Create Interactive Tour

Linux Analysis Report
ZtbAkJUbdl.elf

Overview

General Information

Sample name:	ZtbAkJUbdl.elf renamed because original name is a hash value
Original sample name:	d82b8aed6d880b82d1ba40a88abf9b99.elf
Analysis ID:	1400068
MD5:	d82b8aed6d880b82d1ba40a88abf9b99
SHA1:	d91ce5dec90dc29f906aca8d5ba57825f80a8049
SHA256:	7219da0b6a1e0e280b91e012f492961df51fdaa05479ad304f85689d33b40084
Tags:	32elfmiraimotorola
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1400068
Start date and time:	2024-02-28 07:49:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ZtbAkJUbdl.elf renamed because original name is a hash value
Original Sample Name:	d82b8aed6d880b82d1ba40a88abf9b99.elf
Detection:	MAL
Classification:	mal80.troj.linELF@0/2@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/ZtbAkJUbdl.elf
PID:	5511
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	SHORELINE BOTNET THA REAL SHIT NIGGA
Standard Error:

Process Tree

system is lnxubuntu20

ZtbAkJUbdl.elf (PID: 5511, Parent: 5435, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/ZtbAkJUbdl.elf

ZtbAkJUbdl.elf New Fork (PID: 5513, Parent: 5511)

ZtbAkJUbdl.elf New Fork (PID: 5515, Parent: 5513)

ZtbAkJUbdl.elf New Fork (PID: 5516, Parent: 5513)

ZtbAkJUbdl.elf New Fork (PID: 5518, Parent: 5513)

dash New Fork (PID: 5557, Parent: 3672)

cat (PID: 5557, Parent: 3672, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.ZpZCWAxrDd

dash New Fork (PID: 5558, Parent: 3672)

head (PID: 5558, Parent: 3672, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5559, Parent: 3672)

tr (PID: 5559, Parent: 3672, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5560, Parent: 3672)

cut (PID: 5560, Parent: 3672, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5561, Parent: 3672)

cat (PID: 5561, Parent: 3672, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.ZpZCWAxrDd

dash New Fork (PID: 5562, Parent: 3672)

head (PID: 5562, Parent: 3672, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5563, Parent: 3672)

tr (PID: 5563, Parent: 3672, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5564, Parent: 3672)

cut (PID: 5564, Parent: 3672, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5565, Parent: 3672)

rm (PID: 5565, Parent: 3672, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ZpZCWAxrDd /tmp/tmp.MKVVSTbSYV /tmp/tmp.lUNQDuG22D

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ZtbAkJUbdl.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x126f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12704:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12718:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1272c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12740:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12754:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12768:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1277c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12790:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12808:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1281c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1286c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5515.1.00007f6240001000.00007f6240016000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x126f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12704:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12718:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1272c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12740:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12754:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12768:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1277c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12790:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12808:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1281c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1286c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5511.1.00007f6240001000.00007f6240016000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x126f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12704:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12718:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1272c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12740:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12754:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12768:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1277c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12790:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12808:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1281c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1286c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ZtbAkJUbdl.elf PID: 5511	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1860:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1874:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1888:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x193c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x198c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ZtbAkJUbdl.elf PID: 5515	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfcb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfdf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1007:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Snort Signatures

ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound - Source IP: 192.168.2.15 - Destination IP: 175.150.218.109

Timestamp:	02/28/24-07:51:19.063689
SID:	2027973
Source Port:	46102
Destination Port:	23
Protocol:	TCP
Classtype:	Attempt to login by a default username and password

ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound - Source IP: 192.168.2.15 - Destination IP: 194.28.61.62

Timestamp:	02/28/24-07:51:33.789039
SID:	2027973
Source Port:	44472
Destination Port:	23
Protocol:	TCP
Classtype:	Attempt to login by a default username and password

ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound - Source IP: 192.168.2.15 - Destination IP: 104.243.128.23

Timestamp:	02/28/24-07:52:00.346233
SID:	2027973
Source Port:	56874
Destination Port:	23
Protocol:	TCP
Classtype:	Attempt to login by a default username and password

ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound - Source IP: 192.168.2.15 - Destination IP: 194.28.61.62

Timestamp:	02/28/24-07:51:51.049438
SID:	2027973
Source Port:	44650
Destination Port:	23
Protocol:	TCP
Classtype:	Attempt to login by a default username and password

ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) - Source IP: 192.168.2.15 - Destination IP: 59.52.20.110

Timestamp:	02/28/24-07:51:38.016118
SID:	2829347
Source Port:	59900
Destination Port:	23
Protocol:	TCP
Classtype:	Attempted Information Leak

HTTP traffic detected: GET / HTTP/1.1User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/noneAccept: */*Accept-Encoding: identityHost: motd.ubuntu.comConnection: Keep-Alive

Source: motd-news.28.dr

String found in binary or memory: https://ubuntu.com/engage/secure-kubernetes-at-the-edge

Source: unknown	Network traffic detected: HTTP traffic on port 36390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36390
Source: unknown	Network traffic detected: HTTP traffic on port 44522 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: ZtbAkJUbdl.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5515.1.00007f6240001000.00007f6240016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5511.1.00007f6240001000.00007f6240016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ZtbAkJUbdl.elf PID: 5511, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ZtbAkJUbdl.elf PID: 5515, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	SIGKILL sent: pid: 850, result: successful			Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	SIGKILL sent: pid: 5356, result: successful			Jump to behavior

Source: ZtbAkJUbdl.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5515.1.00007f6240001000.00007f6240016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5511.1.00007f6240001000.00007f6240016000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ZtbAkJUbdl.elf PID: 5511, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ZtbAkJUbdl.elf PID: 5515, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal80.troj.linELF@0/2@0/0

Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1185/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3241/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3483/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1732/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1730/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1333/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1695/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3235/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3234/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/911/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/515/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/914/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1617/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1615/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/917/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3255/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3253/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1591/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3252/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3251/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3250/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1623/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1588/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3249/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/764/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3368/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1585/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3246/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3488/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/766/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/800/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/888/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/802/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1509/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/803/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/804/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1867/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3407/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1484/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/490/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1514/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1634/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1479/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1875/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/654/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3379/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/655/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/656/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/777/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/931/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1595/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/657/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/812/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/779/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/658/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/933/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/418/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/419/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3419/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3672/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3310/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3275/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3274/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3273/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3394/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3272/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/782/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3303/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1762/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3027/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1486/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/789/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1806/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3820/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3821/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3822/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3823/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1660/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3044/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3440/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3715/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/793/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/794/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3316/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/674/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/796/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/675/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/676/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1498/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1497/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1496/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3157/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3278/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3399/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3795/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/5459/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/1659/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/5356/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3332/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3210/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3298/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3055/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/3052/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/680/maps	Jump to behavior
Source: /tmp/ZtbAkJUbdl.elf (PID: 5518)	File opened: /proc/681/maps	Jump to behavior

Source: /usr/bin/dash (PID: 5565)

Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ZpZCWAxrDd /tmp/tmp.MKVVSTbSYV /tmp/tmp.lUNQDuG22D

Jump to behavior

Source: /tmp/ZtbAkJUbdl.elf (PID: 5511)

Queries kernel information via 'uname':

Jump to behavior

Source: ZtbAkJUbdl.elf, 5511.1.00007ffe3d718000.00007ffe3d739000.rw-.sdmp, ZtbAkJUbdl.elf, 5515.1.00007ffe3d718000.00007ffe3d739000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: ZtbAkJUbdl.elf, 5511.1.00005631b693a000.00005631b69bf000.rw-.sdmp, ZtbAkJUbdl.elf, 5515.1.00005631b693a000.00005631b69bf000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: ZtbAkJUbdl.elf, 5511.1.00007ffe3d718000.00007ffe3d739000.rw-.sdmp, ZtbAkJUbdl.elf, 5515.1.00007ffe3d718000.00007ffe3d739000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/ZtbAkJUbdl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ZtbAkJUbdl.elf
Source: ZtbAkJUbdl.elf, 5511.1.00005631b693a000.00005631b69bf000.rw-.sdmp, ZtbAkJUbdl.elf, 5515.1.00005631b693a000.00005631b69bf000.rw-.sdmp	Binary or memory string: 1V!/etc/qemu-binfmt/m68k

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ZtbAkJUbdl.elf	71%	ReversingLabs	Linux.Trojan.Mirai
ZtbAkJUbdl.elf	62%	Virustotal		Browse
ZtbAkJUbdl.elf	100%	Avira	EXP/ELF.Mirai.Bot.Hua.d

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://motd.ubuntu.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ubuntu.com/engage/secure-kubernetes-at-the-edge	motd-news.28.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
163.89.145.253	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
111.104.247.40	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
213.190.39.158	unknown	Lithuania	8764	TELIA-LIETUVALT	false
181.235.151.14	unknown	Colombia	3816	COLOMBIATELECOMUNICACIONESSAESPCO	false
92.173.33.77	unknown	France	3215	FranceTelecom-OrangeFR	false
249.9.229.249	unknown	Reserved	unknown	unknown	false
165.75.217.120	unknown	United States	63474	SIRIUS-DATACENTERSUS	false
110.216.193.241	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
103.7.73.63	unknown	Australia	55707	SIMTRONIC-AS-APSimtronicAU	false
218.27.222.66	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
39.156.128.85	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
95.19.72.161	unknown	Spain	12479	UNI2-ASES	false
24.101.205.68	unknown	United States	27364	ACS-INTERNETUS	false
31.154.83.156	unknown	Israel	12400	PARTNER-ASIL	false
54.54.35.86	unknown	United States	14618	AMAZON-AESUS	false
111.215.117.88	unknown	China	9812	CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN	false
107.49.210.254	unknown	United States	16567	NETRIX-16567US	false
141.35.74.96	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
150.64.159.112	unknown	Japan	6400	CompaniaDominicanadeTelefonosSADO	false
39.118.16.245	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
186.39.62.60	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
222.18.102.192	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
89.35.225.157	unknown	Romania	35450	DAINETRO	false
4.50.33.124	unknown	United States	3356	LEVEL3US	false
79.199.39.96	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
201.11.89.176	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
152.254.145.18	unknown	Brazil	27699	TELEFONICABRASILSABR	false
242.196.148.176	unknown	Reserved	unknown	unknown	false
163.181.69.192	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
36.25.123.203	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
242.222.43.123	unknown	Reserved	unknown	unknown	false
175.40.72.185	unknown	India	4804	MPX-ASMicroplexPTYLTDAU	false
163.146.143.29	unknown	Japan	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
206.185.207.239	unknown	United States	174	COGENT-174US	false
119.95.37.218	unknown	Philippines	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false
75.205.73.44	unknown	United States	22394	CELLCOUS	false
247.138.245.187	unknown	Reserved	unknown	unknown	false
245.232.247.215	unknown	Reserved	unknown	unknown	false
200.122.108.177	unknown	Argentina	10481	TelecomArgentinaSAAR	false
87.31.156.29	unknown	Italy	3269	ASN-IBSNAZIT	false
116.40.18.55	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
94.92.80.234	unknown	Italy	3269	ASN-IBSNAZIT	false
143.23.212.48	unknown	United States	11003	PANDGUS	false
76.16.88.33	unknown	United States	7922	COMCAST-7922US	false
135.49.66.254	unknown	United States	54614	CIKTELECOM-CABLECA	false
19.113.192.35	unknown	United States	3	MIT-GATEWAYSUS	false
14.201.104.153	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	false
198.240.162.6	unknown	Switzerland	3096	CREDITSUISSEGROUP-ASCreditSuisseGroupCH	false
9.70.108.138	unknown	United States	3356	LEVEL3US	false
47.155.118.98	unknown	United States	5650	FRONTIER-FRTRUS	false
153.178.76.138	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
198.40.41.53	unknown	United States	26854	NYSUS	false
249.166.182.117	unknown	Reserved	unknown	unknown	false
117.187.200.246	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
255.228.188.89	unknown	Reserved	unknown	unknown	false
20.183.227.170	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.89.96.155	unknown	unknown	208149	SKYTELECOM-ASGR	false
44.104.202.135	unknown	United States	7377	UCSDUS	false
240.23.146.47	unknown	Reserved	unknown	unknown	false
129.4.161.229	unknown	United States	1906	NORTHROP-GRUMMANUS	false
255.100.76.114	unknown	Reserved	unknown	unknown	false
223.189.1.185	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
118.190.228.116	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
69.77.120.238	unknown	United States	2495	KANRENUS	false
64.18.157.179	unknown	United States	395354	ASN-STARRYUS	false
173.117.25.155	unknown	United States	10507	SPCSUS	false
217.217.226.248	unknown	Spain	6739	ONO-ASCableuropa-ONOES	false
194.85.67.198	unknown	Russian Federation	21416	TCINET-ASRU	false
115.97.238.240	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	false
62.240.194.203	unknown	Switzerland	13267	ZuercherKantonalbankCH	false
45.166.60.181	unknown	Brazil	267945	MICROCHIP-NETTELECOMSERVCOMMULTIMIDIALTDABR	false
13.7.241.200	unknown	United States	33631	PARC-ASNUS	false
84.14.66.10	unknown	France	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
216.26.247.231	unknown	United States	7029	WINDSTREAMUS	false
9.250.167.42	unknown	United States	3356	LEVEL3US	false
62.132.169.21	unknown	Germany	286	KPNNL	false
218.62.11.79	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
211.132.37.161	unknown	Japan	4685	ASAHI-NETAsahiNetJP	false
86.221.45.225	unknown	France	3215	FranceTelecom-OrangeFR	false
147.57.192.61	unknown	United States	4193	WA-STATE-GOVUS	false
165.60.22.68	unknown	Zambia	37154	ZAMTELZM	false
83.241.94.20	unknown	Latvia	43513	NANO-ASLV	false
9.157.64.69	unknown	United States	3356	LEVEL3US	false
112.198.124.78	unknown	Philippines	132199	GLOBE-MOBILE-5TH-GEN-ASGlobeTelecomIncPH	false
54.2.225.234	unknown	United States	14618	AMAZON-AESUS	false
210.77.15.133	unknown	China	7497	CSTNET-AS-APComputerNetworkInformationCenterCN	false
40.228.53.64	unknown	United States	4249	LILLY-ASUS	false
203.93.113.228	unknown	China	9929	CUIICHINAUNICOMIndustrialInternetBackboneCN	false
173.204.251.219	unknown	United States	26228	SERVEPATHUS	false
181.188.77.194	unknown	Trinidad and Tobago	27665	ColumbusCommunicationsTrinidadLimitedTT	false
173.0.181.5	unknown	United States	13909	TECHIEMEDIAUS	false
68.59.61.221	unknown	United States	7922	COMCAST-7922US	false
177.186.238.72	unknown	Brazil	26615	TIMSABR	false
82.127.162.227	unknown	France	3215	FranceTelecom-OrangeFR	false
223.204.221.107	unknown	Thailand	45758	TRIPLETNET-AS-APTripleTInternetTripleTBroadbandTH	false
20.38.219.222	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
201.255.117.232	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
19.92.152.84	unknown	United States	3	MIT-GATEWAYSUS	false
250.181.125.173	unknown	Reserved	unknown	unknown	false
180.194.228.88	unknown	Philippines	45223	WIN-AS-TH-APWorldInternetworkCoLtdThailandTH	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.54.35.86	kLafsxT87Y.elf	Get hash	malicious	Mirai	Browse
186.39.62.60	AzPnARFc9g	Get hash	malicious	Mirai	Browse
141.35.74.96	S8y0x1Zeef.elf	Get hash	malicious	Mirai	Browse
165.75.217.120	lRgFFON2H0.elf	Get hash	malicious	Mirai	Browse
165.75.217.120	DlrszagqjA	Get hash	malicious	Mirai	Browse
89.35.225.157	MviPEORLUw.elf	Get hash	malicious	Unknown	Browse
150.64.159.112	1qwfaM7XZK.elf	Get hash	malicious	Mirai	Browse
79.199.39.96	Pa0exc41sw.elf	Get hash	malicious	Mirai	Browse
201.11.89.176	DWYcRJFyUH	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COLOMBIATELECOMUNICACIONESSAESPCO	6G66kSe2A4.elf	Get hash	malicious	Mirai	Browse	152.204.102.96
	UD6c1o6Fhg.elf	Get hash	malicious	Mirai	Browse	191.110.192.236
	Le3TP5iwHa.elf	Get hash	malicious	Mirai	Browse	167.1.241.127
	2MfOp4FY7r.elf	Get hash	malicious	Mirai	Browse	186.172.230.205
	rDaOraovjl.elf	Get hash	malicious	Unknown	Browse	186.113.131.247
	WLK1j9UWVU.elf	Get hash	malicious	Mirai	Browse	200.21.184.249
	Q87z4TcuF1.elf	Get hash	malicious	Mirai	Browse	179.33.178.143
	7j5Y0VWRZH.elf	Get hash	malicious	Mirai	Browse	186.168.10.27
	5xa5PjUGfm.elf	Get hash	malicious	Mirai	Browse	190.255.99.56
	HpHB322h1d.elf	Get hash	malicious	Mirai	Browse	186.170.238.17
KDDIKDDICORPORATIONJP	mpsl.elf	Get hash	malicious	Mirai	Browse	125.51.29.210
	x86.elf	Get hash	malicious	Mirai	Browse	210.234.177.100
	arm7.elf	Get hash	malicious	Mirai	Browse	118.158.190.106
	nXM6xuJw9q.elf	Get hash	malicious	Mirai	Browse	106.131.57.200
	7lESNpA2F7.elf	Get hash	malicious	Mirai, Okiru	Browse	27.91.141.174
	5NiE12PYJz.elf	Get hash	malicious	Mirai	Browse	203.140.136.60
	cqZmSreb4e.elf	Get hash	malicious	Mirai	Browse	150.49.142.2
	ZSlHX40Um2.elf	Get hash	malicious	Mirai, Okiru	Browse	210.159.20.190
	WiFMm8X57J.elf	Get hash	malicious	Mirai	Browse	106.175.162.201
	huhu.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	113.148.204.84
FranceTelecom-OrangeFR	mpsl.elf	Get hash	malicious	Mirai	Browse	86.241.96.238
	RShSMrtjcl.elf	Get hash	malicious	Mirai	Browse	86.241.96.238
	dTSpuHt89l.elf	Get hash	malicious	Mirai	Browse	81.53.39.167
	huhu.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	92.170.221.91
	huhu.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	86.192.54.164
	huhu.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	2.2.75.200
	p8hzfDn0Pn.elf	Get hash	malicious	Mirai	Browse	81.255.85.74
	GEQ9H7lf1W.elf	Get hash	malicious	Mirai	Browse	86.222.195.169
	Oy4LS6Vost.elf	Get hash	malicious	Mirai	Browse	90.80.41.95
	EaJ376VLX1.elf	Get hash	malicious	Mirai	Browse	217.128.79.199
TELIA-LIETUVALT	906o5yr1NE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc, Xmrig	Browse	78.60.180.159
	huhu.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	78.60.255.179
	2MfOp4FY7r.elf	Get hash	malicious	Mirai	Browse	78.59.128.35
	qynd1m1ejo.elf	Get hash	malicious	Mirai	Browse	85.206.40.11
	O89nUxpP0C.elf	Get hash	malicious	Mirai	Browse	85.206.40.17
	57viNakyQH.elf	Get hash	malicious	Mirai	Browse	85.206.40.36
	8gIL23fHBO.elf	Get hash	malicious	Mirai	Browse	85.206.40.40
	pm71xWvAqP.elf	Get hash	malicious	Moobot	Browse	78.61.45.206
	b3astmode.arm7.elf	Get hash	malicious	Mirai	Browse	78.60.207.228
	sv35nTY4Fv.elf	Get hash	malicious	Mirai	Browse	88.119.141.157
CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	x86.elf	Get hash	malicious	Mirai	Browse	157.148.128.29
	LUNFk2Hgfu.elf	Get hash	malicious	Mirai, Okiru	Browse	157.156.150.6
	VOR5qp1nkw.elf	Get hash	malicious	Mirai	Browse	163.196.226.133
	oLehUXsK2P.elf	Get hash	malicious	Mirai	Browse	163.78.137.207
	huhu.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	157.148.128.31
	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	120.82.68.103
	huhu.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	157.18.180.205
	F1TAUvM9qy.elf	Get hash	malicious	Mirai	Browse	112.93.141.52
	GEQ9H7lf1W.elf	Get hash	malicious	Mirai	Browse	120.82.68.164
	zOKUvUgL0n.elf	Get hash	malicious	Mirai	Browse	163.91.102.100

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.RW26Hs (deleted)

Download File

Process:	/tmp/ZtbAkJUbdl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	3.5867036948207476
Encrypted:	false
SSDEEP:	6:Yh4gDFmdKG3j/VUR4DFmdKv3j/VfKoO/VNfiY/VH:YhNSiRwSi3Kl
MD5:	E23EFC59DCB799961672C04030D05A96
SHA1:	8A6F37B9E18E6E167E5F64D8C89E63B851F5EFE6
SHA-256:	7B6D20FBCE0051718B149E1486BFA3052F67451201F078B7D2043AED7F45D8C7
SHA-512:	88C3336646DEF2FE690F8A035713D52A3BC43CA882D5FE9AC43F767B0D69B169C86B317C3D581C6E7D27E7DB27F997FC40974E10A07C126C945D9116C760DA2C
Malicious:	false
Reputation:	low
Preview:	80000000-80015000 r-xp 00000000 fd:00 531606 /tmp/ZtbAkJUbdl.elf.80016000-80017000 rw-p 00014000 fd:00 531606 /tmp/ZtbAkJUbdl.elf.80017000-8001a000 rw-p 00000000 00:00 0 .ff7fe000-ff7ff000 ---p 00000000 00:00 0 .ff7ff000-fffff000 rw-p 00000000 00:00 0 [stack].

/var/cache/motd-news

Download File

Process:	/usr/bin/cut
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.493616814343774
Encrypted:	false
SSDEEP:	3:P2xxS8/vSAX9qEWpFuEb3c6uGlHY4/4tA9piBFH3guUFuRz5/D0VTFA9PyLOurAn:OlpqEWpFuEb3BlHLbmHwlFeWvL3rA9x
MD5:	CBDCED8720CAB6EEBEF7861E8ADAE665
SHA1:	6D06B520D347AAD2775CAA9AF7852D26347E33D0
SHA-256:	D90D574CFCD9A7C941F9B1385434460F49ED9A2E8C0069C43DD05BA4453087E0
SHA-512:	4DB4E08D47327057A50C0349774A3F31B94C72438D59FB7E3BA8A4F04C519ECF6943CDF4846AB682C2A03CEB83D2840E7389DD5E175F8B3FF12EC06C198A52D2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s. just raised the bar for easy, resilient and secure K8s cluster deployment... https://ubuntu.com/engage/secure-kubernetes-at-the-edge.

Source: ZtbAkJUbdl.elf	ReversingLabs: Detection: 71%
Source: ZtbAkJUbdl.elf	Virustotal: Detection: 62%			Perma Link

Source: Traffic	Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.15:46102 -> 175.150.218.109:23
Source: Traffic	Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.15:44472 -> 194.28.61.62:23
Source: Traffic	Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.15:59900 -> 59.52.20.110:23
Source: Traffic	Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.15:44650 -> 194.28.61.62:23
Source: Traffic	Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.15:56874 -> 104.243.128.23:23

Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.255.169
Source: unknown	TCP traffic detected without corresponding DNS query: 19.37.231.137
Source: unknown	TCP traffic detected without corresponding DNS query: 107.153.17.184
Source: unknown	TCP traffic detected without corresponding DNS query: 167.197.172.136
Source: unknown	TCP traffic detected without corresponding DNS query: 88.132.204.237
Source: unknown	TCP traffic detected without corresponding DNS query: 135.151.85.166
Source: unknown	TCP traffic detected without corresponding DNS query: 159.240.85.181
Source: unknown	TCP traffic detected without corresponding DNS query: 77.72.241.203
Source: unknown	TCP traffic detected without corresponding DNS query: 71.37.152.54
Source: unknown	TCP traffic detected without corresponding DNS query: 148.253.248.157
Source: unknown	TCP traffic detected without corresponding DNS query: 204.29.83.146
Source: unknown	TCP traffic detected without corresponding DNS query: 19.146.220.72
Source: unknown	TCP traffic detected without corresponding DNS query: 84.173.219.76
Source: unknown	TCP traffic detected without corresponding DNS query: 212.97.59.100
Source: unknown	TCP traffic detected without corresponding DNS query: 216.244.151.217
Source: unknown	TCP traffic detected without corresponding DNS query: 151.252.165.202
Source: unknown	TCP traffic detected without corresponding DNS query: 70.236.205.126
Source: unknown	TCP traffic detected without corresponding DNS query: 165.132.192.234
Source: unknown	TCP traffic detected without corresponding DNS query: 88.255.80.37
Source: unknown	TCP traffic detected without corresponding DNS query: 1.8.131.199
Source: unknown	TCP traffic detected without corresponding DNS query: 148.20.142.145
Source: unknown	TCP traffic detected without corresponding DNS query: 171.116.195.2
Source: unknown	TCP traffic detected without corresponding DNS query: 244.86.122.114
Source: unknown	TCP traffic detected without corresponding DNS query: 98.85.9.75
Source: unknown	TCP traffic detected without corresponding DNS query: 177.37.177.16
Source: unknown	TCP traffic detected without corresponding DNS query: 19.233.156.173
Source: unknown	TCP traffic detected without corresponding DNS query: 170.87.192.217
Source: unknown	TCP traffic detected without corresponding DNS query: 144.1.85.199
Source: unknown	TCP traffic detected without corresponding DNS query: 87.150.175.200
Source: unknown	TCP traffic detected without corresponding DNS query: 170.182.31.249
Source: unknown	TCP traffic detected without corresponding DNS query: 48.54.151.32
Source: unknown	TCP traffic detected without corresponding DNS query: 4.219.220.183
Source: unknown	TCP traffic detected without corresponding DNS query: 172.249.94.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.242.139.39
Source: unknown	TCP traffic detected without corresponding DNS query: 73.251.174.154
Source: unknown	TCP traffic detected without corresponding DNS query: 85.42.208.125
Source: unknown	TCP traffic detected without corresponding DNS query: 223.196.222.27
Source: unknown	TCP traffic detected without corresponding DNS query: 247.166.24.48
Source: unknown	TCP traffic detected without corresponding DNS query: 93.249.158.144
Source: unknown	TCP traffic detected without corresponding DNS query: 176.114.81.210
Source: unknown	TCP traffic detected without corresponding DNS query: 86.150.189.118
Source: unknown	TCP traffic detected without corresponding DNS query: 244.77.32.23
Source: unknown	TCP traffic detected without corresponding DNS query: 255.183.216.217
Source: unknown	TCP traffic detected without corresponding DNS query: 180.149.232.90
Source: unknown	TCP traffic detected without corresponding DNS query: 80.245.45.104
Source: unknown	TCP traffic detected without corresponding DNS query: 246.232.184.234
Source: unknown	TCP traffic detected without corresponding DNS query: 124.252.178.182
Source: unknown	TCP traffic detected without corresponding DNS query: 170.166.149.100
Source: unknown	TCP traffic detected without corresponding DNS query: 209.178.6.29
Source: unknown	TCP traffic detected without corresponding DNS query: 2.33.64.209

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.390281742948749
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ZtbAkJUbdl.elf
File size:	84'044 bytes
MD5:	d82b8aed6d880b82d1ba40a88abf9b99
SHA1:	d91ce5dec90dc29f906aca8d5ba57825f80a8049
SHA256:	7219da0b6a1e0e280b91e012f492961df51fdaa05479ad304f85689d33b40084
SHA512:	9d03980059d1029dd13c2d2621e55d19fd9639973a11bdfb8c26c9e943c6e341fef78d077d2373119447f3c8c006dc2ea664e15be27cef3159f77565130424b8
SSDEEP:	1536:qLf0+QM5PHyVwi7f26UiEy+DlOo7HL3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5fH+DMkSJ8FAGocBBum+j
TLSH:	1D832A9AF400DEBCF88BD6BA40664D0EB930A39016920F367767FE933C23095DD56D89
File Content Preview:	.ELF.......................D...4..F......4. ...(......................C...C....... .......C...c...c.......&0...... .dt.Q............................NV..a....da...%.N^NuNV..J9..f\|f>"y..c. QJ.g.X.#...c.N."y..c. QJ.f.A.....J.g.Hy..C.N.X.......f\|N^NuNV..N^NuN

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	83644
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x125de	0x0	0x6	AX	4
.fini	PROGBITS	0x80012686	0x12686	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x80012694	0x12694	0x1d32	0x0	0x2	A	2
.ctors	PROGBITS	0x800163cc	0x143cc	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x800163d4	0x143d4	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x800163e0	0x143e0	0x29c	0x0	0x3	WA	4
.bss	NOBITS	0x8001667c	0x1467c	0x2380	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1467c	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x143c6	0x143c6	6.4260	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x143cc	0x800163cc	0x800163cc	0x2b0	0x2630	1.4995	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Bytes transferred	Direction	Data
2024-02-28 06:50:26 UTC	249	OUT	GET / HTTP/1.1 User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none Accept: / Accept-Encoding: identity Host: motd.ubuntu.com Connection: Keep-Alive
2024-02-28 06:50:26 UTC	271	IN	HTTP/1.1 200 OK Date: Wed, 28 Feb 2024 06:50:26 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 28 Feb 2024 06:45:17 GMT ETag: "d8-6126b7c5ee43a" Accept-Ranges: bytes Content-Length: 216 Vary: Accept-Encoding Connection: close Content-Type: text/plain
2024-02-28 06:50:26 UTC	216	IN	Data Raw: 20 2a 20 53 74 72 69 63 74 6c 79 20 63 6f 6e 66 69 6e 65 64 20 4b 75 62 65 72 6e 65 74 65 73 20 6d 61 6b 65 73 20 65 64 67 65 20 61 6e 64 20 49 6f 54 20 73 65 63 75 72 65 2e 20 4c 65 61 72 6e 20 68 6f 77 20 4d 69 63 72 6f 4b 38 73 0a 20 20 20 6a 75 73 74 20 72 61 69 73 65 64 20 74 68 65 20 62 61 72 20 66 6f 72 20 65 61 73 79 2c 20 72 65 73 69 6c 69 65 6e 74 20 61 6e 64 20 73 65 63 75 72 65 20 4b 38 73 20 63 6c 75 73 74 65 72 20 64 65 70 6c 6f 79 6d 65 6e 74 2e 0a 0a 20 20 20 68 74 74 70 73 3a 2f 2f 75 62 75 6e 74 75 2e 63 6f 6d 2f 65 6e 67 61 67 65 2f 73 65 63 75 72 65 2d 6b 75 62 65 72 6e 65 74 65 73 2d 61 74 2d 74 68 65 2d 65 64 67 65 0a Data Ascii: * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s just raised the bar for easy, resilient and secure K8s cluster deployment. https://ubuntu.com/engage/secure-kubernetes-at-the-edge

Start time (UTC):	06:49:55
Start date (UTC):	28/02/2024
Path:	/tmp/ZtbAkJUbdl.elf
Arguments:	/tmp/ZtbAkJUbdl.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Start time (UTC):	06:50:25
Start date (UTC):	28/02/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Source: global traffic	TCP traffic: 192.168.2.15:55918 -> 91.92.255.169:5555
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 148.253.248.157:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 88.255.80.37:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 48.54.151.32:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 86.150.189.118:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 80.245.45.104:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 65.190.78.179:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 216.148.81.179:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 122.22.81.133:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 20.147.208.65:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 66.118.88.158:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 193.230.197.105:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 207.72.65.237:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 248.188.188.170:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 119.160.89.44:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 200.28.36.84:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 95.204.254.221:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 206.134.181.93:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 202.196.85.185:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 241.79.117.119:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 71.42.16.136:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 76.118.252.142:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 98.146.30.189:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 78.190.94.140:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 43.163.231.69:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 208.112.58.222:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 142.85.191.0:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 175.163.253.85:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 182.212.236.150:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 66.122.161.97:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 2.191.224.51:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 90.128.160.214:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 94.114.245.133:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 151.105.88.186:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 113.170.106.14:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 120.188.200.76:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 108.102.83.235:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 218.179.199.196:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 153.112.103.237:2323
Source: global traffic	TCP traffic: 192.168.2.15:11737 -> 175.226.255.127:2323

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ZtbAkJUbdl.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.RW26Hs (deleted)

/var/cache/motd-news

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

HTTPS Proxied Packets

System Behavior

Analysis Process: ZtbAkJUbdl.elf PID: 5511, Parent PID: 5435

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Prctl Requested

System Activities

Query System Information (uname)

Network Activities

Linux Analysis Report
ZtbAkJUbdl.elf