Edit tour

Linux Analysis Report
q5ZB59lfi7.elf

Overview

General Information

Sample Name:	q5ZB59lfi7.elf
Original Sample Name:	da6057ae8fdf58118890a8b62ce34a3f.elf
Analysis ID:	1352225
MD5:	da6057ae8fdf58118890a8b62ce34a3f
SHA1:	034873c1a7ab4a42a70baa4a826ccb376bfe6bb7
SHA256:	6f7d9f8a6b2fa1a8a9d77d6672db0707de11cdd4a6f3983031189c79c894eb39
Tags:	32elfmiraipowerpc
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Detected Mirai

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Connects to many ports of the same IP (likely port scanning)

Yara signature match

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Found strings indicative of a multi-platform dropper

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1352225
Start date and time:	2023-12-02 20:39:15 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	q5ZB59lfi7.elf renamed because original name is a hash value
Original Sample Name:	da6057ae8fdf58118890a8b62ce34a3f.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/1025@20/0

Runtime Messages

Command:	/tmp/q5ZB59lfi7.elf
PID:	6228
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

q5ZB59lfi7.elf (PID: 6228, Parent: 6145, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/q5ZB59lfi7.elf

q5ZB59lfi7.elf New Fork (PID: 6231, Parent: 6228)

q5ZB59lfi7.elf New Fork (PID: 6233, Parent: 6231)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
q5ZB59lfi7.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
q5ZB59lfi7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1910c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1915c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1924c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1929c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6228.1.00007f7970001000.00007f797001d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6228.1.00007f7970001000.00007f797001d000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1910c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1915c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1924c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19260:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19274:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19288:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1929c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: q5ZB59lfi7.elf PID: 6228	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: q5ZB59lfi7.elf PID: 6228	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x92b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9303:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9317:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x932b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x933f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9353:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9367:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x937b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x938f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x93a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x93b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x93cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x93df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x93f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9407:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x941b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x942f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9443:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538990439572030490 12/02/23-20:40:39.473227
SID:	2030490
Source Port:	38990
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538980439572030490 12/02/23-20:40:18.107876
SID:	2030490
Source Port:	38980
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538992439572030490 12/02/23-20:40:49.945912
SID:	2030490
Source Port:	38992
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539006439572030490 12/02/23-20:41:36.259362
SID:	2030490
Source Port:	39006
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538994439572030490 12/02/23-20:40:59.415900
SID:	2030490
Source Port:	38994
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538982439572030490 12/02/23-20:40:19.580611
SID:	2030490
Source Port:	38982
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538984439572030490 12/02/23-20:40:26.050007
SID:	2030490
Source Port:	38984
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539000439572030490 12/02/23-20:41:19.835949
SID:	2030490
Source Port:	39000
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539008439572030490 12/02/23-20:41:44.732271
SID:	2030490
Source Port:	39008
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538976439572030490 12/02/23-20:40:00.168500
SID:	2030490
Source Port:	38976
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539010439572030490 12/02/23-20:41:51.206832
SID:	2030490
Source Port:	39010
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538998439572030490 12/02/23-20:41:14.363094
SID:	2030490
Source Port:	38998
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538986439572030490 12/02/23-20:40:27.524665
SID:	2030490
Source Port:	38986
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538988439572030490 12/02/23-20:40:37.001142
SID:	2030490
Source Port:	38988
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538978439572030490 12/02/23-20:40:08.637327
SID:	2030490
Source Port:	38978
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539012439572030490 12/02/23-20:41:58.680470
SID:	2030490
Source Port:	39012
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538996439572030490 12/02/23-20:41:07.888193
SID:	2030490
Source Port:	38996
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539002439572030490 12/02/23-20:41:26.307653
SID:	2030490
Source Port:	39002
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539014439572030490 12/02/23-20:42:05.154936
SID:	2030490
Source Port:	39014
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539004439572030490 12/02/23-20:41:32.782157
SID:	2030490
Source Port:	39004
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: q5ZB59lfi7.elf	ReversingLabs: Detection: 54%
Source: q5ZB59lfi7.elf	Virustotal: Detection: 50%			Perma Link

