Edit tour

Linux Analysis Report
x86.elf

Overview

General Information

Sample name:	x86.elf
Analysis ID:	1400053
MD5:	b9bce82f41d06b11802c7d5140b75659
SHA1:	a6ca900230f584e8a60bc0db54dc2e75d6c6c1a5
SHA256:	1c3a7dab14418e44d59d87b8285491f0821fe01a6b24ce33a244998bd8a7a08f
Infos:

Detection

Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Machine Learning detection for sample

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1400053
Start date and time:	2024-02-28 07:08:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86.elf
Detection:	MAL
Classification:	mal84.troj.linELF@0/1@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/x86.elf
PID:	5479
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	SHORELINE BOTNET THA REAL SHIT NIGGA
Standard Error:

Process Tree

system is lnxubuntu20

x86.elf (PID: 5479, Parent: 5403, MD5: b9bce82f41d06b11802c7d5140b75659) Arguments: /tmp/x86.elf

x86.elf New Fork (PID: 5480, Parent: 5479)

x86.elf New Fork (PID: 5481, Parent: 5480)

x86.elf New Fork (PID: 5482, Parent: 5480)

x86.elf New Fork (PID: 5483, Parent: 5480)

dash New Fork (PID: 5524, Parent: 3633)

cat (PID: 5524, Parent: 3633, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.yPI9eK0IXB

dash New Fork (PID: 5525, Parent: 3633)

head (PID: 5525, Parent: 3633, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5526, Parent: 3633)

tr (PID: 5526, Parent: 3633, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5527, Parent: 3633)

cut (PID: 5527, Parent: 3633, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5528, Parent: 3633)

cat (PID: 5528, Parent: 3633, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.yPI9eK0IXB

dash New Fork (PID: 5529, Parent: 3633)

head (PID: 5529, Parent: 3633, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5530, Parent: 3633)

tr (PID: 5530, Parent: 3633, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5531, Parent: 3633)

cut (PID: 5531, Parent: 3633, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5532, Parent: 3633)

rm (PID: 5532, Parent: 3633, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.yPI9eK0IXB /tmp/tmp.GZblvkgr8c /tmp/tmp.IYFQvD1OoU

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
x86.elf	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0xcba:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
x86.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5420:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
x86.elf	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0xd41:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
x86.elf	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0xbeb:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
x86.elf	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x180d:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18ed:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x19c2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1c70:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x20f2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
x86.elf	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0xb03:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
x86.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xb722:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
x86.elf	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
x86.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xcfbf:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
x86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xb6f2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 5 entries

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5479.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0xcba:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
5479.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5420:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5479.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0xd41:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
5479.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0xbeb:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
5479.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x180d:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18ed:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x19c2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1c70:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x20f2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
5479.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0xb03:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
5479.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xb722:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5479.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5479.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xcfbf:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5479.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xb6f2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5481.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0xcba:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
5481.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5420:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5481.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0xd41:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
5481.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0xbeb:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
5481.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x180d:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x18ed:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x19c2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1c70:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x20f2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
5481.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0xb03:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
5481.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xb722:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5481.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5481.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xcfbf:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5481.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xb6f2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 15 entries

Snort Signatures

ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound - Source IP: 192.168.2.14 - Destination IP: 61.140.112.62

Timestamp:	02/28/24-07:10:57.856981
SID:	2027973
Source Port:	57400
Destination Port:	23
Protocol:	TCP
Classtype:	Attempt to login by a default username and password

ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound - Source IP: 192.168.2.14 - Destination IP: 115.198.17.218

Timestamp:	02/28/24-07:10:03.135911
SID:	2027973
Source Port:	57768
Destination Port:	23
Protocol:	TCP
Classtype:	Attempt to login by a default username and password

ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound - Source IP: 192.168.2.14 - Destination IP: 179.36.145.211

Timestamp:	02/28/24-07:10:45.571899
SID:	2027973
Source Port:	59212
Destination Port:	23
Protocol:	TCP
Classtype:	Attempt to login by a default username and password

ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound - Source IP: 192.168.2.14 - Destination IP: 179.36.145.211

Timestamp:	02/28/24-07:10:56.312254
SID:	2027973
Source Port:	59334
Destination Port:	23
Protocol:	TCP
Classtype:	Attempt to login by a default username and password

HTTP traffic detected: GET / HTTP/1.1User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/noneAccept: */*Accept-Encoding: identityHost: motd.ubuntu.comConnection: Keep-Alive

Source: motd-news.31.dr

String found in binary or memory: https://ubuntu.com/engage/secure-kubernetes-at-the-edge

Source: unknown	Network traffic detected: HTTP traffic on port 42626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42626

System Summary

Malicious sample detected (through community Yara rule)

Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/x86.elf (PID: 5483)	SIGKILL sent: pid: 853, result: successful			Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	SIGKILL sent: pid: 5321, result: successful			Jump to behavior

Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5479.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5481.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal84.troj.linELF@0/1@0/0

Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/2672/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1583/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3244/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3120/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3361/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3239/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1577/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1610/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/512/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1299/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3235/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/514/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3633/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/519/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/2946/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/917/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3134/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1593/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3011/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3094/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/2955/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3406/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1589/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3129/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1588/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3402/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3125/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3246/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3245/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/767/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/800/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/888/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/801/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/769/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/5425/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/803/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/806/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/807/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/928/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/2956/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/5321/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3420/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/490/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3142/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1635/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1633/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1599/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3139/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1873/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1630/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3412/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/657/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/658/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/659/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/418/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/419/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1639/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1638/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3398/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1371/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3392/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/780/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/660/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/661/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/782/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1369/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3304/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3425/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/785/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1642/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/940/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/941/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1640/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3147/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3268/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1364/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/548/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3786/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1647/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/5463/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/5464/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/2991/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1383/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1382/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1381/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/791/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/671/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/794/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1655/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/2986/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/795/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/674/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1653/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/797/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/2983/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3159/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/678/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1650/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3157/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/679/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1659/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3319/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3178/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/1394/maps	Jump to behavior
Source: /tmp/x86.elf (PID: 5483)	File opened: /proc/3172/maps	Jump to behavior

Source: /usr/bin/dash (PID: 5532)

Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.yPI9eK0IXB /tmp/tmp.GZblvkgr8c /tmp/tmp.IYFQvD1OoU

