Edit tour

Linux Analysis Report
j0lGr8krMR.elf

Overview

General Information

Sample Name:	j0lGr8krMR.elf
Original Sample Name:	ac4401b81abe2ff869adb33d3eba6129.elf
Analysis ID:	1352230
MD5:	ac4401b81abe2ff869adb33d3eba6129
SHA1:	cadfae1d275b185cfce011271788defb25944f76
SHA256:	64fa6a096369897ae7d0dbc0986f44d31889ba93db84a3a7092f0000dda881f7
Tags:	32elfmirairenesas
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Detected Mirai

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Connects to many ports of the same IP (likely port scanning)

Yara signature match

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Found strings indicative of a multi-platform dropper

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1352230
Start date and time:	2023-12-02 20:46:12 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	j0lGr8krMR.elf renamed because original name is a hash value
Original Sample Name:	ac4401b81abe2ff869adb33d3eba6129.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/1025@20/0

Runtime Messages

Command:	/tmp/j0lGr8krMR.elf
PID:	6205
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

j0lGr8krMR.elf (PID: 6205, Parent: 6124, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/j0lGr8krMR.elf

j0lGr8krMR.elf New Fork (PID: 6207, Parent: 6205)

j0lGr8krMR.elf New Fork (PID: 6209, Parent: 6207)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
j0lGr8krMR.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
j0lGr8krMR.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x154a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1552c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1557c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1561c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6205.1.00007fa23c400000.00007fa23c418000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6205.1.00007fa23c400000.00007fa23c418000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x154a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1552c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15540:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15554:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15568:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1557c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15590:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15608:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1561c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15630:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: j0lGr8krMR.elf PID: 6205	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: j0lGr8krMR.elf PID: 6205	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1707:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1743:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1757:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x176b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x177f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1793:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x180b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x181f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1833:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538990439572030490 12/02/23-20:47:38.592826
SID:	2030490
Source Port:	38990
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538980439572030490 12/02/23-20:47:08.229628
SID:	2030490
Source Port:	38980
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538992439572030490 12/02/23-20:47:45.068599
SID:	2030490
Source Port:	38992
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539006439572030490 12/02/23-20:48:28.386421
SID:	2030490
Source Port:	39006
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538994439572030490 12/02/23-20:47:47.539876
SID:	2030490
Source Port:	38994
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538982439572030490 12/02/23-20:47:12.707004
SID:	2030490
Source Port:	38982
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538984439572030490 12/02/23-20:47:21.180509
SID:	2030490
Source Port:	38984
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539000439572030490 12/02/23-20:48:05.965545
SID:	2030490
Source Port:	39000
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539008439572030490 12/02/23-20:48:31.864822
SID:	2030490
Source Port:	39008
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538976439572030490 12/02/23-20:46:55.289019
SID:	2030490
Source Port:	38976
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539010439572030490 12/02/23-20:48:40.343132
SID:	2030490
Source Port:	39010
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538998439572030490 12/02/23-20:47:58.494074
SID:	2030490
Source Port:	38998
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538986439572030490 12/02/23-20:47:26.649912
SID:	2030490
Source Port:	38986
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538988439572030490 12/02/23-20:47:32.122592
SID:	2030490
Source Port:	38988
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538978439572030490 12/02/23-20:47:00.758008
SID:	2030490
Source Port:	38978
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539012439572030490 12/02/23-20:48:43.827820
SID:	2030490
Source Port:	39012
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9538996439572030490 12/02/23-20:47:54.011353
SID:	2030490
Source Port:	38996
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539002439572030490 12/02/23-20:48:13.435286
SID:	2030490
Source Port:	39002
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539014439572030490 12/02/23-20:48:53.301910
SID:	2030490
Source Port:	39014
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.23 - Destination IP: 45.142.182.95

Timestamp:	192.168.2.2345.142.182.9539004439572030490 12/02/23-20:48:17.910173
SID:	2030490
Source Port:	39004
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Source: j0lGr8krMR.elf	ReversingLabs: Detection: 64%
Source: j0lGr8krMR.elf	Virustotal: Detection: 66%			Perma Link

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38976 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38978 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38980 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38982 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38984 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38986 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38988 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38990 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38992 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38994 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38996 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:38998 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39000 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39002 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39004 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39006 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39008 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39010 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39012 -> 45.142.182.95:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:39014 -> 45.142.182.95:43957

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43

Source: j0lGr8krMR.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6205.1.00007fa23c400000.00007fa23c418000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: j0lGr8krMR.elf PID: 6205, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/6146/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/j0lGr8krMR.elf (PID: 6209)	File opened: /proc/141/cmdline	Jump to behavior

Source: j0lGr8krMR.elf, 6205.1.00007ffd112f9000.00007ffd1131a000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/j0lGr8krMR.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/j0lGr8krMR.elf
Source: j0lGr8krMR.elf, 6205.1.00007ffd112f9000.00007ffd1131a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: j0lGr8krMR.elf, 6205.1.000055ab9bf72000.000055ab9bfd5000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: j0lGr8krMR.elf, 6205.1.000055ab9bf72000.000055ab9bfd5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Source: Yara match	File source: j0lGr8krMR.elf, type: SAMPLE
Source: Yara match	File source: 6205.1.00007fa23c400000.00007fa23c418000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: j0lGr8krMR.elf PID: 6205, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Scripting	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	2 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names

Source	Detection	Scanner	Label	Link
j0lGr8krMR.elf	65%	ReversingLabs	Linux.Trojan.Mirai
j0lGr8krMR.elf	66%	Virustotal		Browse
j0lGr8krMR.elf	100%	Avira	EXP/ELF.Mirai.Gen.Z.A

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
45.142.182.95	botnet.shoprbx.com	Germany	207959	XSSERVERNL	true
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
109.202.202.202	q5ZB59lfi7.elf	Get hash	malicious	Mirai	Browse
	bot.x86.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai	Browse
	xaarch64.elf	Get hash	malicious	Unknown	Browse
	eIsiU6BbPe.elf	Get hash	malicious	Mirai	Browse
	tvOnVQPlql.elf	Get hash	malicious	Mirai	Browse
	gjh7N6186u.elf	Get hash	malicious	Mirai	Browse
	arm7-20231201-1833.elf	Get hash	malicious	Unknown	Browse
	tgLEk39U	Get hash	malicious	Unknown	Browse
	rPmpxBOqv6.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	ZlokKccCkK.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	oLiCZWdCxX.elf	Get hash	malicious	Unknown	Browse
	hAr9ItLrN3.elf	Get hash	malicious	Unknown	Browse
	bot.arm.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai	Browse
	kinsing_aarch64.elf	Get hash	malicious	Kinsing	Browse
	http://45.95.146.26/g/x86	Get hash	malicious	Unknown	Browse
	my_miner_test	Get hash	malicious	Xmrig	Browse
45.142.182.95	q5ZB59lfi7.elf	Get hash	malicious	Mirai	Browse
	7AkLDoK9x7.elf	Get hash	malicious	Mirai	Browse
	bot.arm.elf	Get hash	malicious	Mirai	Browse
	bot.mips.elf	Get hash	malicious	Mirai	Browse
	bot.x86.elf	Get hash	malicious	Mirai	Browse
	bot.x86_64.elf	Get hash	malicious	Mirai	Browse
	bot.arm7.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai	Browse
	bot.mpsl.elf	Get hash	malicious	Mirai	Browse
91.189.91.43	q5ZB59lfi7.elf	Get hash	malicious	Mirai	Browse
	bot.x86.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai	Browse
	xaarch64.elf	Get hash	malicious	Unknown	Browse
	eIsiU6BbPe.elf	Get hash	malicious	Mirai	Browse
	tvOnVQPlql.elf	Get hash	malicious	Mirai	Browse
	gjh7N6186u.elf	Get hash	malicious	Mirai	Browse
	arm7-20231201-1833.elf	Get hash	malicious	Unknown	Browse
	tgLEk39U	Get hash	malicious	Unknown	Browse
	rPmpxBOqv6.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	ZlokKccCkK.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	oLiCZWdCxX.elf	Get hash	malicious	Unknown	Browse
	hAr9ItLrN3.elf	Get hash	malicious	Unknown	Browse
	bot.arm.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai	Browse
	kinsing_aarch64.elf	Get hash	malicious	Kinsing	Browse
	http://45.95.146.26/g/x86	Get hash	malicious	Unknown	Browse
	my_miner_test	Get hash	malicious	Xmrig	Browse
91.189.91.42	q5ZB59lfi7.elf	Get hash	malicious	Mirai	Browse
	bot.x86.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai	Browse
	xaarch64.elf	Get hash	malicious	Unknown	Browse
	eIsiU6BbPe.elf	Get hash	malicious	Mirai	Browse
	tvOnVQPlql.elf	Get hash	malicious	Mirai	Browse
	gjh7N6186u.elf	Get hash	malicious	Mirai	Browse
	arm7-20231201-1833.elf	Get hash	malicious	Unknown	Browse
	tgLEk39U	Get hash	malicious	Unknown	Browse
	rPmpxBOqv6.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	ZlokKccCkK.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	oLiCZWdCxX.elf	Get hash	malicious	Unknown	Browse
	hAr9ItLrN3.elf	Get hash	malicious	Unknown	Browse
	bot.arm.elf	Get hash	malicious	Mirai	Browse
	bot.arm5.elf	Get hash	malicious	Mirai	Browse
	kinsing_aarch64.elf	Get hash	malicious	Kinsing	Browse
	http://45.95.146.26/g/x86	Get hash	malicious	Unknown	Browse
	my_miner_test	Get hash	malicious	Xmrig	Browse

Process:	/tmp/j0lGr8krMR.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887362
Encrypted:	false
SSDEEP:	3:TgtsXde3:Tgm83
MD5:	6910BE2554B40F7BE0D6BD82D8CFEF2C
SHA1:	9AC339F8740D4DA2C3125CFA922186B5FB0E9010
SHA-256:	1C1DBA84D12A38957F60C14C0BD2AD30D24A0F5F3ED9700608496235A3E62F57
SHA-512:	E7FEAC32967675C1AAE42B9D398E334E1FD56A288BDAA0CE3F63C90B5CA21BB047669DC88D51724917888241A25FEA84F59433DC8D5BC4E7F4408E77538A7D3E
Malicious:	false
Reputation:	low
Preview:	/tmp/j0lGr8krMR.elf.

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.18294324543859
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	j0lGr8krMR.elf
File size:	117'568 bytes
MD5:	ac4401b81abe2ff869adb33d3eba6129
SHA1:	cadfae1d275b185cfce011271788defb25944f76
SHA256:	64fa6a096369897ae7d0dbc0986f44d31889ba93db84a3a7092f0000dda881f7
SHA512:	cc6079f9d2d704b7bdde42577af971e4bf7b64d880dd3c1e6fcbf47d6d40d5604efde1c43590d406b7f523aab5d0cdbd51cb6cefb3d4f78d4ef7e29f833793ac
SSDEEP:	1536:2aVTHW/qIAmPq9MHFGEWCRPKBKFnLblvCifzQVW9kXxeUwr/zp:2qWLS9MlDWMSBOlvC2sWqXxQrbp
TLSH:	71B34A77C8296FA8C259D5B4B0B09F792B63A58182471FBE54B2C3B64083DCDF505BB8
File Content Preview:	.ELF.....................@.4...........4. ...(...............@...@..{...{....................B...B.DI..............Q.td............................././"O.n........#.@........#.*@.R...o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	117128
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x152c0	0x0	0x6	AX	32
.fini	PROGBITS	0x4153a0	0x153a0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x4153c4	0x153c4	0x2838	0x0	0x2	A	4
.ctors	PROGBITS	0x428000	0x18000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x42800c	0x1800c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x428020	0x18020	0x4910	0x0	0x3	WA	32
.got	PROGBITS	0x42c930	0x1c930	0x14	0x4	0x3	WA	4
.bss	NOBITS	0x42c944	0x1c944	0x46bc	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1c944	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x17bfc	0x17bfc	6.9035	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x18000	0x428000	0x428000	0x4944	0x9000	0.4110	0x6	RW	0x10000	.ctors .dtors .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report j0lGr8krMR.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.06sHaF (deleted)