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38976 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38978 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38980 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38982 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38984 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38986 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38988 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38990 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38992 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38994 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38996 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38998 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39000 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39002 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39004 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39006 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39008 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39010 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39012 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39014 -> 45.142.182.95:43957

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43

Source: q5ZB59lfi7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6228.1.00007f7970001000.00007f797001d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: q5ZB59lfi7.elf PID: 6228, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/q5ZB59lfi7.elf (PID: 6233)	File opened: /proc/141/cmdline	Jump to behavior

Source: q5ZB59lfi7.elf, 6228.1.000055c712264000.000055c712314000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: q5ZB59lfi7.elf, 6228.1.000055c712264000.000055c712314000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: q5ZB59lfi7.elf, 6228.1.00007ffd36962000.00007ffd36983000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: q5ZB59lfi7.elf, 6228.1.00007ffd36962000.00007ffd36983000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/q5ZB59lfi7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/q5ZB59lfi7.elf

Source: Yara match	File source: q5ZB59lfi7.elf, type: SAMPLE
Source: Yara match	File source: 6228.1.00007f7970001000.00007f797001d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: q5ZB59lfi7.elf PID: 6228, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Scripting	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	2 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names

Source	Detection	Scanner	Label	Link
q5ZB59lfi7.elf	54%	ReversingLabs	Linux.Trojan.Mirai
q5ZB59lfi7.elf	50%	Virustotal		Browse
q5ZB59lfi7.elf	100%	Avira	EXP/ELF.Mirai.Gen.Z.A

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
45.142.182.95	botnet.shoprbx.com	Germany	207959	XSSERVERNL	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
109.202.202.202	bot.x86.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai	Browse
	xaarch64.elf	Get hash	malicious	Unknown	Browse
	eIsiU6BbPe.elf	Get hash	malicious	Mirai	Browse
	tvOnVQPlql.elf	Get hash	malicious	Mirai	Browse
	gjh7N6186u.elf	Get hash	malicious	Mirai	Browse
	arm7-20231201-1833.elf	Get hash	malicious	Unknown	Browse
	tgLEk39U	Get hash	malicious	Unknown	Browse
	rPmpxBOqv6.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	ZlokKccCkK.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	oLiCZWdCxX.elf	Get hash	malicious	Unknown	Browse
	hAr9ItLrN3.elf	Get hash	malicious	Unknown	Browse
	bot.arm.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai	Browse
	kinsing_aarch64.elf	Get hash	malicious	Kinsing	Browse
	http://45.95.146.26/g/x86	Get hash	malicious	Unknown	Browse
	my_miner_test	Get hash	malicious	Xmrig	Browse
	3bEvPJYNHw.elf	Get hash	malicious	Mirai	Browse
45.142.182.95	bot.arm.elf	Get hash	malicious	Mirai	Browse
	bot.mips.elf	Get hash	malicious	Mirai	Browse
	bot.x86.elf	Get hash	malicious	Mirai	Browse
	bot.x86_64.elf	Get hash	malicious	Mirai	Browse
	bot.arm7.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai	Browse
	bot.mpsl.elf	Get hash	malicious	Mirai	Browse
91.189.91.43	bot.x86.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai	Browse
	xaarch64.elf	Get hash	malicious	Unknown	Browse
	eIsiU6BbPe.elf	Get hash	malicious	Mirai	Browse
	tvOnVQPlql.elf	Get hash	malicious	Mirai	Browse
	gjh7N6186u.elf	Get hash	malicious	Mirai	Browse
	arm7-20231201-1833.elf	Get hash	malicious	Unknown	Browse
	tgLEk39U	Get hash	malicious	Unknown	Browse
	rPmpxBOqv6.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	ZlokKccCkK.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	oLiCZWdCxX.elf	Get hash	malicious	Unknown	Browse
	hAr9ItLrN3.elf	Get hash	malicious	Unknown	Browse
	bot.arm.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai	Browse
	kinsing_aarch64.elf	Get hash	malicious	Kinsing	Browse
	http://45.95.146.26/g/x86	Get hash	malicious	Unknown	Browse
	my_miner_test	Get hash	malicious	Xmrig	Browse
	3bEvPJYNHw.elf	Get hash	malicious	Mirai	Browse