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
x86.elf	64%	Virustotal		Browse
x86.elf	76%	ReversingLabs	Linux.Trojan.Mirai
x86.elf	100%	Avira	EXP/ELF.Mirai.Bot.Hua.d
x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://motd.ubuntu.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ubuntu.com/engage/secure-kubernetes-at-the-edge	motd-news.31.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
101.163.134.213	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
211.166.104.13	unknown	China	9389	UNSPECIFIEDBEIJINGSHENZHOUGREATWALLCOMMUNICATIONCN	false
136.18.217.31	unknown	United States	60311	ONEFMCH	false
32.67.121.164	unknown	United States	17224	ATT-CERFNET-BLOCKUS	false
142.115.18.125	unknown	Canada	577	BACOMCA	false
218.96.204.128	unknown	China	10212	CHINAENTERCOMChinaEnterpriseCommunicationsLtdCN	false
58.135.118.45	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
150.72.174.105	unknown	Japan	6400	CompaniaDominicanadeTelefonosSADO	false
35.87.63.199	unknown	United States	237	MERIT-AS-14US	false
1.158.220.195	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
48.221.203.197	unknown	United States	2686	ATGS-MMD-ASUS	false
221.252.22.23	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
112.160.16.53	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
126.176.242.194	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
195.239.117.82	unknown	Russian Federation	3216	SOVAM-ASRU	false
172.142.59.229	unknown	United States	7018	ATT-INTERNET4US	false
37.149.51.242	unknown	Cyprus	31549	RASANAIR	false
96.37.110.5	unknown	United States	20115	CHARTER-20115US	false
123.232.3.62	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
209.200.58.217	unknown	United States	27257	WEBAIR-INTERNETUS	false
164.248.121.180	unknown	United States	5972	DNIC-ASBLK-05800-06055US	false
246.196.220.251	unknown	Reserved	unknown	unknown	false
104.169.169.9	unknown	United States	5650	FRONTIER-FRTRUS	false
135.177.182.199	unknown	United States	14962	NCR-252US	false
183.233.94.187	unknown	China	56040	CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	false
165.227.55.117	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
193.203.99.224	unknown	Poland	47303	REDEFINEPL	false
34.25.237.225	unknown	United States	2686	ATGS-MMD-ASUS	false
76.226.188.70	unknown	United States	7018	ATT-INTERNET4US	false
75.120.110.142	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
62.86.104.196	unknown	Italy	3269	ASN-IBSNAZIT	false
162.6.9.138	unknown	United States	7152	REDCROSS-ASNUS	false
252.78.10.31	unknown	Reserved	unknown	unknown	false
142.30.83.77	unknown	Canada	3633	PROVINCE-OF-BRITISH-COLUMBIACA	false
9.68.50.167	unknown	United States	3356	LEVEL3US	false
162.27.98.72	unknown	United States	14328	RRDUS	false
67.215.37.255	unknown	United States	15305	SYRINGANETWORKSUS	false
249.29.139.131	unknown	Reserved	unknown	unknown	false
84.155.203.21	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
122.209.24.178	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
194.244.66.178	unknown	Italy	3302	AS-IRIDEOS-IN-NETAPPIT	false
193.113.23.53	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
46.201.252.60	unknown	Ukraine	6849	UKRTELNETUA	false
205.187.1.83	unknown	United States	7029	WINDSTREAMUS	false
66.193.178.29	unknown	United States	27537	ACCAASUS	false
81.205.89.119	unknown	Netherlands	1136	KPNKPNNationalEU	false
147.63.155.146	unknown	United States	4193	WA-STATE-GOVUS	false
104.217.130.175	unknown	United States	40676	AS40676US	false
75.219.62.230	unknown	United States	22394	CELLCOUS	false
182.15.236.111	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
217.27.242.135	unknown	United Kingdom	29006	POBOX-ASGB	false
43.153.180.172	unknown	Japan	4249	LILLY-ASUS	false
200.165.250.52	unknown	Brazil	7738	TelemarNorteLesteSABR	false
72.67.240.64	unknown	United States	5650	FRONTIER-FRTRUS	false
53.225.188.160	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
221.163.44.223	unknown	Korea Republic of	18323	SNUBH-AS-KRSeoulNationalUniversityBundangHospitalKR	false
72.182.35.193	unknown	United States	11427	TWC-11427-TEXASUS	false
248.143.229.188	unknown	Reserved	unknown	unknown	false
185.133.108.204	unknown	Netherlands	57112	ASN-F2XNL	false
42.3.137.235	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	false
46.146.139.233	unknown	Russian Federation	12768	ER-TELECOM-ASRU	false
153.195.12.182	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
42.222.92.72	unknown	China	4249	LILLY-ASUS	false
201.104.146.139	unknown	Mexico	8151	UninetSAdeCVMX	false
133.250.246.125	unknown	Japan	9357	FNCNRISecureTechnologiesLtdJP	false
66.210.247.127	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
174.5.6.41	unknown	Canada	6327	SHAWCA	false
198.184.60.89	unknown	United States	13990	COUNTYOFORANGEUS	false
207.142.100.50	unknown	United States	27229	WEBHOST-ASN1US	false
210.234.177.100	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
113.45.207.159	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
23.164.102.135	unknown	Reserved	19382	ONCORECA	false
104.176.229.91	unknown	United States	7018	ATT-INTERNET4US	false
73.27.50.240	unknown	United States	7922	COMCAST-7922US	false
112.59.63.233	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
195.239.218.134	unknown	Russian Federation	3216	SOVAM-ASRU	false
213.241.39.227	unknown	Poland	12741	AS-NETIAWarszawa02-822PL	false
32.167.24.82	unknown	United States	2686	ATGS-MMD-ASUS	false
161.75.0.247	unknown	Japan	786	JANETJiscServicesLimitedGB	false
212.110.122.30	unknown	Germany	8648	KAMP-DE	false
24.120.22.244	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
146.188.190.197	unknown	United Kingdom	702	UUNETUS	false
200.3.149.39	unknown	Colombia	19429	ETB-ColombiaCO	false
180.255.128.39	unknown	Singapore	45143	SINGTELMOBILE-AS-APSINGTELMOBILEINTERNETSERVICEPROVIDER	false
160.87.251.46	unknown	United States	299	UCINET-ASUS	false
44.10.245.14	unknown	United States	7377	UCSDUS	false
201.230.26.40	unknown	Peru	6147	TelefonicadelPeruSAAPE	false
254.25.208.22	unknown	Reserved	unknown	unknown	false
153.152.9.193	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
157.148.128.29	unknown	China	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
37.181.24.137	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
34.28.143.157	unknown	United States	2686	ATGS-MMD-ASUS	false
159.165.234.149	unknown	United States	34058	LIFECELL-ASUA	false
1.238.242.140	unknown	Korea Republic of	38396	GOEPJ-AS-KRPajuofficeofEducationGyeonggiProvinceKR	false
95.55.190.123	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
161.23.201.153	unknown	United Kingdom	198864	QMW-AC-UK	false
58.109.94.41	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
37.48.232.87	unknown	Croatia (LOCAL Name: Hrvatska)	35549	METRONET-ASZagrebCroatiaHR	false
43.131.55.48	unknown	Japan	4249	LILLY-ASUS	false
85.57.70.16	unknown	Spain	12479	UNI2-ASES	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
58.135.118.45	IaQN8KZLir	Get hash	malicious	Mirai	Browse
123.232.3.62	QKKPMPtocS	Get hash	malicious	Mirai	Browse
112.160.16.53	db0fa4b8db0333367e9bda3ab68b8042.x86	Get hash	malicious	Gafgyt, Mirai	Browse
112.160.16.53	Uhv3yyh088	Get hash	malicious	Mirai	Browse
142.115.18.125	GF2QHRMI1t	Get hash	malicious	Mirai	Browse
96.37.110.5	dG6x7IXDwU	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATT-CERFNET-BLOCKUS	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	12.131.202.180
	kH5MfuKUfl.elf	Get hash	malicious	Mirai	Browse	12.131.202.166
	jklarm5.elf	Get hash	malicious	Mirai	Browse	63.240.110.187
	kGKsfEjR9J.elf	Get hash	malicious	Mirai	Browse	12.67.248.6
	2ELJo2yPb9.elf	Get hash	malicious	Mirai	Browse	12.131.202.135
	8BNdCdDk17.elf	Get hash	malicious	Mirai	Browse	206.18.146.156
	0FhZaHrd5n.elf	Get hash	malicious	Mirai	Browse	135.15.74.103
	gR1DW6Zm1N.elf	Get hash	malicious	Mirai	Browse	206.18.146.141
	zsGh6GOugh.elf	Get hash	malicious	Mirai	Browse	135.15.74.128
	7oT3AVmeSf.elf	Get hash	malicious	Unknown	Browse	135.12.1.237
UNSPECIFIEDBEIJINGSHENZHOUGREATWALLCOMMUNICATIONCN	5NiE12PYJz.elf	Get hash	malicious	Mirai	Browse	211.165.98.188
	tAF0Glq9pH.elf	Get hash	malicious	Mirai	Browse	211.166.104.142
	ysxN9kZVuH.elf	Get hash	malicious	Mirai	Browse	211.166.104.27
	P5yBme7kPJ.elf	Get hash	malicious	Mirai	Browse	211.165.114.230
	D1Q4FHfsj6.elf	Get hash	malicious	Mirai	Browse	211.166.104.35
	v6B9kxKva1.elf	Get hash	malicious	Mirai	Browse	211.165.114.207
	L7WtUZpZ67.elf	Get hash	malicious	Mirai	Browse	211.166.212.0
	S8kyTAF7c9.elf	Get hash	malicious	Mirai	Browse	211.165.162.183
	f0LSiRhDq6.elf	Get hash	malicious	Mirai	Browse	211.165.114.238
	SecuriteInfo.com.Linux.Siggen.9999.15798.13010.elf	Get hash	malicious	Mirai	Browse	211.165.162.126
ONEFMCH	nXM6xuJw9q.elf	Get hash	malicious	Mirai	Browse	136.68.212.52
	huhu.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	136.76.251.169
	F1TAUvM9qy.elf	Get hash	malicious	Mirai	Browse	136.85.120.199
	vttB6D4E29.elf	Get hash	malicious	Mirai	Browse	136.102.228.84
	7erU7Xu8Wa.elf	Get hash	malicious	Mirai	Browse	136.104.21.90
	3C65WCfDUz.elf	Get hash	malicious	Mirai	Browse	136.109.4.200
	bMFkN5WhuU.elf	Get hash	malicious	Mirai	Browse	136.65.10.236
	IZ4Om6WI3Q.elf	Get hash	malicious	Unknown	Browse	136.82.8.144
	g7HXGuuY6X.elf	Get hash	malicious	Mirai	Browse	136.130.192.137
	ajNjvSIXbo.elf	Get hash	malicious	Mirai	Browse	136.70.56.57
ASN-TELSTRATelstraCorporationLtdAU	7lESNpA2F7.elf	Get hash	malicious	Mirai, Okiru	Browse	101.163.182.113
	5NiE12PYJz.elf	Get hash	malicious	Mirai	Browse	110.150.65.58
	VOR5qp1nkw.elf	Get hash	malicious	Mirai	Browse	1.133.123.56
	dTSpuHt89l.elf	Get hash	malicious	Mirai	Browse	1.146.71.84
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	144.139.77.46
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	101.167.117.150
	p8hzfDn0Pn.elf	Get hash	malicious	Mirai	Browse	110.150.53.42
	uI4VKVPsur.elf	Get hash	malicious	Mirai	Browse	101.180.76.144
	GEQ9H7lf1W.elf	Get hash	malicious	Mirai	Browse	101.162.192.212
	Oy4LS6Vost.elf	Get hash	malicious	Mirai	Browse	1.154.21.138

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/var/cache/motd-news

Download File

Process:	/usr/bin/cut
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.493616814343774
Encrypted:	false
SSDEEP:	3:P2xxS8/vSAX9qEWpFuEb3c6uGlHY4/4tA9piBFH3guUFuRz5/D0VTFA9PyLOurAn:OlpqEWpFuEb3BlHLbmHwlFeWvL3rA9x
MD5:	CBDCED8720CAB6EEBEF7861E8ADAE665
SHA1:	6D06B520D347AAD2775CAA9AF7852D26347E33D0
SHA-256:	D90D574CFCD9A7C941F9B1385434460F49ED9A2E8C0069C43DD05BA4453087E0
SHA-512:	4DB4E08D47327057A50C0349774A3F31B94C72438D59FB7E3BA8A4F04C519ECF6943CDF4846AB682C2A03CEB83D2840E7389DD5E175F8B3FF12EC06C198A52D2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s. just raised the bar for easy, resilient and secure K8s cluster deployment... https://ubuntu.com/engage/secure-kubernetes-at-the-edge.

Source: x86.elf	Virustotal: Detection: 63%			Perma Link
Source: x86.elf	ReversingLabs: Detection: 76%

Source: Traffic	Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.14:57768 -> 115.198.17.218:23
Source: Traffic	Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.14:59212 -> 179.36.145.211:23
Source: Traffic	Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.14:59334 -> 179.36.145.211:23
Source: Traffic	Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.14:57400 -> 61.140.112.62:23

Source: unknown	TCP traffic detected without corresponding DNS query: 68.22.33.22
Source: unknown	TCP traffic detected without corresponding DNS query: 176.167.178.22
Source: unknown	TCP traffic detected without corresponding DNS query: 240.113.175.141
Source: unknown	TCP traffic detected without corresponding DNS query: 163.146.112.101
Source: unknown	TCP traffic detected without corresponding DNS query: 12.125.75.131
Source: unknown	TCP traffic detected without corresponding DNS query: 68.181.80.10
Source: unknown	TCP traffic detected without corresponding DNS query: 35.207.198.195
Source: unknown	TCP traffic detected without corresponding DNS query: 44.15.205.200
Source: unknown	TCP traffic detected without corresponding DNS query: 118.190.206.15
Source: unknown	TCP traffic detected without corresponding DNS query: 250.108.54.136
Source: unknown	TCP traffic detected without corresponding DNS query: 36.136.58.3
Source: unknown	TCP traffic detected without corresponding DNS query: 83.81.96.254
Source: unknown	TCP traffic detected without corresponding DNS query: 216.107.138.35
Source: unknown	TCP traffic detected without corresponding DNS query: 164.5.34.146
Source: unknown	TCP traffic detected without corresponding DNS query: 88.223.215.63
Source: unknown	TCP traffic detected without corresponding DNS query: 119.207.186.213
Source: unknown	TCP traffic detected without corresponding DNS query: 189.35.213.21
Source: unknown	TCP traffic detected without corresponding DNS query: 144.32.206.202
Source: unknown	TCP traffic detected without corresponding DNS query: 93.189.73.108
Source: unknown	TCP traffic detected without corresponding DNS query: 241.104.8.42
Source: unknown	TCP traffic detected without corresponding DNS query: 139.224.89.48
Source: unknown	TCP traffic detected without corresponding DNS query: 178.22.169.92
Source: unknown	TCP traffic detected without corresponding DNS query: 216.94.153.178
Source: unknown	TCP traffic detected without corresponding DNS query: 5.205.16.6
Source: unknown	TCP traffic detected without corresponding DNS query: 152.142.243.102
Source: unknown	TCP traffic detected without corresponding DNS query: 126.96.118.226
Source: unknown	TCP traffic detected without corresponding DNS query: 59.52.74.158
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.255.169
Source: unknown	TCP traffic detected without corresponding DNS query: 44.216.147.108
Source: unknown	TCP traffic detected without corresponding DNS query: 91.174.42.230
Source: unknown	TCP traffic detected without corresponding DNS query: 95.15.124.9
Source: unknown	TCP traffic detected without corresponding DNS query: 67.92.163.99
Source: unknown	TCP traffic detected without corresponding DNS query: 208.140.139.174
Source: unknown	TCP traffic detected without corresponding DNS query: 191.253.200.25
Source: unknown	TCP traffic detected without corresponding DNS query: 80.24.120.4
Source: unknown	TCP traffic detected without corresponding DNS query: 126.181.177.189
Source: unknown	TCP traffic detected without corresponding DNS query: 35.52.91.176
Source: unknown	TCP traffic detected without corresponding DNS query: 34.155.65.55
Source: unknown	TCP traffic detected without corresponding DNS query: 181.192.104.2
Source: unknown	TCP traffic detected without corresponding DNS query: 136.174.39.180
Source: unknown	TCP traffic detected without corresponding DNS query: 247.245.97.151
Source: unknown	TCP traffic detected without corresponding DNS query: 18.215.255.184
Source: unknown	TCP traffic detected without corresponding DNS query: 174.240.222.96
Source: unknown	TCP traffic detected without corresponding DNS query: 5.169.56.73
Source: unknown	TCP traffic detected without corresponding DNS query: 9.122.223.235
Source: unknown	TCP traffic detected without corresponding DNS query: 57.73.46.181
Source: unknown	TCP traffic detected without corresponding DNS query: 250.12.33.153
Source: unknown	TCP traffic detected without corresponding DNS query: 248.168.28.176
Source: unknown	TCP traffic detected without corresponding DNS query: 92.169.38.67
Source: unknown	TCP traffic detected without corresponding DNS query: 99.191.251.180

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.517099228814512
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	x86.elf
File size:	74'640 bytes
MD5:	b9bce82f41d06b11802c7d5140b75659
SHA1:	a6ca900230f584e8a60bc0db54dc2e75d6c6c1a5
SHA256:	1c3a7dab14418e44d59d87b8285491f0821fe01a6b24ce33a244998bd8a7a08f
SHA512:	8f4aba65d4dd23587a6f1c9e1ed7db33658557c870c2f53bc711bed9df711783a1f33a514aac7827084b89a7e19a47a90e14031ff15fce17cbaac80476235c59
SSDEEP:	1536:b/DYQYs1ZokODichzx15UzOHIt09afsH18ruUGDKVQSi:zDhzUkODichz9Uzk40A0V8qbGVs
TLSH:	11735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E61625E
File Content Preview:	.ELF....................d...4...."......4. ...(.....................\...\................ ...............)..........Q.td............................U..S.......w....h....s...[]...$.............U......=.....t..5....$......$.......u........t....h\...........

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	74240
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xff96	0x0	0x6	AX	16
.fini	PROGBITS	0x8058046	0x10046	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8058060	0x10060	0x1bfc	0x0	0x2	A	32
.ctors	PROGBITS	0x805a000	0x12000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x805a008	0x12008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805a020	0x12020	0x1a0	0x0	0x3	WA	32
.bss	NOBITS	0x805a1c0	0x121c0	0x27c0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x121c0	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x11c5c	0x11c5c	6.5947	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x12000	0x805a000	0x805a000	0x1c0	0x2980	1.8236	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Bytes transferred	Direction	Data
2024-02-28 06:09:29 UTC	249	OUT	GET / HTTP/1.1 User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none Accept: / Accept-Encoding: identity Host: motd.ubuntu.com Connection: Keep-Alive
2024-02-28 06:09:31 UTC	271	IN	HTTP/1.1 200 OK Date: Wed, 28 Feb 2024 06:09:30 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 28 Feb 2024 06:00:18 GMT ETag: "d8-6126adb82c880" Accept-Ranges: bytes Content-Length: 216 Vary: Accept-Encoding Connection: close Content-Type: text/plain
2024-02-28 06:09:31 UTC	216	IN	Data Raw: 20 2a 20 53 74 72 69 63 74 6c 79 20 63 6f 6e 66 69 6e 65 64 20 4b 75 62 65 72 6e 65 74 65 73 20 6d 61 6b 65 73 20 65 64 67 65 20 61 6e 64 20 49 6f 54 20 73 65 63 75 72 65 2e 20 4c 65 61 72 6e 20 68 6f 77 20 4d 69 63 72 6f 4b 38 73 0a 20 20 20 6a 75 73 74 20 72 61 69 73 65 64 20 74 68 65 20 62 61 72 20 66 6f 72 20 65 61 73 79 2c 20 72 65 73 69 6c 69 65 6e 74 20 61 6e 64 20 73 65 63 75 72 65 20 4b 38 73 20 63 6c 75 73 74 65 72 20 64 65 70 6c 6f 79 6d 65 6e 74 2e 0a 0a 20 20 20 68 74 74 70 73 3a 2f 2f 75 62 75 6e 74 75 2e 63 6f 6d 2f 65 6e 67 61 67 65 2f 73 65 63 75 72 65 2d 6b 75 62 65 72 6e 65 74 65 73 2d 61 74 2d 74 68 65 2d 65 64 67 65 0a Data Ascii: * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s just raised the bar for easy, resilient and secure K8s cluster deployment. https://ubuntu.com/engage/secure-kubernetes-at-the-edge

Start time (UTC):	06:08:53
Start date (UTC):	28/02/2024
Path:	/tmp/x86.elf
Arguments:	/tmp/x86.elf
File size:	74640 bytes
MD5 hash:	b9bce82f41d06b11802c7d5140b75659

Start time (UTC):	06:09:30
Start date (UTC):	28/02/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 68.22.33.22:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 250.108.54.136:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 241.104.8.42:2323
Source: global traffic	TCP traffic: 192.168.2.14:39692 -> 91.92.255.169:5555
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 44.216.147.108:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 181.192.104.2:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 92.169.38.67:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 101.229.30.80:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 182.177.104.80:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 104.87.130.47:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 114.159.49.76:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 121.146.35.127:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 247.180.63.185:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 188.72.223.88:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 81.180.213.201:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 248.54.83.6:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 20.254.241.201:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 97.253.104.1:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 95.1.164.0:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 249.64.71.63:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 205.175.189.207:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 159.172.248.33:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 79.67.101.79:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 100.41.2.151:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 165.61.142.172:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 177.216.102.232:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 43.8.32.212:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 94.59.107.250:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 254.175.159.34:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 213.51.203.115:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 133.159.87.55:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 196.212.80.104:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 175.223.179.149:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 106.120.187.246:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 252.75.166.214:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 108.249.112.233:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 241.49.141.43:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 36.74.223.79:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 162.189.9.13:2323
Source: global traffic	TCP traffic: 192.168.2.14:37588 -> 98.181.147.118:2323

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/cache/motd-news

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

HTTPS Proxied Packets

System Behavior

Analysis Process: x86.elf PID: 5479, Parent PID: 5403

General

Chronological Activities

Analysis Process: x86.elf PID: 5480, Parent PID: 5479

General

Chronological Activities

Analysis Process: x86.elf PID: 5481, Parent PID: 5480

General

Chronological Activities

Analysis Process: x86.elf PID: 5482, Parent PID: 5480

General

Analysis Process: x86.elf PID: 5483, Parent PID: 5480

General

Chronological Activities

Linux Analysis Report
x86.elf