Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
PylIt4izlJ.elf

Overview

General Information

Sample name:PylIt4izlJ.elf
renamed because original name is a hash value
Original sample name:a648e3916f191a59f47d07a49702d0eb.elf
Analysis ID:1431540
MD5:a648e3916f191a59f47d07a49702d0eb
SHA1:1d9280fd392858f5dbe61aea4cfa2453ade97442
SHA256:0a82c84b8564ae5a178e3e8f6fc4550885055043928ee667e59efb035f9ccfc3
Tags:32elfintelmirai
Infos:

Detection

Score:68
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Machine Learning detection for sample
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Yara signature match

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1431540
Start date and time:2024-04-25 12:20:09 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 37s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:PylIt4izlJ.elf
renamed because original name is a hash value
Original Sample Name:a648e3916f191a59f47d07a49702d0eb.elf
Detection:MAL
Classification:mal68.linELF@0/0@0/0

Runtime Messages

Command:/tmp/PylIt4izlJ.elf
PID:5489
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
DaddyL33T Infected Your Shit
Standard Error:

Process Tree

  • system is lnxubuntu20
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
PylIt4izlJ.elfLinux_Trojan_Mirai_b14f4c5dunknownunknown
  • 0x6e30:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
PylIt4izlJ.elfLinux_Trojan_Mirai_88de437funknownunknown
  • 0x8142:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
PylIt4izlJ.elfLinux_Trojan_Mirai_ae9d0fa6unknownunknown
  • 0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
PylIt4izlJ.elfLinux_Trojan_Mirai_389ee3e9unknownunknown
  • 0x9bf4:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
PylIt4izlJ.elfLinux_Trojan_Mirai_cc93863bunknownunknown
  • 0x874e:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 1 entries

Memory Dumps

SourceRuleDescriptionAuthorStrings
5492.1.0000000008048000.0000000008054000.r-x.sdmpLinux_Trojan_Mirai_b14f4c5dunknownunknown
  • 0x6e30:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5492.1.0000000008048000.0000000008054000.r-x.sdmpLinux_Trojan_Mirai_88de437funknownunknown
  • 0x8142:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5492.1.0000000008048000.0000000008054000.r-x.sdmpLinux_Trojan_Mirai_ae9d0fa6unknownunknown
  • 0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
5492.1.0000000008048000.0000000008054000.r-x.sdmpLinux_Trojan_Mirai_389ee3e9unknownunknown
  • 0x9bf4:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5492.1.0000000008048000.0000000008054000.r-x.sdmpLinux_Trojan_Mirai_cc93863bunknownunknown
  • 0x874e:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 13 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: PylIt4izlJ.elfAvira: detected
Multi AV Scanner detection for submitted file
Source: PylIt4izlJ.elfReversingLabs: Detection: 72%
Source: PylIt4izlJ.elfVirustotal: Detection: 59%Perma Link
Machine Learning detection for sample
Source: PylIt4izlJ.elfJoe Sandbox ML: detected
Source: global trafficTCP traffic: 192.168.2.14:45558 -> 209.14.69.249:666
Source: global trafficTCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownTCP traffic detected without corresponding DNS query: 209.14.69.249
Source: unknownNetwork traffic detected: HTTP traffic on port 46540 -> 443

System Summary

barindex
Malicious sample detected (through community Yara rule)
Source: PylIt4izlJ.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: PylIt4izlJ.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: PylIt4izlJ.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: PylIt4izlJ.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: PylIt4izlJ.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: PylIt4izlJ.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5492.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5492.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5492.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5492.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5492.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5492.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5490.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5490.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5490.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5490.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5490.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5490.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5489.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5489.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5489.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5489.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5489.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5489.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: ELF static info symbol of initial sample.symtab present: no
Source: PylIt4izlJ.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: PylIt4izlJ.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: PylIt4izlJ.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: PylIt4izlJ.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: PylIt4izlJ.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: PylIt4izlJ.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5492.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5492.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5492.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5492.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5490.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5490.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5490.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5490.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5489.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5489.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5489.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: classification engineClassification label: mal68.linELF@0/0@0/0

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume AccessOS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Standard Port		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
PylIt4izlJ.elf73%ReversingLabsLinux.Trojan.Mirai
PylIt4izlJ.elf60%VirustotalBrowse
PylIt4izlJ.elf100%AviraEXP/ELF.Mirai.T
PylIt4izlJ.elf100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
185.125.190.26
unknownUnited Kingdom
41231CANONICAL-ASGBfalse
209.14.69.249
unknownUnited States
6220AS6220USfalse

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
185.125.190.26SecuriteInfo.com.Trojan.Linux.GenericKD.24576.11147.21229.elfGet hashmaliciousUnknownBrowse
    SecuriteInfo.com.Trojan.Linux.GenericKD.24541.15958.30966.elfGet hashmaliciousUnknownBrowse
      SecuriteInfo.com.Other.Malware-gen.31307.16494.elfGet hashmaliciousMiraiBrowse
        gFHZn3Ck3v.elfGet hashmaliciousUnknownBrowse
          2V7qaSy0Jl.elfGet hashmaliciousUnknownBrowse
            EfsIiZhHxS.elfGet hashmaliciousGafgyt, MiraiBrowse
              7Ud8fq8tJs.elfGet hashmaliciousGafgytBrowse
                C1Dd84tB3n.elfGet hashmaliciousUnknownBrowse
                  73wSOh7A9P.elfGet hashmaliciousUnknownBrowse
                    az9a0rNKvy.elfGet hashmaliciousMirai, OkiruBrowse

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      AS6220USsora.armGet hashmaliciousMiraiBrowse
                      • 207.166.94.107
                      s422uUu30YGet hashmaliciousMiraiBrowse
                      • 209.14.76.114
                      37F1aDw0RcGet hashmaliciousMiraiBrowse
                      • 207.166.94.118
                      CANONICAL-ASGBTGIQpNxMb0.elfGet hashmaliciousMiraiBrowse
                      • 91.189.91.42
                      qnW5l5IegwGet hashmaliciousXmrigBrowse
                      • 91.189.91.42
                      SecuriteInfo.com.Linux.Siggen.9999.28857.26683.elfGet hashmaliciousMiraiBrowse
                      • 91.189.91.42
                      SecuriteInfo.com.Trojan.Linux.GenericKD.24576.11147.21229.elfGet hashmaliciousUnknownBrowse
                      • 185.125.190.26
                      SecuriteInfo.com.Trojan.Linux.GenericKD.24541.15958.30966.elfGet hashmaliciousUnknownBrowse
                      • 185.125.190.26
                      SecuriteInfo.com.Other.Malware-gen.3200.4135.elfGet hashmaliciousMiraiBrowse
                      • 91.189.91.42
                      SecuriteInfo.com.Other.Malware-gen.31307.16494.elfGet hashmaliciousMiraiBrowse
                      • 185.125.190.26
                      SecuriteInfo.com.Linux.Siggen.6954.6684.13146.elfGet hashmaliciousMiraiBrowse
                      • 91.189.91.42
                      http://94.156.79.129/i686Get hashmaliciousUnknownBrowse
                      • 91.189.91.42
                      0ADLfPX6HX.elfGet hashmaliciousUnknownBrowse
                      • 91.189.91.42

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      ⊘No created / dropped files found

                      Static File Info

                      General

                      File type:ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
                      Entropy (8bit):6.3413078097296
                      TrID:
                      • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
                      • ELF Executable and Linkable format (generic) (4004/1) 49.84%
                      File name:PylIt4izlJ.elf
                      File size:48'112 bytes
                      MD5:a648e3916f191a59f47d07a49702d0eb
                      SHA1:1d9280fd392858f5dbe61aea4cfa2453ade97442
                      SHA256:0a82c84b8564ae5a178e3e8f6fc4550885055043928ee667e59efb035f9ccfc3
                      SHA512:73ef7ce042d0d165c327acd50e984a08b3d8450fb8821c8ef390a8dc02044128836ba7590bd035a072a9b7a4c94defed1256e85b03887788fa998e5648b5e587
                      SSDEEP:768:urVYfMiOGjzjpnhFUUnq+shf9xT6DlIfpVnJ5W1b8qIxmrLsCjLLLLLLLLLLLL6K:BfMiOGzVnhFfnq+qf9xT6DlIfzJE1b32
                      TLSH:A12328C2654BE9FCEC164EB92272E3329B36B83F112CE957D399D6239C83A00D547199
                      File Content Preview:.ELF....................d...4...`.......4. ...(..............................................H...H..\...............Q.td............................U..S.......;....h....#...[]...$.............U......= J...t..5.....I......I......u........t....h.8..........

                      Static ELF Info

                      ELF header

                      Class:ELF32
                      Data:2's complement, little endian
                      Version:1 (current)
                      Machine:Intel 80386
                      Version Number:0x1
                      Type:EXEC (Executable file)
                      OS/ABI:UNIX - System V
                      ABI Version:0
                      Entry Point Address:0x8048164
                      Flags:0x0
                      ELF Header Size:52
                      Program Header Offset:52
                      Program Header Size:32
                      Number of Program Headers:3
                      Section Header Offset:47712
                      Section Header Size:40
                      Number of Section Headers:10
                      Header String Table Index:9

                      Sections

                      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                      NULL0x00x00x00x00x0000
                      .initPROGBITS0x80480940x940x1c0x00x6AX001
                      .textPROGBITS0x80480b00xb00xa6460x00x6AX0016
                      .finiPROGBITS0x80526f60xa6f60x170x00x6AX001
                      .rodataPROGBITS0x80527200xa7200x11a00x00x2A0032
                      .ctorsPROGBITS0x80548c40xb8c40x80x00x3WA004
                      .dtorsPROGBITS0x80548cc0xb8cc0x80x00x3WA004
                      .dataPROGBITS0x80549000xb9000x1200x00x3WA0032
                      .bssNOBITS0x8054a200xba200x5800x00x3WA0032
                      .shstrtabSTRTAB0x00xba200x3e0x00x0001

                      Program Segments

                      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                      LOAD0x00x80480000x80480000xb8c00xb8c06.36360x5R E0x1000.init .text .fini .rodata
                      LOAD0xb8c40x80548c40x80548c40x15c0x6dc4.26390x6RW 0x1000.ctors .dtors .data .bss
                      GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                      Network Behavior

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Apr 25, 2024 12:20:53.360436916 CEST45558666192.168.2.14209.14.69.249
                      Apr 25, 2024 12:20:53.602277040 CEST66645558209.14.69.249192.168.2.14
                      Apr 25, 2024 12:20:53.602401018 CEST45558666192.168.2.14209.14.69.249
                      Apr 25, 2024 12:20:53.602564096 CEST45558666192.168.2.14209.14.69.249
                      Apr 25, 2024 12:20:53.844063997 CEST66645558209.14.69.249192.168.2.14
                      Apr 25, 2024 12:20:53.844192028 CEST45558666192.168.2.14209.14.69.249
                      Apr 25, 2024 12:20:54.085843086 CEST66645558209.14.69.249192.168.2.14
                      Apr 25, 2024 12:21:02.815592051 CEST46540443192.168.2.14185.125.190.26
                      Apr 25, 2024 12:21:03.609436989 CEST45558666192.168.2.14209.14.69.249
                      Apr 25, 2024 12:21:03.851238012 CEST66645558209.14.69.249192.168.2.14
                      Apr 25, 2024 12:21:03.851299047 CEST66645558209.14.69.249192.168.2.14
                      Apr 25, 2024 12:21:03.851454020 CEST45558666192.168.2.14209.14.69.249
                      Apr 25, 2024 12:21:19.120484114 CEST66645558209.14.69.249192.168.2.14
                      Apr 25, 2024 12:21:19.120855093 CEST45558666192.168.2.14209.14.69.249
                      Apr 25, 2024 12:21:33.790329933 CEST46540443192.168.2.14185.125.190.26
                      Apr 25, 2024 12:21:34.362341881 CEST66645558209.14.69.249192.168.2.14
                      Apr 25, 2024 12:21:34.362740993 CEST45558666192.168.2.14209.14.69.249
                      Apr 25, 2024 12:21:49.392328978 CEST66645558209.14.69.249192.168.2.14
                      Apr 25, 2024 12:21:49.392790079 CEST45558666192.168.2.14209.14.69.249
                      Apr 25, 2024 12:22:03.902075052 CEST45558666192.168.2.14209.14.69.249
                      Apr 25, 2024 12:22:04.146195889 CEST66645558209.14.69.249192.168.2.14
                      Apr 25, 2024 12:22:04.146452904 CEST45558666192.168.2.14209.14.69.249
                      Apr 25, 2024 12:22:19.440639019 CEST66645558209.14.69.249192.168.2.14
                      Apr 25, 2024 12:22:19.440850973 CEST45558666192.168.2.14209.14.69.249
                      Apr 25, 2024 12:22:34.685910940 CEST66645558209.14.69.249192.168.2.14
                      Apr 25, 2024 12:22:34.686392069 CEST45558666192.168.2.14209.14.69.249
                      Apr 25, 2024 12:22:49.927809000 CEST66645558209.14.69.249192.168.2.14
                      Apr 25, 2024 12:22:49.928278923 CEST45558666192.168.2.14209.14.69.249

                      System Behavior

                      General

                      Start time (UTC):10:20:52
                      Start date (UTC):25/04/2024
                      Path:/tmp/PylIt4izlJ.elf
                      Arguments:/tmp/PylIt4izlJ.elf
                      File size:48112 bytes
                      MD5 hash:a648e3916f191a59f47d07a49702d0eb

                      Chronological Activities


                      General

                      Start time (UTC):10:20:52
                      Start date (UTC):25/04/2024
                      Path:/tmp/PylIt4izlJ.elf
                      Arguments:-
                      File size:48112 bytes
                      MD5 hash:a648e3916f191a59f47d07a49702d0eb

                      Chronological Activities


                      General

                      Start time (UTC):10:20:52
                      Start date (UTC):25/04/2024
                      Path:/tmp/PylIt4izlJ.elf
                      Arguments:-
                      File size:48112 bytes
                      MD5 hash:a648e3916f191a59f47d07a49702d0eb

                      Chronological Activities


                      General

                      Start time (UTC):10:20:52
                      Start date (UTC):25/04/2024
                      Path:/tmp/PylIt4izlJ.elf
                      Arguments:-
                      File size:48112 bytes
                      MD5 hash:a648e3916f191a59f47d07a49702d0eb

                      Chronological Activities