Process:	/tmp/q5ZB59lfi7.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.921928094887362
Encrypted:	false
SSDEEP:	3:TghJJDCln:TghJNCl
MD5:	704C7B914419900EC9AEB7D2B43E8CEA
SHA1:	466CED964F53A97B70210FCC5496D757E76E9107
SHA-256:	EB373600887E76FA5E3B953C5289848EFB38AD875B4C54B5D452FDF54536A49F
SHA-512:	05C4AFC4C03A885A988EF7609D5D6F788F29B0D00E40638BFE8B0296FDF9B6B8A32226668C8FC3A4501F242CA41EC5A1A43265789908B8D34CE252E9BFAFCB46
Malicious:	false
Reputation:	low
Preview:	/tmp/q5ZB59lfi7.elf.

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.610258761258143
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	q5ZB59lfi7.elf
File size:	132'344 bytes
MD5:	da6057ae8fdf58118890a8b62ce34a3f
SHA1:	034873c1a7ab4a42a70baa4a826ccb376bfe6bb7
SHA256:	6f7d9f8a6b2fa1a8a9d77d6672db0707de11cdd4a6f3983031189c79c894eb39
SHA512:	474a345fc2aa77b8972c1d9b75e12d7e77aae9fd01a40bfd4cf8f99690c104fccbd9c89a1da4d6bf3e1aa71e1660205eaefd1ea76ea49d6e4cf7f42aaa70b450
SSDEEP:	1536:a0nwryWv6n/qZIRzSH98z+xpnvTnNoIRF9Ugg97PMXgvAtId0DD2h/qvI8kpd/zY:BWv6/zy8z+x57ndngpPMVtUpdbyX
TLSH:	4ED32A06B30C0A47D2632EF43A3F67D093EF9AC121E4F640356FAA899172E365585EDD
File Content Preview:	.ELF...........................4.........4. ...(......................................................IH............dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.............../...@..\?........+../...A..$8...})......N..

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	131864
Section Header Size:	40
Number of Section Headers:	12
Header String Table Index:	11

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0x18f58	0x0	0x6	AX	4
.fini	PROGBITS	0x10019010	0x19010	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x10019030	0x19030	0x2950	0x0	0x2	A	8
.ctors	PROGBITS	0x1002b984	0x1b984	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x1002b990	0x1b990	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x1002b9a0	0x1b9a0	0x48a0	0x0	0x3	WA	32
.sdata	PROGBITS	0x10030240	0x20240	0x8c	0x0	0x3	WA	4
.sbss	NOBITS	0x100302cc	0x202cc	0x108	0x0	0x3	WA	4
.bss	NOBITS	0x100303d8	0x202cc	0x45b0	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x202cc	0x4b	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x1b980	0x1b980	6.1840	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1b984	0x1002b984	0x1002b984	0x4948	0x9004	0.4502	0x6	RW	0x10000	.ctors .dtors .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report q5ZB59lfi7.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.06Fz6w (deleted)

/tmp/qemu-open.0CkwTv (deleted)

/tmp/qemu-open.0Cy9Nt (deleted)

/tmp/qemu-open.0EF63x (deleted)

/tmp/qemu-open.0HtCTx (deleted)

/tmp/qemu-open.0IOjow (deleted)

/tmp/qemu-open.0S08vx (deleted)

/tmp/qemu-open.0gLVNx (deleted)

/tmp/qemu-open.0npyqu (deleted)

/tmp/qemu-open.0oh6nw (deleted)

/tmp/qemu-open.0qc0Zt (deleted)

/tmp/qemu-open.0uvyjv (deleted)

/tmp/qemu-open.0wPyjv (deleted)

/tmp/qemu-open.0xXbru (deleted)

/tmp/qemu-open.13xTrv (deleted)

/tmp/qemu-open.14XuPw (deleted)

/tmp/qemu-open.15ZKMw (deleted)

/tmp/qemu-open.15lGgx (deleted)

/tmp/qemu-open.1DvWIx (deleted)

/tmp/qemu-open.1FSPqu (deleted)

/tmp/qemu-open.1GNKyv (deleted)

/tmp/qemu-open.1HYk8u (deleted)

/tmp/qemu-open.1KxSZx (deleted)

/tmp/qemu-open.1MDzex (deleted)

/tmp/qemu-open.1Vq8sw (deleted)

/tmp/qemu-open.1bhGdw (deleted)

/tmp/qemu-open.1gxyCx (deleted)

/tmp/qemu-open.1mshst (deleted)

/tmp/qemu-open.1t7gAv (deleted)

/tmp/qemu-open.1vOcHv (deleted)

Linux Analysis Report
q5ZB59lfi7.elf

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2023 20:39:59.976699114 CET	38976	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:00.026978016 CET	43928	443	192.168.2.23	91.189.91.42
Dec 2, 2023 20:40:00.164283991 CET	43957	38976	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:00.164513111 CET	38976	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:00.168499947 CET	38976	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:00.352291107 CET	43957	38976	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:00.353898048 CET	38976	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:00.356024027 CET	43957	38976	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:00.541388035 CET	43957	38976	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:05.402184963 CET	42836	443	192.168.2.23	91.189.91.43
Dec 2, 2023 20:40:06.170062065 CET	42516	80	192.168.2.23	109.202.202.202
Dec 2, 2023 20:40:08.454164028 CET	38978	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:08.637160063 CET	43957	38978	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:08.637326956 CET	38978	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:08.637326956 CET	38978	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:08.820552111 CET	43957	38978	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:08.820624113 CET	43957	38978	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:17.922161102 CET	38980	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:18.107722044 CET	43957	38980	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:18.107800961 CET	38980	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:18.107876062 CET	38980	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:18.293504000 CET	43957	38980	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:18.293545008 CET	43957	38980	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:19.392959118 CET	38982	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:19.580396891 CET	43957	38982	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:19.580610037 CET	38982	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:19.580610991 CET	38982	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:19.768060923 CET	43957	38982	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:19.768080950 CET	43957	38982	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:19.768286943 CET	38982	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:19.955899000 CET	43957	38982	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:21.015997887 CET	43928	443	192.168.2.23	91.189.91.42
Dec 2, 2023 20:40:25.866877079 CET	38984	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:26.049786091 CET	43957	38984	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:26.050007105 CET	38984	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:26.050007105 CET	38984	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:26.232810974 CET	43957	38984	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:26.232884884 CET	43957	38984	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:26.233033895 CET	38984	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:26.415877104 CET	43957	38984	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:27.336926937 CET	38986	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:27.524524927 CET	43957	38986	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:27.524621010 CET	38986	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:27.524665117 CET	38986	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:27.712161064 CET	43957	38986	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:27.712239981 CET	43957	38986	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:27.712377071 CET	38986	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:27.899970055 CET	43957	38986	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:31.254318953 CET	42836	443	192.168.2.23	91.189.91.43
Dec 2, 2023 20:40:36.814918041 CET	38988	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:37.000838041 CET	43957	38988	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:37.001017094 CET	38988	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:37.001142025 CET	38988	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:37.187251091 CET	43957	38988	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:37.187280893 CET	43957	38988	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:37.187403917 CET	38988	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:37.373286009 CET	43957	38988	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:37.397382975 CET	42516	80	192.168.2.23	109.202.202.202
Dec 2, 2023 20:40:39.287451982 CET	38990	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:39.473011017 CET	43957	38990	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:39.473135948 CET	38990	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:39.473227024 CET	38990	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:39.658881903 CET	43957	38990	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:39.658917904 CET	43957	38990	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:49.759614944 CET	38992	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:49.945677042 CET	43957	38992	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:49.945827961 CET	38992	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:49.945911884 CET	38992	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:50.131767035 CET	43957	38992	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:50.131795883 CET	43957	38992	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:50.131993055 CET	38992	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:50.318001986 CET	43957	38992	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:59.230010033 CET	38994	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:59.415720940 CET	43957	38994	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:59.415834904 CET	38994	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:59.415899992 CET	38994	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:59.601454973 CET	43957	38994	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:59.601561069 CET	43957	38994	45.142.182.95	192.168.2.23
Dec 2, 2023 20:40:59.601706982 CET	38994	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:40:59.787197113 CET	43957	38994	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:01.969729900 CET	43928	443	192.168.2.23	91.189.91.42
Dec 2, 2023 20:41:07.700171947 CET	38996	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:07.887996912 CET	43957	38996	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:07.888115883 CET	38996	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:07.888192892 CET	38996	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:08.076122046 CET	43957	38996	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:08.076142073 CET	43957	38996	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:08.076309919 CET	38996	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:08.263747931 CET	43957	38996	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:14.174706936 CET	38998	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:14.362893105 CET	43957	38998	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:14.363012075 CET	38998	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:14.363094091 CET	38998	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:14.550920963 CET	43957	38998	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:14.550973892 CET	43957	38998	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:14.551101923 CET	38998	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:14.738986015 CET	43957	38998	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:19.649894953 CET	39000	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:19.835711956 CET	43957	39000	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:19.835819960 CET	39000	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:19.835948944 CET	39000	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:20.021455050 CET	43957	39000	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:20.021627903 CET	43957	39000	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:20.021770000 CET	39000	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:20.207571030 CET	43957	39000	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:22.446639061 CET	42836	443	192.168.2.23	91.189.91.43
Dec 2, 2023 20:41:26.121767044 CET	39002	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:26.307446957 CET	43957	39002	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:26.307576895 CET	39002	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:26.307652950 CET	39002	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:26.493319988 CET	43957	39002	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:26.493347883 CET	43957	39002	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:26.493499041 CET	39002	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:26.679167986 CET	43957	39002	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:32.592365980 CET	39004	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:32.781956911 CET	43957	39004	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:32.782083035 CET	39004	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:32.782156944 CET	39004	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:32.971543074 CET	43957	39004	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:32.971681118 CET	43957	39004	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:32.971798897 CET	39004	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:33.161442995 CET	43957	39004	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:36.071331978 CET	39006	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:36.259012938 CET	43957	39006	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:36.259166002 CET	39006	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:36.259361982 CET	39006	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:36.446832895 CET	43957	39006	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:36.446863890 CET	43957	39006	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:44.544855118 CET	39008	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:44.731997013 CET	43957	39008	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:44.732158899 CET	39008	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:44.732270956 CET	39008	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:44.919368982 CET	43957	39008	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:44.919570923 CET	43957	39008	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:44.919637918 CET	39008	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:45.106884956 CET	43957	39008	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:51.020905018 CET	39010	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:51.206615925 CET	43957	39010	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:51.206754923 CET	39010	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:51.206831932 CET	39010	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:51.392600060 CET	43957	39010	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:51.392620087 CET	43957	39010	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:51.392851114 CET	39010	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:51.578537941 CET	43957	39010	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:58.492312908 CET	39012	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:58.680234909 CET	43957	39012	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:58.680385113 CET	39012	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:58.680469990 CET	39012	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:41:58.868549109 CET	43957	39012	45.142.182.95	192.168.2.23
Dec 2, 2023 20:41:58.868679047 CET	43957	39012	45.142.182.95	192.168.2.23
Dec 2, 2023 20:42:04.966825962 CET	39014	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:42:05.154740095 CET	43957	39014	45.142.182.95	192.168.2.23
Dec 2, 2023 20:42:05.154881001 CET	39014	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:42:05.154936075 CET	39014	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:42:05.342809916 CET	43957	39014	45.142.182.95	192.168.2.23
Dec 2, 2023 20:42:05.342866898 CET	43957	39014	45.142.182.95	192.168.2.23
Dec 2, 2023 20:42:05.342968941 CET	39014	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:42:05.531075954 CET	43957	39014	45.142.182.95	192.168.2.23

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2023 20:39:59.874063015 CET	47666	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:39:59.975745916 CET	53	47666	8.8.8.8	192.168.2.23
Dec 2, 2023 20:40:08.352240086 CET	45835	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:40:08.454026937 CET	53	45835	8.8.8.8	192.168.2.23
Dec 2, 2023 20:40:17.819523096 CET	38780	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:40:17.922044039 CET	53	38780	8.8.8.8	192.168.2.23
Dec 2, 2023 20:40:19.293641090 CET	51042	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:40:19.392802954 CET	53	51042	8.8.8.8	192.168.2.23
Dec 2, 2023 20:40:25.767621994 CET	52709	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:40:25.866708040 CET	53	52709	8.8.8.8	192.168.2.23
Dec 2, 2023 20:40:27.233033895 CET	35859	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:40:27.336746931 CET	53	35859	8.8.8.8	192.168.2.23
Dec 2, 2023 20:40:36.711283922 CET	47538	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:40:36.814743042 CET	53	47538	8.8.8.8	192.168.2.23
Dec 2, 2023 20:40:39.187550068 CET	33652	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:40:39.287086010 CET	53	33652	8.8.8.8	192.168.2.23
Dec 2, 2023 20:40:49.657833099 CET	51812	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:40:49.759412050 CET	53	51812	8.8.8.8	192.168.2.23
Dec 2, 2023 20:40:59.131083965 CET	38629	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:40:59.229733944 CET	53	38629	8.8.8.8	192.168.2.23
Dec 2, 2023 20:41:07.600677013 CET	53608	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:41:07.700012922 CET	53	53608	8.8.8.8	192.168.2.23
Dec 2, 2023 20:41:14.075742006 CET	59960	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:41:14.174503088 CET	53	59960	8.8.8.8	192.168.2.23
Dec 2, 2023 20:41:19.550647020 CET	39983	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:41:19.649691105 CET	53	39983	8.8.8.8	192.168.2.23
Dec 2, 2023 20:41:26.021270037 CET	47900	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:41:26.121376991 CET	53	47900	8.8.8.8	192.168.2.23
Dec 2, 2023 20:41:32.492916107 CET	59242	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:41:32.592174053 CET	53	59242	8.8.8.8	192.168.2.23
Dec 2, 2023 20:41:35.971803904 CET	40269	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:41:36.071125031 CET	53	40269	8.8.8.8	192.168.2.23
Dec 2, 2023 20:41:44.446048021 CET	46417	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:41:44.544661999 CET	53	46417	8.8.8.8	192.168.2.23
Dec 2, 2023 20:41:50.918906927 CET	42175	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:41:51.020672083 CET	53	42175	8.8.8.8	192.168.2.23
Dec 2, 2023 20:41:58.392061949 CET	45889	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:41:58.492125034 CET	53	45889	8.8.8.8	192.168.2.23
Dec 2, 2023 20:42:04.868083954 CET	60301	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:42:04.966615915 CET	53	60301	8.8.8.8	192.168.2.23

Start time (UTC):	19:39:59
Start date (UTC):	02/12/2023
Path:	/tmp/q5ZB59lfi7.elf
Arguments:	/tmp/q5ZB59lfi7.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre