-open.0t1ISS (deleted)

/tmp/qemu-open.0tPCYW (deleted)

/tmp/qemu-open.0z0aiT (deleted)

/tmp/qemu-open.10lDxT (deleted)

/tmp/qemu-open.12FHoV (deleted)

/tmp/qemu-open.1HisKU (deleted)

/tmp/qemu-open.1Jh9hW (deleted)

/tmp/qemu-open.1KyqKT (deleted)

/tmp/qemu-open.1PTuMV (deleted)

/tmp/qemu-open.1dSwbT (deleted)

/tmp/qemu-open.1dXPWW (deleted)

Linux Analysis Report
bot.arm.elf

Start time (UTC):	18:45:57
Start date (UTC):	02/12/2023
Path:	/tmp/bot.arm.elf
Arguments:	/tmp/bot.arm.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre