Linux Analysis Report
z8lHAECIcU.elf

Overview

General Information

Sample name: z8lHAECIcU.elf
renamed because original name is a hash value
Original sample name: b70c1e3b204c6b5b706f49347cb1f35a.elf
Analysis ID: 1383029
MD5: b70c1e3b204c6b5b706f49347cb1f35a
SHA1: 3a05449966842a616b2903d7e405528ec64b4e19
SHA256: 7829c72ee62b574dbba327de3a60b4063b31851c858327b1eeb05a9740e30456
Tags: 32elfmiraipowerpc
Infos:

Detection

Mirai
Score: 96
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Detected Mirai
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Mirai
Sample is packed with UPX
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: z8lHAECIcU.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: z8lHAECIcU.elf ReversingLabs: Detection: 55%

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.13:56244 -> 186.39.129.4:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.13:36480 -> 201.176.27.87:23
Source: Traffic Snort IDS: 2023443 ET TROJAN Possible Linux.Mirai Login Attempt (klv123) 192.168.2.14:39762 -> 187.168.4.70:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.14:38860 -> 178.163.132.143:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.14:49802 -> 37.98.227.163:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.14:47532 -> 171.34.207.12:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.14:40538 -> 121.120.101.1:23
Source: Traffic Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.14:40526 -> 89.213.31.121:23
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37696
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37702
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37706
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37710
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37714
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37718
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37722
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37726
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37728
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37730
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60010
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60014
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60020
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60028
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60032
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60040
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60044
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60050
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60056
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60060
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38214
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38220
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38226
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38232
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38234
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39752
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38242
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39764
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38250
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38254
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39768
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38258
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39776
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38268
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39786
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39788
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39798
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38274
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39808
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39814
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39826
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38294
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38320
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38340
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38362
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38372
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38378
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38394
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38408
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38424
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50592
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50602
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50606
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50610
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50616
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50618
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50620
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50624
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50628
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50628
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50634
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.14:54784 -> 195.144.21.204:1312
Sample listens on a socket
Source: /tmp/z8lHAECIcU.elf (PID: 5489) Socket: 0.0.0.0::0 Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) Socket: 0.0.0.0::0 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
Source: unknown TCP traffic detected without corresponding DNS query: 195.144.21.204
Source: unknown TCP traffic detected without corresponding DNS query: 45.118.56.52
Source: unknown TCP traffic detected without corresponding DNS query: 178.180.156.52
Source: unknown TCP traffic detected without corresponding DNS query: 27.181.65.55
Source: unknown TCP traffic detected without corresponding DNS query: 92.2.24.83
Source: unknown TCP traffic detected without corresponding DNS query: 192.191.33.52
Source: unknown TCP traffic detected without corresponding DNS query: 148.208.151.53
Source: unknown TCP traffic detected without corresponding DNS query: 171.146.117.249
Source: unknown TCP traffic detected without corresponding DNS query: 32.118.147.85
Source: unknown TCP traffic detected without corresponding DNS query: 60.140.51.254
Source: unknown TCP traffic detected without corresponding DNS query: 174.72.188.95
Source: unknown TCP traffic detected without corresponding DNS query: 173.50.141.201
Source: unknown TCP traffic detected without corresponding DNS query: 174.95.182.212
Source: unknown TCP traffic detected without corresponding DNS query: 253.58.112.162
Source: unknown TCP traffic detected without corresponding DNS query: 119.177.124.202
Source: unknown TCP traffic detected without corresponding DNS query: 78.49.95.199
Source: unknown TCP traffic detected without corresponding DNS query: 178.72.147.236
Source: unknown TCP traffic detected without corresponding DNS query: 85.24.155.199
Source: unknown TCP traffic detected without corresponding DNS query: 122.198.184.4
Source: unknown TCP traffic detected without corresponding DNS query: 63.211.67.102
Source: unknown TCP traffic detected without corresponding DNS query: 209.230.121.78
Source: unknown TCP traffic detected without corresponding DNS query: 217.152.204.56
Source: unknown TCP traffic detected without corresponding DNS query: 2.107.108.182
Source: unknown TCP traffic detected without corresponding DNS query: 8.139.132.199
Source: unknown TCP traffic detected without corresponding DNS query: 200.185.109.41
Source: unknown TCP traffic detected without corresponding DNS query: 64.54.105.217
Source: unknown TCP traffic detected without corresponding DNS query: 155.238.61.24
Source: unknown TCP traffic detected without corresponding DNS query: 27.3.133.215
Source: unknown TCP traffic detected without corresponding DNS query: 133.121.145.169
Source: unknown TCP traffic detected without corresponding DNS query: 105.76.38.182
Source: unknown TCP traffic detected without corresponding DNS query: 249.97.63.178
Source: unknown TCP traffic detected without corresponding DNS query: 42.119.68.5
Source: unknown TCP traffic detected without corresponding DNS query: 155.36.14.205
Source: unknown TCP traffic detected without corresponding DNS query: 81.247.122.34
Source: unknown TCP traffic detected without corresponding DNS query: 175.167.146.64
Source: unknown TCP traffic detected without corresponding DNS query: 174.170.107.88
Source: unknown TCP traffic detected without corresponding DNS query: 44.1.167.175
Source: unknown TCP traffic detected without corresponding DNS query: 2.101.172.115
Source: unknown TCP traffic detected without corresponding DNS query: 70.23.196.169
Source: unknown TCP traffic detected without corresponding DNS query: 102.233.134.232
Source: unknown TCP traffic detected without corresponding DNS query: 191.108.120.177
Source: unknown TCP traffic detected without corresponding DNS query: 102.4.43.45
Source: unknown TCP traffic detected without corresponding DNS query: 216.151.225.108
Source: unknown TCP traffic detected without corresponding DNS query: 67.15.96.98
Source: unknown TCP traffic detected without corresponding DNS query: 245.67.200.241
Source: unknown TCP traffic detected without corresponding DNS query: 190.39.232.135
Source: unknown TCP traffic detected without corresponding DNS query: 182.172.4.46
Source: unknown TCP traffic detected without corresponding DNS query: 104.165.116.111
Source: unknown TCP traffic detected without corresponding DNS query: 160.182.15.136
Source: unknown TCP traffic detected without corresponding DNS query: 115.3.66.55
Source: unknown DNS traffic detected: queries for: daisy.ubuntu.com
Source: z8lHAECIcU.elf String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5627.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5627.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5602.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5602.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5487.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5487.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5489.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5489.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5497.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5497.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5611.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5611.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5606.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5606.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5491.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5491.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: z8lHAECIcU.elf PID: 5487, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: z8lHAECIcU.elf PID: 5487, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: z8lHAECIcU.elf PID: 5489, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: z8lHAECIcU.elf PID: 5489, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: z8lHAECIcU.elf PID: 5497, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: z8lHAECIcU.elf PID: 5602, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: z8lHAECIcU.elf PID: 5602, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: z8lHAECIcU.elf PID: 5611, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: z8lHAECIcU.elf PID: 5611, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: z8lHAECIcU.elf PID: 5627, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: z8lHAECIcU.elf PID: 5627, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x100000
Sample tries to kill a process (SIGKILL)
Source: /tmp/z8lHAECIcU.elf (PID: 5489) SIGKILL sent: pid: 940, result: successful Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) SIGKILL sent: pid: 940, result: successful Jump to behavior
Yara signature match
Source: 5627.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5627.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5602.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5602.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5487.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5487.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5489.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5489.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5497.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5497.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5611.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5611.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5606.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5606.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5491.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5491.1.00007f7f8800b000.00007f7f88010000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: z8lHAECIcU.elf PID: 5487, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: z8lHAECIcU.elf PID: 5487, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: z8lHAECIcU.elf PID: 5489, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: z8lHAECIcU.elf PID: 5489, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: z8lHAECIcU.elf PID: 5497, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: z8lHAECIcU.elf PID: 5602, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: z8lHAECIcU.elf PID: 5602, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: z8lHAECIcU.elf PID: 5611, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: z8lHAECIcU.elf PID: 5611, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: z8lHAECIcU.elf PID: 5627, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: z8lHAECIcU.elf PID: 5627, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal96.troj.evad.linELF@0/0@2/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/490/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/791/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/794/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/795/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/797/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/853/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/917/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/780/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/1/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/661/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/782/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/785/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/940/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/767/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/800/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/888/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/801/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/725/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/769/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/726/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/803/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/806/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/807/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5495) File opened: /proc/928/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/490/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/791/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/794/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/795/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/797/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/853/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/917/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/780/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/1/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/661/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/782/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/785/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/940/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/767/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/800/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/888/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/801/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/725/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/769/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/726/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/803/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/806/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/807/fd Jump to behavior
Source: /tmp/z8lHAECIcU.elf (PID: 5489) File opened: /proc/928/fd Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37696
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37702
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37706
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37710
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37714
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37718
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37722
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37726
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37728
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 37730
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60010
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60014
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60020
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60028
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60032
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60040
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60044
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60050
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60056
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 60060
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38214
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38220
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38226
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38232
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38234
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39752
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38242
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39764
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38250
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38254
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39768
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38258
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39776
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38268
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39786
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39788
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39798
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38274
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39808
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39814
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 39826
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38294
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38320
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38340
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38362
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38372
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38378
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38394
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38408
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 38424
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50592
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50602
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50606
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50610
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50616
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50618
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50620
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50624
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50628
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50628
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 50634
ELF contains segments with high entropy indicating compressed/encrypted content
Source: z8lHAECIcU.elf Submission file: segment LOAD with 7.929 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/z8lHAECIcU.elf (PID: 5487) Queries kernel information via 'uname': Jump to behavior
Source: z8lHAECIcU.elf, 5487.1.0000560216b78000.0000560216c28000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: z8lHAECIcU.elf, 5489.1.0000560216b78000.0000560216c28000.rw-.sdmp, z8lHAECIcU.elf, 5606.1.0000560216b78000.0000560216c28000.rw-.sdmp, z8lHAECIcU.elf, 5627.1.0000560216b78000.0000560216c28000.rw-.sdmp, z8lHAECIcU.elf, 5611.1.0000560216b78000.0000560216c28000.rw-.sdmp, z8lHAECIcU.elf, 5491.1.0000560216b78000.0000560216c28000.rw-.sdmp, z8lHAECIcU.elf, 5602.1.0000560216b78000.0000560216c28000.rw-.sdmp, z8lHAECIcU.elf, 5497.1.0000560216b78000.0000560216c28000.rw-.sdmp Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: z8lHAECIcU.elf, 5487.1.0000560216b78000.0000560216c28000.rw-.sdmp, z8lHAECIcU.elf, 5489.1.0000560216b78000.0000560216c28000.rw-.sdmp, z8lHAECIcU.elf, 5606.1.0000560216b78000.0000560216c28000.rw-.sdmp, z8lHAECIcU.elf, 5627.1.0000560216b78000.0000560216c28000.rw-.sdmp, z8lHAECIcU.elf, 5611.1.0000560216b78000.0000560216c28000.rw-.sdmp, z8lHAECIcU.elf, 5491.1.0000560216b78000.0000560216c28000.rw-.sdmp, z8lHAECIcU.elf, 5602.1.0000560216b78000.0000560216c28000.rw-.sdmp, z8lHAECIcU.elf, 5497.1.0000560216b78000.0000560216c28000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/ppc
Source: z8lHAECIcU.elf, 5487.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5489.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5606.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5627.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5611.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5491.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5602.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5497.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-ppc
Source: z8lHAECIcU.elf, 5487.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5489.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5606.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5627.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5611.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5491.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5602.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp, z8lHAECIcU.elf, 5497.1.00007ffcc513b000.00007ffcc515c000.rw-.sdmp Binary or memory string: ix86_64/usr/bin/qemu-ppc/tmp/z8lHAECIcU.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/z8lHAECIcU.elf

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP

Remote Access Functionality
barindex
Detected Mirai
Source: Traffic Snort IDS: ET TROJAN Possible Linux.Mirai Login Attempt (klv123)
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
143.20.10.217
 unknown United States
264008 LANCAMANTOANISERVICOSDEINFORMATICALTDA-MEBR false
62.15.62.97
 unknown Spain
12479 UNI2-ASES false
14.116.8.18
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
182.248.9.31
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
139.176.199.183
 unknown China
8968 BT-ITALIAIT false
252.93.238.106
 unknown Reserved
unknown unknown false
5.5.54.254
 unknown Germany
6805 TDDE-ASN1DE false
146.207.94.223
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
48.41.224.232
 unknown United States
2686 ATGS-MMD-ASUS false
12.128.179.252
 unknown United States
7018 ATT-INTERNET4US false
134.245.99.183
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
158.30.183.12
 unknown United States
1504 DNIC-AS-01504US false
207.24.250.138
 unknown United States
701 UUNETUS false
159.192.195.151
 unknown Thailand
131090 CAT-IDC-4BYTENET-AS-APCATTELECOMPublicCompanyLtdCATT false
147.179.51.115
 unknown United States
12257 EMC-AS12257US false
194.110.153.106
 unknown Russian Federation
57364 KMARUDA-ASRU false
191.66.127.159
 unknown Colombia
26611 COMCELSACO false
114.3.173.36
 unknown Indonesia
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
154.210.135.128
 unknown Seychelles
136800 XIAOZHIYUN1-AS-APICIDCNETWORKUS false
126.13.86.249
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
48.105.48.124
 unknown United States
2686 ATGS-MMD-ASUS false
126.119.158.153
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
99.18.205.102
 unknown United States
7018 ATT-INTERNET4US false
1.135.197.42
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
113.54.159.212
 unknown China
24355 CNGI-CD-IX-AS-APCERNET2IXatUniversityofElectronicScie false
31.191.242.155
 unknown Italy
24608 WINDTRE-ASIT false
82.74.104.213
 unknown Netherlands
33915 TNF-ASNL false
172.96.116.60
 unknown United States
21859 ZNETUS false
158.99.140.158
 unknown Spain
766 REDIRISRedIRISAutonomousSystemES false
192.73.27.27
 unknown United States
1569 DNIC-ASBLK-01550-01601US false
101.68.105.103
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
253.3.96.45
 unknown Reserved
unknown unknown false
54.104.203.186
 unknown United States
16509 AMAZON-02US false
92.154.45.128
 unknown France
3215 FranceTelecom-OrangeFR false
121.98.36.77
 unknown New Zealand
9790 VOCUSGROUPNZVocusGroupNZ false
101.222.153.72
 unknown India
58519 CHINATELECOM-CTCLOUDCloudComputingCorporationCN false
169.9.204.236
 unknown United States
203 CENTURYLINK-LEGACY-LVLT-203US false
17.71.130.172
 unknown United States
714 APPLE-ENGINEERINGUS false
243.251.148.233
 unknown Reserved
unknown unknown false
179.59.217.116
 unknown Bolivia
28024 NuevatelPCSdeBoliviaSABO false
183.156.204.184
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
135.188.153.89
 unknown United States
14962 NCR-252US false
23.198.151.244
 unknown United States
16625 AKAMAI-ASUS false
205.190.14.132
 unknown United States
1239 SPRINTLINKUS false
68.114.229.58
 unknown United States
20115 CHARTER-20115US false
163.214.108.250
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
74.34.248.50
 unknown United States
7011 FRONTIER-AND-CITIZENSUS false
145.199.203.218
 unknown Netherlands
1101 IP-EEND-ASIP-EENDBVNL false
150.69.156.165
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
246.125.75.217
 unknown Reserved
unknown unknown false
169.82.172.59
 unknown United States
37611 AfrihostZA false
195.223.214.33
 unknown Italy
3269 ASN-IBSNAZIT false
70.13.65.109
 unknown United States
10507 SPCSUS false
9.87.14.68
 unknown United States
3356 LEVEL3US false
218.120.121.238
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
63.86.208.103
 unknown United States
701 UUNETUS false
9.3.186.54
 unknown United States
3356 LEVEL3US false
153.92.252.240
 unknown France
200484 SENDINBLUE-ASNFR false
182.235.249.50
 unknown Taiwan; Republic of China (ROC)
9416 MULTIMEDIA-AS-APHoshinMultimediaCenterIncTW false
31.92.237.234
 unknown United Kingdom
12576 EELtdGB false
187.146.129.146
 unknown Mexico
8151 UninetSAdeCVMX false
107.115.136.122
 unknown United States
7018 ATT-INTERNET4US false
218.218.215.102
 unknown Japan 4725 ODNSoftBankMobileCorpJP false
106.143.252.179
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
250.18.6.146
 unknown Reserved
unknown unknown false
8.228.87.35
 unknown United States
3356 LEVEL3US false
247.238.11.84
 unknown Reserved
unknown unknown false
208.147.74.180
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
243.167.131.128
 unknown Reserved
unknown unknown false
14.212.146.48
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
19.193.194.127
 unknown United States
3 MIT-GATEWAYSUS false
161.2.87.46
 unknown United Kingdom
15914 BritishAirwaysGB false
68.225.43.93
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
206.243.250.156
 unknown United States
3356 LEVEL3US false
58.217.149.0
 unknown China
134769 CHINANET-JIANGSU-CHANGZHOU-IDCChinaNetJiangsuChangzhouID false
99.35.249.6
 unknown United States
7018 ATT-INTERNET4US false
100.191.250.217
 unknown United States
21928 T-MOBILE-AS21928US false
169.81.123.251
 unknown United States
37611 AfrihostZA false
124.87.226.93
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
184.108.200.170
 unknown United States
7922 COMCAST-7922US false
184.119.120.53
 unknown United States
7922 COMCAST-7922US false
177.122.19.188
 unknown Brazil
26615 TIMSABR false
123.246.197.174
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
57.255.57.243
 unknown Belgium
2686 ATGS-MMD-ASUS false
60.3.74.81
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
9.170.63.8
 unknown United States
3356 LEVEL3US false
65.32.152.106
 unknown United States
33363 BHN-33363US false
178.130.18.68
 unknown Russian Federation
41691 SUMTEL-AS-RIPEMoscowRussiaRU false
152.72.236.20
 unknown United States
21558 SC-JOHNSONUS false
176.250.112.170
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
1.151.84.116
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
34.38.58.159
 unknown United States
2686 ATGS-MMD-ASUS false
121.61.138.101
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
218.52.94.110
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
54.24.234.54
 unknown United States
14618 AMAZON-AESUS false
250.122.249.195
 unknown Reserved
unknown unknown false
105.120.247.83
 unknown Nigeria
36873 VNL1-ASNG false
213.69.38.204
 unknown Germany
702 UUNETUS false
209.181.93.110
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
114.240.125.107
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.25 true