/tmp/qemu-open.0De1oF (deleted)

/tmp/qemu-open.0L4PtH (deleted)

/tmp/qemu-open.0k987E (deleted)

/tmp/qemu-open.0lRMrJ (deleted)

/tmp/qemu-open.0mXoaG (deleted)

/tmp/qemu-open.0nLyVF (deleted)

/tmp/qemu-open.0niAEI (deleted)

/tmp/qemu-open.0tQlHH (deleted)

/tmp/qemu-open.0ymqxH (deleted)

/tmp/qemu-open.10BfhI (deleted)

/tmp/qemu-open.14A4jF (deleted)

/tmp/qemu-open.14ot7F (deleted)

/tmp/qemu-open.1EMeBF (deleted)

/tmp/qemu-open.1NCGbJ (deleted)

/tmp/qemu-open.1WSvVH (deleted)

/tmp/qemu-open.1XB8fG (deleted)

/tmp/qemu-open.1ZmSEF (deleted)

/tmp/qemu-open.1dU7MF (deleted)

/tmp/qemu-open.1joRoG (deleted)

/tmp/qemu-open.1xgg4G (deleted)

/tmp/qemu-open.1xwY1G (deleted)

/tmp/qemu-open.1ytx2H (deleted)

/tmp/qemu-open.22NzmH (deleted)

/tmp/qemu-open.24QuiH (deleted)

/tmp/qemu-open.24rl3F (deleted)

/tmp/qemu-open.26ovHF (deleted)

/tmp/qemu-open.27C64F (deleted)

/tmp/qemu-open.2BaL5E (deleted)

/tmp/qemu-open.2DeeQF (deleted)

Linux Analysis Report
j0lGr8krMR.elf

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2023 20:46:55.101311922 CET	38976	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:46:55.205249071 CET	43928	443	192.168.2.23	91.189.91.42
Dec 2, 2023 20:46:55.288714886 CET	43957	38976	45.142.182.95	192.168.2.23
Dec 2, 2023 20:46:55.288779020 CET	38976	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:46:55.289019108 CET	38976	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:46:55.476260900 CET	43957	38976	45.142.182.95	192.168.2.23
Dec 2, 2023 20:46:55.476402998 CET	43957	38976	45.142.182.95	192.168.2.23
Dec 2, 2023 20:46:55.476619959 CET	38976	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:46:55.664031029 CET	43957	38976	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:00.575041056 CET	38978	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:00.757877111 CET	43957	38978	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:00.758008003 CET	38978	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:00.758008003 CET	38978	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:00.836512089 CET	42836	443	192.168.2.23	91.189.91.43
Dec 2, 2023 20:47:00.940691948 CET	43957	38978	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:00.940798998 CET	43957	38978	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:00.944657087 CET	38978	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:01.129007101 CET	43957	38978	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:01.860311985 CET	42516	80	192.168.2.23	109.202.202.202
Dec 2, 2023 20:47:08.043842077 CET	38980	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:08.229262114 CET	43957	38980	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:08.229439020 CET	38980	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:08.229628086 CET	38980	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:08.414916039 CET	43957	38980	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:08.414963961 CET	43957	38980	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:12.519131899 CET	38982	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:12.706789970 CET	43957	38982	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:12.706873894 CET	38982	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:12.707004070 CET	38982	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:12.894200087 CET	43957	38982	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:12.894408941 CET	43957	38982	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:16.450097084 CET	43928	443	192.168.2.23	91.189.91.42
Dec 2, 2023 20:47:20.997397900 CET	38984	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:21.180269957 CET	43957	38984	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:21.180411100 CET	38984	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:21.180509090 CET	38984	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:21.363169909 CET	43957	38984	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:21.363356113 CET	43957	38984	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:21.363477945 CET	38984	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:21.546241045 CET	43957	38984	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:26.462213993 CET	38986	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:26.649728060 CET	43957	38986	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:26.649837971 CET	38986	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:26.649912119 CET	38986	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:26.688601971 CET	42836	443	192.168.2.23	91.189.91.43
Dec 2, 2023 20:47:26.837385893 CET	43957	38986	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:26.837559938 CET	43957	38986	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:26.837687969 CET	38986	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:27.025312901 CET	43957	38986	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:31.936700106 CET	38988	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:32.122366905 CET	43957	38988	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:32.122575045 CET	38988	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:32.122591972 CET	38988	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:32.308212996 CET	43957	38988	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:32.308331966 CET	43957	38988	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:32.308549881 CET	38988	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:32.494128942 CET	43957	38988	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:32.831748962 CET	42516	80	192.168.2.23	109.202.202.202
Dec 2, 2023 20:47:38.407085896 CET	38990	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:38.592534065 CET	43957	38990	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:38.592825890 CET	38990	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:38.592825890 CET	38990	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:38.778307915 CET	43957	38990	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:38.778381109 CET	43957	38990	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:38.778546095 CET	38990	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:38.964068890 CET	43957	38990	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:44.882749081 CET	38992	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:45.068394899 CET	43957	38992	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:45.068540096 CET	38992	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:45.068598986 CET	38992	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:45.254174948 CET	43957	38992	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:45.254292965 CET	43957	38992	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:45.254430056 CET	38992	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:45.440095901 CET	43957	38992	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:47.353899002 CET	38994	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:47.539675951 CET	43957	38994	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:47.539788008 CET	38994	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:47.539875984 CET	38994	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:47.725239038 CET	43957	38994	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:47.725534916 CET	43957	38994	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:47.725681067 CET	38994	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:47.911132097 CET	43957	38994	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:53.823676109 CET	38996	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:54.011157990 CET	43957	38996	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:54.011290073 CET	38996	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:54.011353016 CET	38996	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:54.198833942 CET	43957	38996	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:54.198973894 CET	43957	38996	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:57.404131889 CET	43928	443	192.168.2.23	91.189.91.42
Dec 2, 2023 20:47:58.306263924 CET	38998	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:58.493904114 CET	43957	38998	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:58.494028091 CET	38998	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:58.494074106 CET	38998	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:58.681718111 CET	43957	38998	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:58.681822062 CET	43957	38998	45.142.182.95	192.168.2.23
Dec 2, 2023 20:47:58.681996107 CET	38998	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:47:58.869606972 CET	43957	38998	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:05.779752016 CET	39000	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:05.965347052 CET	43957	39000	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:05.965544939 CET	39000	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:05.965544939 CET	39000	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:06.151124001 CET	43957	39000	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:06.151354074 CET	43957	39000	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:06.151449919 CET	39000	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:06.336981058 CET	43957	39000	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:13.249490023 CET	39002	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:13.434974909 CET	43957	39002	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:13.435226917 CET	39002	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:13.435286045 CET	39002	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:13.620786905 CET	43957	39002	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:13.620902061 CET	43957	39002	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:13.621016979 CET	39002	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:13.806802034 CET	43957	39002	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:17.720493078 CET	39004	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:17.881098986 CET	42836	443	192.168.2.23	91.189.91.43
Dec 2, 2023 20:48:17.909873962 CET	43957	39004	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:17.910059929 CET	39004	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:17.910172939 CET	39004	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:18.099379063 CET	43957	39004	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:18.099463940 CET	43957	39004	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:18.099714994 CET	39004	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:18.289170980 CET	43957	39004	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:28.198545933 CET	39006	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:28.386095047 CET	43957	39006	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:28.386420012 CET	39006	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:28.386420965 CET	39006	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:28.573860884 CET	43957	39006	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:28.573995113 CET	43957	39006	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:28.574198008 CET	39006	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:28.762613058 CET	43957	39006	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:31.677483082 CET	39008	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:31.864569902 CET	43957	39008	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:31.864821911 CET	39008	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:31.864821911 CET	39008	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:32.052050114 CET	43957	39008	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:32.052067041 CET	43957	39008	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:32.052231073 CET	39008	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:32.239197016 CET	43957	39008	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:40.157167912 CET	39010	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:40.342876911 CET	43957	39010	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:40.343082905 CET	39010	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:40.343132019 CET	39010	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:40.528877974 CET	43957	39010	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:40.528902054 CET	43957	39010	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:40.529158115 CET	39010	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:40.715018034 CET	43957	39010	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:43.634219885 CET	39012	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:43.827637911 CET	43957	39012	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:43.827769995 CET	39012	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:43.827820063 CET	39012	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:44.015413046 CET	43957	39012	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:44.015440941 CET	43957	39012	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:44.015558958 CET	39012	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:44.203486919 CET	43957	39012	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:53.113807917 CET	39014	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:53.301668882 CET	43957	39014	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:53.301804066 CET	39014	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:53.301909924 CET	39014	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:53.490187883 CET	43957	39014	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:53.490243912 CET	43957	39014	45.142.182.95	192.168.2.23
Dec 2, 2023 20:48:53.490396023 CET	39014	43957	192.168.2.23	45.142.182.95
Dec 2, 2023 20:48:53.678241968 CET	43957	39014	45.142.182.95	192.168.2.23

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2023 20:46:54.998908997 CET	41142	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:46:55.100861073 CET	53	41142	8.8.8.8	192.168.2.23
Dec 2, 2023 20:47:00.476429939 CET	52001	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:47:00.574903011 CET	53	52001	8.8.8.8	192.168.2.23
Dec 2, 2023 20:47:07.940176964 CET	48332	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:47:08.043461084 CET	53	48332	8.8.8.8	192.168.2.23
Dec 2, 2023 20:47:12.414964914 CET	36128	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:47:12.518831015 CET	53	36128	8.8.8.8	192.168.2.23
Dec 2, 2023 20:47:20.893590927 CET	46577	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:47:20.997009039 CET	53	46577	8.8.8.8	192.168.2.23
Dec 2, 2023 20:47:26.363022089 CET	48966	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:47:26.461898088 CET	53	48966	8.8.8.8	192.168.2.23
Dec 2, 2023 20:47:31.837312937 CET	39540	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:47:31.936368942 CET	53	39540	8.8.8.8	192.168.2.23
Dec 2, 2023 20:47:38.307898045 CET	59307	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:47:38.406765938 CET	53	59307	8.8.8.8	192.168.2.23
Dec 2, 2023 20:47:44.777863026 CET	55009	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:47:44.882535934 CET	53	55009	8.8.8.8	192.168.2.23
Dec 2, 2023 20:47:47.254342079 CET	36813	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:47:47.353657007 CET	53	36813	8.8.8.8	192.168.2.23
Dec 2, 2023 20:47:53.725111008 CET	54354	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:47:53.823463917 CET	53	54354	8.8.8.8	192.168.2.23
Dec 2, 2023 20:47:58.198735952 CET	34099	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:47:58.306088924 CET	53	34099	8.8.8.8	192.168.2.23
Dec 2, 2023 20:48:05.681063890 CET	40916	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:48:05.779530048 CET	53	40916	8.8.8.8	192.168.2.23
Dec 2, 2023 20:48:13.150693893 CET	55579	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:48:13.249102116 CET	53	55579	8.8.8.8	192.168.2.23
Dec 2, 2023 20:48:17.620806932 CET	58401	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:48:17.720221996 CET	53	58401	8.8.8.8	192.168.2.23
Dec 2, 2023 20:48:28.098582983 CET	53366	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:48:28.197904110 CET	53	53366	8.8.8.8	192.168.2.23
Dec 2, 2023 20:48:31.573924065 CET	50353	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:48:31.677275896 CET	53	50353	8.8.8.8	192.168.2.23
Dec 2, 2023 20:48:40.051282883 CET	57657	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:48:40.156951904 CET	53	57657	8.8.8.8	192.168.2.23
Dec 2, 2023 20:48:43.528928041 CET	39892	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:48:43.634047031 CET	53	39892	8.8.8.8	192.168.2.23
Dec 2, 2023 20:48:53.014457941 CET	47380	53	192.168.2.23	8.8.8.8
Dec 2, 2023 20:48:53.113275051 CET	53	47380	8.8.8.8	192.168.2.23

Start time (UTC):	19:46:53
Start date (UTC):	02/12/2023
Path:	/tmp/j0lGr8krMR.elf
Arguments:	/tmp/j0lGr8krMR.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	19:46:54
Start date (UTC):	02/12/2023
Path:	/tmp/j0lGr8krMR.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre