Edit tour

Linux Analysis Report
icgYDPuGqT.elf

Overview

General Information

Sample name:	icgYDPuGqT.elf renamed because original name is a hash value
Original sample name:	ca0d5a5c133e2bbf869c85c919674387.elf
Analysis ID:	1441967
MD5:	ca0d5a5c133e2bbf869c85c919674387
SHA1:	0d2a30a474c8726c1e284e167d73215834540d5e
SHA256:	afbb42ca639450f0003fcbe5aebdcf3cdc67bed633ded906a7cffcde5e13fb95
Tags:	32elfmiraimotorola
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1441967
Start date and time:	2024-05-15 14:29:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	icgYDPuGqT.elf renamed because original name is a hash value
Original Sample Name:	ca0d5a5c133e2bbf869c85c919674387.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/0@2/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/icgYDPuGqT.elf
PID:	5517
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

icgYDPuGqT.elf (PID: 5517, Parent: 5440, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/icgYDPuGqT.elf

icgYDPuGqT.elf New Fork (PID: 5519, Parent: 5517)

icgYDPuGqT.elf New Fork (PID: 5665, Parent: 5519)

icgYDPuGqT.elf New Fork (PID: 5668, Parent: 5519)

icgYDPuGqT.elf New Fork (PID: 5672, Parent: 5668)

icgYDPuGqT.elf New Fork (PID: 5688, Parent: 5672)

icgYDPuGqT.elf New Fork (PID: 5690, Parent: 5672)

icgYDPuGqT.elf New Fork (PID: 5675, Parent: 5668)

icgYDPuGqT.elf New Fork (PID: 5676, Parent: 5668)

icgYDPuGqT.elf New Fork (PID: 5520, Parent: 5517)

icgYDPuGqT.elf New Fork (PID: 5521, Parent: 5517)

icgYDPuGqT.elf New Fork (PID: 5525, Parent: 5521)

icgYDPuGqT.elf New Fork (PID: 5664, Parent: 5525)

icgYDPuGqT.elf New Fork (PID: 5666, Parent: 5525)

icgYDPuGqT.elf New Fork (PID: 5526, Parent: 5521)

icgYDPuGqT.elf New Fork (PID: 5528, Parent: 5521)

dash New Fork (PID: 5575, Parent: 3670)

rm (PID: 5575, Parent: 3670, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.p4jtwGEaCv /tmp/tmp.aoduX730i7 /tmp/tmp.Iq637EO8TU

dash New Fork (PID: 5576, Parent: 3670)

cat (PID: 5576, Parent: 3670, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.p4jtwGEaCv

dash New Fork (PID: 5577, Parent: 3670)

head (PID: 5577, Parent: 3670, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5578, Parent: 3670)

tr (PID: 5578, Parent: 3670, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5579, Parent: 3670)

cut (PID: 5579, Parent: 3670, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5580, Parent: 3670)

cat (PID: 5580, Parent: 3670, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.p4jtwGEaCv

dash New Fork (PID: 5581, Parent: 3670)

head (PID: 5581, Parent: 3670, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 5582, Parent: 3670)

tr (PID: 5582, Parent: 3670, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 5583, Parent: 3670)

cut (PID: 5583, Parent: 3670, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 5584, Parent: 3670)

rm (PID: 5584, Parent: 3670, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.p4jtwGEaCv /tmp/tmp.aoduX730i7 /tmp/tmp.Iq637EO8TU

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
icgYDPuGqT.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
icgYDPuGqT.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x111c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11205:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11219:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1122d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11241:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11255:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11269:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1127d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11291:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11309:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1131d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11331:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11345:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11359:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5520.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5520.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x111c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11205:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11219:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1122d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11241:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11255:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11269:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1127d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11291:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11309:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1131d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11331:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11345:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11359:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5519.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5519.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x111c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11205:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11219:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1122d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11241:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11255:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11269:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1127d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11291:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11309:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1131d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11331:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11345:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11359:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5664.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5664.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x111c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11205:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11219:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1122d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11241:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11255:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11269:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1127d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11291:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11309:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1131d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11331:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11345:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11359:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5665.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5665.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x111c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11205:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11219:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1122d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11241:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11255:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11269:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1127d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11291:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11309:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1131d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11331:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11345:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11359:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5675.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5675.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x111c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11205:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11219:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1122d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11241:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11255:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11269:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1127d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11291:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11309:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1131d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11331:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11345:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11359:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5517.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5517.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x111c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11205:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11219:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1122d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11241:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11255:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11269:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1127d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11291:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11309:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1131d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11331:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11345:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11359:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5688.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5688.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x111c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11205:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11219:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1122d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11241:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11255:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11269:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1127d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11291:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11309:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1131d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11331:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11345:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11359:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5526.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5526.1.00007f70cc001000.00007f70cc014000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x111c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11205:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11219:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1122d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11241:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11255:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11269:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1127d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11291:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x112f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11309:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1131d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11331:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11345:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11359:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: icgYDPuGqT.elf PID: 5517	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x462e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4642:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4656:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x466a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x467e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4692:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x46a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x46ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x46ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x46e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x46f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x470a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x471e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4732:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4746:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x475a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x476e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4782:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4796:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x47aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x47be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: icgYDPuGqT.elf PID: 5519	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xddd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdde7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddfb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde9b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdeaf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdec3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xded7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdeeb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdeff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: icgYDPuGqT.elf PID: 5520	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xfde:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1006:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x101a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x102e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1042:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1056:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1092:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1132:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1146:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x115a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x116e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: icgYDPuGqT.elf PID: 5664	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x146c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x150c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: icgYDPuGqT.elf PID: 5665	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf45:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf59:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf6d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf81:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf95:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfa9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfbd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfe5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xff9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x100d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1021:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1035:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1049:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x105d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1071:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1085:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1099:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: icgYDPuGqT.elf PID: 5675	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3729:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x373d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3751:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3765:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3779:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x378d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x37f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3805:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3819:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x382d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3841:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3855:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3869:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x387d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3891:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x38b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: icgYDPuGqT.elf PID: 5688	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4047:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x405b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x406f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4083:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4097:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x410f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4123:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4137:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x414b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x415f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4173:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4187:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x419b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 18 entries

Snort Signatures

ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) - Source IP: 192.168.2.15 - Destination IP: 59.45.131.166

Timestamp:	05/15/24-14:31:46.684858
SID:	2829347
Source Port:	57508
Destination Port:	23
Protocol:	TCP
Classtype:	Attempted Information Leak

ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) - Source IP: 192.168.2.15 - Destination IP: 59.45.131.166

Timestamp:	05/15/24-14:31:59.278767
SID:	2829347
Source Port:	57546
Destination Port:	23
Protocol:	TCP
Classtype:	Attempted Information Leak

ET TROJAN Possible Linux.Mirai Login Attempt (ubnt) - Source IP: 192.168.2.15 - Destination IP: 39.40.132.27

Timestamp:	05/15/24-14:33:21.484089
SID:	2023448
Source Port:	35898
Destination Port:	23
Protocol:	TCP
Classtype:	Attempted Administrator Privilege Gain

HTTP traffic detected: GET / HTTP/1.1User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/noneAccept: */*Accept-Encoding: identityHost: motd.ubuntu.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36266
Source: unknown	Network traffic detected: HTTP traffic on port 36266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44524 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: icgYDPuGqT.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5520.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5519.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5664.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5665.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5675.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5517.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5688.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5526.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: icgYDPuGqT.elf PID: 5517, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: icgYDPuGqT.elf PID: 5519, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: icgYDPuGqT.elf PID: 5520, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: icgYDPuGqT.elf PID: 5664, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: icgYDPuGqT.elf PID: 5665, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: icgYDPuGqT.elf PID: 5675, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: icgYDPuGqT.elf PID: 5688, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/icgYDPuGqT.elf (PID: 5519)	SIGKILL sent: pid: 933, result: successful			Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	SIGKILL sent: pid: 933, result: successful			Jump to behavior

Source: icgYDPuGqT.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5520.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5519.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5664.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5665.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5675.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5517.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5688.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5526.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: icgYDPuGqT.elf PID: 5517, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: icgYDPuGqT.elf PID: 5519, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: icgYDPuGqT.elf PID: 5520, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: icgYDPuGqT.elf PID: 5664, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: icgYDPuGqT.elf PID: 5665, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: icgYDPuGqT.elf PID: 5675, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: icgYDPuGqT.elf PID: 5688, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.troj.linELF@0/0@2/0

Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/490/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/793/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/794/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/850/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/796/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/931/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/779/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/812/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/933/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/917/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/782/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/764/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/766/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/723/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/789/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/888/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/724/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/802/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/803/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5519)	File opened: /proc/804/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/490/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/793/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/794/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/850/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/796/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/931/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/779/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/812/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/933/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/917/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/782/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/764/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/766/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/723/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/789/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/888/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/724/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/802/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/803/fd	Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	File opened: /proc/804/fd	Jump to behavior

Source: /usr/bin/dash (PID: 5575)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.p4jtwGEaCv /tmp/tmp.aoduX730i7 /tmp/tmp.Iq637EO8TU			Jump to behavior
Source: /usr/bin/dash (PID: 5584)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.p4jtwGEaCv /tmp/tmp.aoduX730i7 /tmp/tmp.Iq637EO8TU			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49346
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49352
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49374
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49382
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49388
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49390
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49398
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49400
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49426
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 49432
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59888
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59896
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59906
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59910
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59920
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59926
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59932
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59940
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59946
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59950
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38124
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38138
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 48684
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38158
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 48704
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38176
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 48716
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38186
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 48730
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38200
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 48746
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38214
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 48762
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38232
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 48778
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38250
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 48794
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38258
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 48804
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56600
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 48824
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56612
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56628
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56664
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56682
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56710
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56766
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56828
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56840
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 56848
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43318
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43326
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43348
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43360
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43372
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43384
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43398
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43420
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43444
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 43466
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59562
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59572
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59580
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59596
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59616
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 59624

Source: /tmp/icgYDPuGqT.elf (PID: 5517)

Queries kernel information via 'uname':

Jump to behavior

Source: icgYDPuGqT.elf, 5517.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5519.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5665.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5688.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5675.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5520.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5664.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5526.1.00005626fd80f000.00005626fd894000.rw-.sdmp	Binary or memory string: &V!/etc/qemu-binfmt/m68k
Source: icgYDPuGqT.elf, 5517.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5519.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5665.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5688.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5675.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5520.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5664.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5526.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/icgYDPuGqT.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/icgYDPuGqT.elf
Source: icgYDPuGqT.elf, 5517.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5519.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5665.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5688.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5675.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5520.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5664.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp, icgYDPuGqT.elf, 5526.1.00007fffbf06f000.00007fffbf090000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: icgYDPuGqT.elf, 5517.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5519.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5665.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5688.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5675.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5520.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5664.1.00005626fd80f000.00005626fd894000.rw-.sdmp, icgYDPuGqT.elf, 5526.1.00005626fd80f000.00005626fd894000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: icgYDPuGqT.elf, type: SAMPLE
Source: Yara match	File source: 5520.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5519.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5664.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5665.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5675.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5517.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5688.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5526.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Detected Mirai

Source: Traffic

Snort IDS: ET TROJAN Possible Linux.Mirai Login Attempt (ubnt)

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: icgYDPuGqT.elf, type: SAMPLE
Source: Yara match	File source: 5520.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5519.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5664.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5665.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5675.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5517.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5688.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5526.1.00007f70cc001000.00007f70cc014000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
icgYDPuGqT.elf	61%	ReversingLabs	Linux.Trojan.Mirai
icgYDPuGqT.elf	58%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
daisy.ubuntu.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://motd.ubuntu.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://motd.ubuntu.com/	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
16.116.70.85	unknown	United States	unknown	unknown	false
251.25.165.83	unknown	Reserved	unknown	unknown	false
133.86.79.32	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
204.95.255.97	unknown	United States	1239	SPRINTLINKUS	false
155.196.12.191	unknown	Sudan	37197	SUDRENSD	false
90.77.123.135	unknown	France	12479	UNI2-ASES	false
181.17.147.114	unknown	Venezuela	27889	TelecomunicacionesMOVILNETVE	false
170.11.192.71	unknown	United States	1621	ASN-SECURIANUS	false
90.80.89.44	unknown	France	3215	FranceTelecom-OrangeFR	false
79.62.227.207	unknown	Italy	3269	ASN-IBSNAZIT	false
75.196.99.2	unknown	United States	22394	CELLCOUS	false
197.129.211.56	unknown	Morocco	6713	IAM-ASMA	false
242.95.24.186	unknown	Reserved	unknown	unknown	false
191.19.149.218	unknown	Brazil	27699	TELEFONICABRASILSABR	false
241.131.78.53	unknown	Reserved	unknown	unknown	false
126.174.103.179	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
141.236.124.253	unknown	United States	5972	DNIC-ASBLK-05800-06055US	false
68.158.27.161	unknown	United States	7018	ATT-INTERNET4US	false
87.164.2.77	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
19.160.246.201	unknown	United States	3	MIT-GATEWAYSUS	false
62.34.129.225	unknown	France	5410	BOUYGTEL-ISPFR	false
213.190.108.84	unknown	Iceland	25509	VORTEX-ASSkulagotu19IS	false
181.104.232.174	unknown	Argentina	6147	TelefonicadelPeruSAAPE	false
85.216.41.179	unknown	Germany	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
123.149.29.123	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
121.6.104.117	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	false
244.210.21.43	unknown	Reserved	unknown	unknown	false
198.127.95.169	unknown	United States	291	ESNET-EASTUS	false
222.13.19.25	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
99.66.89.58	unknown	United States	7018	ATT-INTERNET4US	false
97.21.12.69	unknown	United States	22394	CELLCOUS	false
24.29.43.168	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
62.213.110.33	unknown	Russian Federation	25227	ASN-AVANTEL-MSKLocatedinMoscowRussiaRU	false
186.239.252.153	unknown	Brazil	10429	TELEFONICABRASILSABR	false
32.217.248.236	unknown	United States	46690	SNET-FCCUS	false
208.78.192.200	unknown	United States	11763	IBX-CHICAGOUS	false
202.159.212.72	unknown	India	17813	MTNL-APMahanagarTelephoneNigamLimitedIN	false
153.108.109.238	unknown	Switzerland	24952	FIRMENICH-ASCH	false
74.33.27.103	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
16.197.86.62	unknown	United States	unknown	unknown	false
74.162.214.27	unknown	United States	10796	TWC-10796-MIDWESTUS	false
194.206.179.220	unknown	France	3215	FranceTelecom-OrangeFR	false
8.138.223.22	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
65.40.218.47	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
36.99.183.84	unknown	China	137687	CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	false
194.183.76.177	unknown	San Marino	15433	TISMTelecomItaliaSanMarinoSM	false
80.5.214.197	unknown	United Kingdom	5089	NTLGB	false
255.41.118.189	unknown	Reserved	unknown	unknown	false
2.184.242.160	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
255.92.16.172	unknown	Reserved	unknown	unknown	false
189.233.226.108	unknown	Mexico	8151	UninetSAdeCVMX	false
202.24.151.222	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
205.245.131.144	unknown	United States	2379	CENTURYLINK-LEGACY-EMBARQ-WNPKUS	false
83.58.127.140	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
203.156.118.122	unknown	Thailand	45455	TH-2S1N-APTwoSOneNCoLtdInternetServiceProviderand	false
156.247.76.131	unknown	Seychelles	54600	PEGTECHINCUS	false
20.17.17.211	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
149.140.248.10	unknown	Turkey	8386	KOCNETTR	false
40.246.145.11	unknown	United States	4249	LILLY-ASUS	false
39.99.251.26	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
163.123.202.22	unknown	Reserved	1767	ILIGHT-NETUS	false
106.135.68.188	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
255.169.87.255	unknown	Reserved	unknown	unknown	false
5.108.208.229	unknown	Saudi Arabia	35819	MOBILY-ASEtihadEtisalatCompanyMobilySA	false
222.117.63.161	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
62.171.20.226	unknown	Switzerland	8821	TELEZUGWWZTelekomAGTELEZUGCH	false
67.164.149.55	unknown	United States	7922	COMCAST-7922US	false
105.11.128.154	unknown	South Africa	37168	CELL-CZA	false
14.254.104.199	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
162.127.82.41	unknown	United States	11714	NETWORKNEBRASKAUS	false
153.178.28.207	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
14.218.222.248	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
186.195.100.224	unknown	Brazil	262720	MELOTELECOMUNICACOESLTDABR	false
222.121.249.5	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
90.114.154.169	unknown	France	3215	FranceTelecom-OrangeFR	false
35.63.23.87	unknown	United States	397797	CITYOFMARSHALL-01US	false
165.1.159.8	unknown	United States	7297	AP-ASUS	false
80.3.59.135	unknown	United Kingdom	5089	NTLGB	false
144.20.235.246	unknown	Sweden	58541	CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN	false
85.155.51.116	unknown	Spain	6739	ONO-ASCableuropa-ONOES	false
101.66.29.213	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
53.32.167.63	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
210.198.12.225	unknown	Japan	7514	MEXComputerEngineeringConsultingLtdJP	false
176.168.50.82	unknown	France	5410	BOUYGTEL-ISPFR	false
133.198.203.46	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
203.208.237.153	unknown	Singapore	9911	CONNECTPLUS-APSingaporeTelecomSG	false
89.127.81.74	unknown	Ireland	25441	IBIS-ASImagineGroupLtdIE	false
116.197.95.199	unknown	Malaysia	10081	DIGI-MYDiGiTelecommunicationsSdnBhdMY	false
244.25.157.137	unknown	Reserved	unknown	unknown	false
192.253.43.22	unknown	United States	394384	EDGE-BROADBANDUS	false
201.135.21.73	unknown	Mexico	8151	UninetSAdeCVMX	false
248.200.221.48	unknown	Reserved	unknown	unknown	false
179.148.48.254	unknown	Brazil	26599	TELEFONICABRASILSABR	false
166.145.186.139	unknown	United States	22394	CELLCOUS	false
197.238.77.177	unknown	unknown	37705	TOPNETTN	false
96.124.177.131	unknown	United States	7922	COMCAST-7922US	false
4.125.80.125	unknown	United States	3356	LEVEL3US	false
38.89.204.146	unknown	United States	174	COGENT-174US	false
165.37.73.101	unknown	United States	37053	RSAWEB-ASZA	false
38.174.139.1	unknown	United States	174	COGENT-174US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
241.131.78.53	FoXUNDQoE9	Get hash	malicious	Mirai	Browse
133.86.79.32	UQK8tt3qKC.elf	Get hash	malicious	Mirai	Browse
204.95.255.97	sora.arm7	Get hash	malicious	Mirai	Browse
79.62.227.207	bot.mpsl.elf	Get hash	malicious	Mirai	Browse
126.174.103.179	t684cbmCtc.elf	Get hash	malicious	Mirai	Browse
126.174.103.179	Y3DDAV07CG	Get hash	malicious	Mirai	Browse
141.236.124.253	sora.arm.elf	Get hash	malicious	Mirai	Browse
155.196.12.191	1isequal9.arm-20220531-0950	Get hash	malicious	Unknown	Browse
75.196.99.2	Umfq5XXRWf.elf	Get hash	malicious	Mirai	Browse
181.17.147.114	8mZC2r0sUz	Get hash	malicious	Unknown	Browse
181.17.147.114	sora.arm7	Get hash	malicious	Mirai	Browse
197.129.211.56	8EuhBAFf2b.elf	Get hash	malicious	Mirai, Moobot	Browse
197.129.211.56	SecuriteInfo.com.Linux.Siggen.9999.27627.8892	Get hash	malicious	Mirai	Browse
242.95.24.186	sora.x86	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	muAZlKU0hq.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	lUn1lFKEJq.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	msPLtZiPcA.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	byKLI4nzv2.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	VxrYNgC0xs.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	ENu3Pj6ZOC.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	SecuriteInfo.com.Trojan.Linux.Gafgyt.6656.12477.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	SecuriteInfo.com.Trojan.Linux.Gafgyt.6945.1081.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	SecuriteInfo.com.Trojan.Linux.Gafgyt.31959.25788.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SUDRENSD	sBgS8t0K7i.elf	Get hash	malicious	Mirai	Browse	155.197.159.88
	SocUwyIjOh.elf	Get hash	malicious	Mirai	Browse	197.251.49.222
	H6ccnU1094.elf	Get hash	malicious	Mirai, Okiru	Browse	197.251.97.131
	dPFRrhKTeG.elf	Get hash	malicious	Unknown	Browse	155.196.171.143
	Vedtb2CYvY.elf	Get hash	malicious	Mirai	Browse	197.251.97.177
	GjWh3Nar5c.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.251.56.1
	H8wnVxIEh6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.251.50.166
	WIb2MCrHFc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.251.50.154
	3FWcPHiVPC.elf	Get hash	malicious	Mirai	Browse	155.197.201.140
	PhvvLCLFym.elf	Get hash	malicious	Mirai	Browse	197.251.50.120
SPRINTLINKUS	muAZlKU0hq.elf	Get hash	malicious	Mirai	Browse	63.175.201.84
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	206.229.162.0
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse	65.163.214.131
	aowNKqhrAX.elf	Get hash	malicious	Mirai	Browse	173.107.35.216
	x86_huawei	Get hash	malicious	Gafgyt, Mirai	Browse	64.133.108.60
	9bRba4KOfR.elf	Get hash	malicious	Mirai	Browse	63.180.237.2
	rnnTivv9Q5.elf	Get hash	malicious	Mirai	Browse	173.107.83.113
	3bmkUo9WvY.elf	Get hash	malicious	Mirai	Browse	208.19.90.211
	qMh36Rvh4J.elf	Get hash	malicious	Mirai	Browse	204.105.4.84
	WDzkAh06Pf.elf	Get hash	malicious	Mirai	Browse	204.97.44.232
TelecomunicacionesMOVILNETVE	FaKcYgqu4i.elf	Get hash	malicious	Unknown	Browse	181.34.118.254
	p67UidesWn.elf	Get hash	malicious	Mirai	Browse	181.35.46.244
	sora.arm.elf	Get hash	malicious	Mirai	Browse	181.17.48.143
	f8txrlLgsG.elf	Get hash	malicious	Mirai	Browse	181.17.147.156
	bnNLsZqj8B.elf	Get hash	malicious	Mirai	Browse	181.19.238.226
	x86.elf	Get hash	malicious	Mirai	Browse	181.19.238.204
	6UN4xYCTnf.elf	Get hash	malicious	Mirai	Browse	181.19.238.214
	kZX5U74quv.elf	Get hash	malicious	Mirai	Browse	190.76.228.210
	lYMzLERz9v.elf	Get hash	malicious	Unknown	Browse	181.17.147.129
	57MarRRXFN.elf	Get hash	malicious	Mirai	Browse	181.18.27.171
SINET-ASResearchOrganizationofInformationandSystemsN	1pvn30a8IT.elf	Get hash	malicious	Mirai	Browse	160.15.35.153
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	133.220.199.219
	msPLtZiPcA.elf	Get hash	malicious	Mirai	Browse	157.105.123.89
	VxrYNgC0xs.elf	Get hash	malicious	Mirai	Browse	144.213.16.140
	x86_huawei	Get hash	malicious	Gafgyt, Mirai	Browse	157.6.53.114
	Y6S9UtMNT1.elf	Get hash	malicious	Mirai	Browse	133.32.164.90
	h5jtx8DXVf.elf	Get hash	malicious	Unknown	Browse	133.187.166.238
	z5tLjmo4GP.elf	Get hash	malicious	Mirai	Browse	133.103.194.184
	HepvgtsxX7.elf	Get hash	malicious	Mirai	Browse	160.14.239.107
	FaKcYgqu4i.elf	Get hash	malicious	Unknown	Browse	150.83.182.142
UNI2-ASES	Y6S9UtMNT1.elf	Get hash	malicious	Mirai	Browse	90.165.103.110
	FOTO MULTA NACIONAL.vbs	Get hash	malicious	Remcos, PrivateLoader	Browse	85.60.29.68
	h5jtx8DXVf.elf	Get hash	malicious	Unknown	Browse	85.50.234.239
	FaKcYgqu4i.elf	Get hash	malicious	Unknown	Browse	90.162.109.230
	67gneXXY2P.elf	Get hash	malicious	Unknown	Browse	92.179.172.38
	16sbYI4aDX.elf	Get hash	malicious	Unknown	Browse	37.135.7.184
	jew.arm.elf	Get hash	malicious	Mirai	Browse	37.132.200.63
	jew.x86.elf	Get hash	malicious	Unknown	Browse	37.132.200.43
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	90.74.129.234
	8mqf8Cm7Tc.elf	Get hash	malicious	Mirai	Browse	37.35.193.55

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Source: icgYDPuGqT.elf	ReversingLabs: Detection: 60%
Source: icgYDPuGqT.elf	Virustotal: Detection: 57%			Perma Link

Source: Traffic	Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.15:57508 -> 59.45.131.166:23
Source: Traffic	Snort IDS: 2829347 ETPRO EXPLOIT Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) 192.168.2.15:57546 -> 59.45.131.166:23
Source: Traffic	Snort IDS: 2023448 ET TROJAN Possible Linux.Mirai Login Attempt (ubnt) 192.168.2.15:35898 -> 39.40.132.27:23

Source: /tmp/icgYDPuGqT.elf (PID: 5519)	Socket: 0.0.0.0::0			Jump to behavior
Source: /tmp/icgYDPuGqT.elf (PID: 5525)	Socket: 0.0.0.0::0			Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 5.253.246.126
Source: unknown	TCP traffic detected without corresponding DNS query: 35.68.142.147
Source: unknown	TCP traffic detected without corresponding DNS query: 74.69.205.147
Source: unknown	TCP traffic detected without corresponding DNS query: 254.152.28.162
Source: unknown	TCP traffic detected without corresponding DNS query: 65.30.157.145
Source: unknown	TCP traffic detected without corresponding DNS query: 20.193.157.7
Source: unknown	TCP traffic detected without corresponding DNS query: 197.18.224.75
Source: unknown	TCP traffic detected without corresponding DNS query: 59.203.96.102
Source: unknown	TCP traffic detected without corresponding DNS query: 252.90.88.220
Source: unknown	TCP traffic detected without corresponding DNS query: 241.74.70.214
Source: unknown	TCP traffic detected without corresponding DNS query: 43.175.24.144
Source: unknown	TCP traffic detected without corresponding DNS query: 172.251.171.199
Source: unknown	TCP traffic detected without corresponding DNS query: 93.20.216.246
Source: unknown	TCP traffic detected without corresponding DNS query: 194.7.84.79
Source: unknown	TCP traffic detected without corresponding DNS query: 178.162.138.188
Source: unknown	TCP traffic detected without corresponding DNS query: 255.167.59.185
Source: unknown	TCP traffic detected without corresponding DNS query: 71.147.62.127
Source: unknown	TCP traffic detected without corresponding DNS query: 70.50.156.236
Source: unknown	TCP traffic detected without corresponding DNS query: 208.114.141.176
Source: unknown	TCP traffic detected without corresponding DNS query: 255.238.13.170
Source: unknown	TCP traffic detected without corresponding DNS query: 158.206.33.116
Source: unknown	TCP traffic detected without corresponding DNS query: 120.248.0.191
Source: unknown	TCP traffic detected without corresponding DNS query: 111.60.36.99
Source: unknown	TCP traffic detected without corresponding DNS query: 121.154.219.108
Source: unknown	TCP traffic detected without corresponding DNS query: 95.176.167.120
Source: unknown	TCP traffic detected without corresponding DNS query: 246.67.38.223
Source: unknown	TCP traffic detected without corresponding DNS query: 121.58.30.171
Source: unknown	TCP traffic detected without corresponding DNS query: 8.199.146.98
Source: unknown	TCP traffic detected without corresponding DNS query: 99.94.204.153
Source: unknown	TCP traffic detected without corresponding DNS query: 62.246.186.210
Source: unknown	TCP traffic detected without corresponding DNS query: 171.248.167.24
Source: unknown	TCP traffic detected without corresponding DNS query: 72.241.39.72
Source: unknown	TCP traffic detected without corresponding DNS query: 43.160.84.89
Source: unknown	TCP traffic detected without corresponding DNS query: 99.77.68.154
Source: unknown	TCP traffic detected without corresponding DNS query: 219.16.53.107
Source: unknown	TCP traffic detected without corresponding DNS query: 41.135.227.164
Source: unknown	TCP traffic detected without corresponding DNS query: 159.100.69.49
Source: unknown	TCP traffic detected without corresponding DNS query: 245.13.184.13
Source: unknown	TCP traffic detected without corresponding DNS query: 125.66.124.14
Source: unknown	TCP traffic detected without corresponding DNS query: 36.150.186.47
Source: unknown	TCP traffic detected without corresponding DNS query: 86.115.50.31
Source: unknown	TCP traffic detected without corresponding DNS query: 60.73.171.204
Source: unknown	TCP traffic detected without corresponding DNS query: 175.92.221.57
Source: unknown	TCP traffic detected without corresponding DNS query: 135.150.243.125
Source: unknown	TCP traffic detected without corresponding DNS query: 95.86.217.195
Source: unknown	TCP traffic detected without corresponding DNS query: 169.56.111.21
Source: unknown	TCP traffic detected without corresponding DNS query: 173.96.6.207
Source: unknown	TCP traffic detected without corresponding DNS query: 125.24.253.143
Source: unknown	TCP traffic detected without corresponding DNS query: 216.121.20.213
Source: unknown	TCP traffic detected without corresponding DNS query: 75.17.211.78

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.352460452608833
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	icgYDPuGqT.elf
File size:	77'188 bytes
MD5:	ca0d5a5c133e2bbf869c85c919674387
SHA1:	0d2a30a474c8726c1e284e167d73215834540d5e
SHA256:	afbb42ca639450f0003fcbe5aebdcf3cdc67bed633ded906a7cffcde5e13fb95
SHA512:	159e4346df86c4e192a2d62200e3c448266a63b03c3e41d2a4012b1dc2836458a7e877d20de60762882954307589ff9ecee91eab9ecfe30078c61ce7f824af44
SSDEEP:	1536:2uBIHXEbzEXfB51v6fFjyrlx8NJH4TZwr1TLC1C:UXEvE55J0yJ+vrBLb
TLSH:	B9734B99B4028E7DF98BA97994150E0AF93163C056830F2767ABFED37D73165BC02C46
File Content Preview:	.ELF.......................D...4..+......4. ...(......................)...)....... .......)...I...I....$.......... .dt.Q............................NV..a....da.....N^NuNV..J9..K.f>"y..I. QJ.g.X.#...I.N."y..I. QJ.f.A.....J.g.Hy..).N.X.......K.N^NuNV..N^NuN

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	76788
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x1103a	0x0	0x6	AX	4
.fini	PROGBITS	0x800110e2	0x110e2	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x800110f0	0x110f0	0x189a	0x0	0x2	A	2
.ctors	PROGBITS	0x80014990	0x12990	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x80014998	0x12998	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x800149a4	0x129a4	0x210	0x0	0x3	WA	4
.bss	NOBITS	0x80014bb4	0x12bb4	0x2e8	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x12bb4	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x1298a	0x1298a	6.3784	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x12990	0x80014990	0x80014990	0x224	0x50c	3.0770	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 15, 2024 14:32:32.363668919 CEST	192.168.2.15	8.8.8.8	0xafc0	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
May 15, 2024 14:32:32.363739967 CEST	192.168.2.15	8.8.8.8	0x6087	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 15, 2024 14:32:32.497967005 CEST	8.8.8.8	192.168.2.15	0xafc0	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
May 15, 2024 14:32:32.497967005 CEST	8.8.8.8	192.168.2.15	0xafc0	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-05-15 12:30:22 UTC	249	OUT	GET / HTTP/1.1 User-Agent: wget/1.20.3-1ubuntu1 Ubuntu/20.04.2/LTS GNU/Linux/5.4.0-72-generic/x86_64 Intel(R)/Xeon(R)/Silver/4210/CPU/@/2.20GHz cloud_id/none Accept: / Accept-Encoding: identity Host: motd.ubuntu.com Connection: Keep-Alive
2024-05-15 12:30:23 UTC	271	IN	HTTP/1.1 200 OK Date: Wed, 15 May 2024 12:30:22 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 15 May 2024 12:30:17 GMT ETag: "d8-6187d47f7f233" Accept-Ranges: bytes Content-Length: 216 Vary: Accept-Encoding Connection: close Content-Type: text/plain
2024-05-15 12:30:23 UTC	216	IN	Data Raw: 20 2a 20 53 74 72 69 63 74 6c 79 20 63 6f 6e 66 69 6e 65 64 20 4b 75 62 65 72 6e 65 74 65 73 20 6d 61 6b 65 73 20 65 64 67 65 20 61 6e 64 20 49 6f 54 20 73 65 63 75 72 65 2e 20 4c 65 61 72 6e 20 68 6f 77 20 4d 69 63 72 6f 4b 38 73 0a 20 20 20 6a 75 73 74 20 72 61 69 73 65 64 20 74 68 65 20 62 61 72 20 66 6f 72 20 65 61 73 79 2c 20 72 65 73 69 6c 69 65 6e 74 20 61 6e 64 20 73 65 63 75 72 65 20 4b 38 73 20 63 6c 75 73 74 65 72 20 64 65 70 6c 6f 79 6d 65 6e 74 2e 0a 0a 20 20 20 68 74 74 70 73 3a 2f 2f 75 62 75 6e 74 75 2e 63 6f 6d 2f 65 6e 67 61 67 65 2f 73 65 63 75 72 65 2d 6b 75 62 65 72 6e 65 74 65 73 2d 61 74 2d 74 68 65 2d 65 64 67 65 0a Data Ascii: * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s just raised the bar for easy, resilient and secure K8s cluster deployment. https://ubuntu.com/engage/secure-kubernetes-at-the-edge

Start time (UTC):	12:29:46
Start date (UTC):	15/05/2024
Path:	/tmp/icgYDPuGqT.elf
Arguments:	/tmp/icgYDPuGqT.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Start time (UTC):	12:32:27
Start date (UTC):	15/05/2024
Path:	/tmp/icgYDPuGqT.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Start time (UTC):	12:32:32
Start date (UTC):	15/05/2024
Path:	/tmp/icgYDPuGqT.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Start time (UTC):	12:30:21
Start date (UTC):	15/05/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	12:30:22
Start date (UTC):	15/05/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report icgYDPuGqT.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

HTTP Packets

HTTPS Proxied Packets

System Behavior

Analysis Process: icgYDPuGqT.elf PID: 5517, Parent PID: 5440

General

Chronological Activities

Analysis Process: icgYDPuGqT.elf PID: 5519, Parent PID: 5517

General

Chronological Activities

Analysis Process: icgYDPuGqT.elf PID: 5665, Parent PID: 5519

General

Chronological Activities

Analysis Process: icgYDPuGqT.elf PID: 5668, Parent PID: 5519

General

Linux Analysis Report
icgYDPuGqT.elf

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre