Edit tour

Linux Analysis Report
HHzrOvo2d3.elf

Overview

General Information

Sample name:	HHzrOvo2d3.elf renamed because original name is a hash value
Original sample name:	707ee3fc1b799944f33a9240df1b4177.elf
Analysis ID:	1447958
MD5:	707ee3fc1b799944f33a9240df1b4177
SHA1:	132c36da1c1f3abddfd18e871bc070605ac2202e
SHA256:	709c3f984b6bcd3554adb6db43f1cb3c0324ff02a9bfafbd6663473258bf5ce3
Tags:	32elfmipsmirai
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447958
Start date and time:	2024-05-27 13:12:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	HHzrOvo2d3.elf renamed because original name is a hash value
Original Sample Name:	707ee3fc1b799944f33a9240df1b4177.elf
Detection:	MAL
Classification:	mal60.spre.troj.evad.linELF@0/84@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/HHzrOvo2d3.elf
PID:	5519
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	snow slide
Standard Error:

Process Tree

system is lnxubuntu20

HHzrOvo2d3.elf (PID: 5519, Parent: 5443, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/HHzrOvo2d3.elf

HHzrOvo2d3.elf New Fork (PID: 5522, Parent: 5519)

HHzrOvo2d3.elf New Fork (PID: 5524, Parent: 5522)

HHzrOvo2d3.elf New Fork (PID: 5526, Parent: 5522)

systemd New Fork (PID: 5558, Parent: 1)

rsyslogd (PID: 5558, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gnome-session-binary New Fork (PID: 5559, Parent: 1498)

sh (PID: 5559, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 5559, Parent: 1498, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

gnome-session-binary New Fork (PID: 5563, Parent: 1498)

sh (PID: 5563, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 5563, Parent: 1498, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 5565, Parent: 1498)

sh (PID: 5565, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 5565, Parent: 1498, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gvfsd-fuse New Fork (PID: 5569, Parent: 3044)

fusermount (PID: 5569, Parent: 3044, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

gnome-session-binary New Fork (PID: 5570, Parent: 1498)

sh (PID: 5570, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 5570, Parent: 1498, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gnome-session-binary New Fork (PID: 5571, Parent: 1498)

sh (PID: 5571, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5571, Parent: 1498, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 5572, Parent: 1498)

sh (PID: 5572, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 5572, Parent: 1498, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 5573, Parent: 1498)

sh (PID: 5573, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 5573, Parent: 1498, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 5576, Parent: 1498)

sh (PID: 5576, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 5576, Parent: 1498, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 5594, Parent: 1498)

sh (PID: 5594, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 5594, Parent: 1498, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 5597, Parent: 1498)

sh (PID: 5597, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 5597, Parent: 1498, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 5598, Parent: 1498)

sh (PID: 5598, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 5598, Parent: 1498, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 5599, Parent: 1498)

sh (PID: 5599, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 5599, Parent: 1498, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 5601, Parent: 1498)

sh (PID: 5601, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 5601, Parent: 1498, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 5602, Parent: 1498)

sh (PID: 5602, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 5602, Parent: 1498, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

systemd New Fork (PID: 5607, Parent: 1)

rsyslogd (PID: 5607, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5635, Parent: 1)

rsyslogd (PID: 5635, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5639, Parent: 1)

rsyslogd (PID: 5639, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5645, Parent: 1)

rsyslogd (PID: 5645, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5651, Parent: 1)

rsyslogd (PID: 5651, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5655, Parent: 1)

rsyslogd (PID: 5655, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: HHzrOvo2d3.elf

Virustotal: Detection: 13%

Perma Link

Source: HHzrOvo2d3.elf

String: %xlocalhost/proc//exe/usr/bin//usr/lib//sbin//fd/fd//proc/net/tcp/var/bin//usr/local/bin//fh/extend//www//cmdline/procwgetcurlftpnctftpsshtelnetechontpdate@

Source: /usr/sbin/rsyslogd (PID: 5558)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5607)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5635)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5639)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5645)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5651)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5655)	Reads hosts file: /etc/hosts	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 136.242.59.59
Source: unknown	TCP traffic detected without corresponding DNS query: 136.242.59.59
Source: unknown	TCP traffic detected without corresponding DNS query: 180.101.140.33
Source: unknown	TCP traffic detected without corresponding DNS query: 31.240.254.59
Source: unknown	TCP traffic detected without corresponding DNS query: 14.229.168.134
Source: unknown	TCP traffic detected without corresponding DNS query: 94.136.115.58
Source: unknown	TCP traffic detected without corresponding DNS query: 9.168.31.65
Source: unknown	TCP traffic detected without corresponding DNS query: 208.184.214.93
Source: unknown	TCP traffic detected without corresponding DNS query: 71.69.0.32
Source: unknown	TCP traffic detected without corresponding DNS query: 189.88.12.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.173.126.189
Source: unknown	TCP traffic detected without corresponding DNS query: 135.57.95.28
Source: unknown	TCP traffic detected without corresponding DNS query: 52.250.158.20
Source: unknown	TCP traffic detected without corresponding DNS query: 102.176.140.189
Source: unknown	TCP traffic detected without corresponding DNS query: 84.59.218.83
Source: unknown	TCP traffic detected without corresponding DNS query: 48.192.121.221
Source: unknown	TCP traffic detected without corresponding DNS query: 144.178.62.156
Source: unknown	TCP traffic detected without corresponding DNS query: 18.179.181.12
Source: unknown	TCP traffic detected without corresponding DNS query: 88.176.241.73
Source: unknown	TCP traffic detected without corresponding DNS query: 14.61.156.53
Source: unknown	TCP traffic detected without corresponding DNS query: 70.14.151.147
Source: unknown	TCP traffic detected without corresponding DNS query: 74.197.123.205
Source: unknown	TCP traffic detected without corresponding DNS query: 126.224.206.122
Source: unknown	TCP traffic detected without corresponding DNS query: 35.148.221.164
Source: unknown	TCP traffic detected without corresponding DNS query: 157.114.115.85
Source: unknown	TCP traffic detected without corresponding DNS query: 76.205.214.202
Source: unknown	TCP traffic detected without corresponding DNS query: 19.33.34.1
Source: unknown	TCP traffic detected without corresponding DNS query: 103.145.54.232
Source: unknown	TCP traffic detected without corresponding DNS query: 216.219.81.243
Source: unknown	TCP traffic detected without corresponding DNS query: 221.73.244.176
Source: unknown	TCP traffic detected without corresponding DNS query: 18.33.49.211
Source: unknown	TCP traffic detected without corresponding DNS query: 183.157.21.94
Source: unknown	TCP traffic detected without corresponding DNS query: 117.58.209.233
Source: unknown	TCP traffic detected without corresponding DNS query: 77.238.139.95
Source: unknown	TCP traffic detected without corresponding DNS query: 13.180.106.251
Source: unknown	TCP traffic detected without corresponding DNS query: 113.19.124.228
Source: unknown	TCP traffic detected without corresponding DNS query: 167.227.52.89
Source: unknown	TCP traffic detected without corresponding DNS query: 120.78.205.251
Source: unknown	TCP traffic detected without corresponding DNS query: 124.17.150.181
Source: unknown	TCP traffic detected without corresponding DNS query: 203.29.231.122
Source: unknown	TCP traffic detected without corresponding DNS query: 82.134.111.32
Source: unknown	TCP traffic detected without corresponding DNS query: 149.223.234.60
Source: unknown	TCP traffic detected without corresponding DNS query: 132.113.47.185
Source: unknown	TCP traffic detected without corresponding DNS query: 162.97.2.191
Source: unknown	TCP traffic detected without corresponding DNS query: 146.226.186.211
Source: unknown	TCP traffic detected without corresponding DNS query: 140.44.128.28
Source: unknown	TCP traffic detected without corresponding DNS query: 95.246.178.222
Source: unknown	TCP traffic detected without corresponding DNS query: 222.239.166.119
Source: unknown	TCP traffic detected without corresponding DNS query: 178.107.209.154
Source: unknown	TCP traffic detected without corresponding DNS query: 205.212.102.28

Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 779, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 796, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 804, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 850, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 931, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 933, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1333, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1445, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1498, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1509, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1588, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1591, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1595, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1603, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1659, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1660, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1666, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1669, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1679, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1690, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1691, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1692, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1695, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1701, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1704, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1729, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1730, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1732, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1762, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1806, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 1867, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3183, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3205, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3210, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3298, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3303, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3316, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3368, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3379, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3394, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3399, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3419, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3456, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3461, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3465, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3469, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3475, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3488, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 3700, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5558, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5559, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5563, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5565, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5570, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5571, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5572, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5573, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5576, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5594, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5597, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5598, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5599, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5601, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5602, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 766, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5607, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5635, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5639, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5645, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5651, result: successful	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	SIGKILL sent: pid: 5655, result: successful	Jump to behavior

Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/110/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/231/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/111/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/112/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/233/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/113/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/114/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/235/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/115/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/1333/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/116/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/117/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/118/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/119/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/911/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/3874/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/3874/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/914/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/10/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/11/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/12/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/13/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/14/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/15/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/16/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/17/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/18/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/19/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/120/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/121/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/122/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/243/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/2/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/123/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/3/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/124/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/125/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/4/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/246/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/126/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/5/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/127/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/6/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/1585/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/128/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/7/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/129/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/8/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/9/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/802/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/803/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/804/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/20/fd	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/HHzrOvo2d3.elf (PID: 5526)	File opened: /proc/21/fd	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5558)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5607)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5635)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5639)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5645)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5651)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5655)	Log file created: /var/log/kern.log	Jump to dropped file

Source: /tmp/HHzrOvo2d3.elf (PID: 5519)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5558)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5607)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5635)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5639)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5645)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5651)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5655)	Queries kernel information via 'uname':	Jump to behavior

Source: HHzrOvo2d3.elf, 5519.1.00007ffc289f5000.00007ffc28a16000.rw-.sdmp	Binary or memory string: rex86_64/usr/bin/qemu-mips/tmp/HHzrOvo2d3.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/HHzrOvo2d3.elf
Source: kern.log.62.dr	Binary or memory string: May 27 06:13:12 galassia kernel: [ 162.056639] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
Source: HHzrOvo2d3.elf, 5519.1.0000561c785e6000.0000561c7866d000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/mips
Source: HHzrOvo2d3.elf, 5519.1.0000561c785e6000.0000561c7866d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: HHzrOvo2d3.elf, 5519.1.00007ffc289f5000.00007ffc28a16000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: kern.log.62.dr	Binary or memory string: May 27 06:13:12 galassia kernel: [ 162.056582] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel parport_pc ppdev lp parport drm ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper mptspi scsi_transport_spi psmouse mptscsih mptbase ahci libahci vmxnet3

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
HHzrOvo2d3.elf	8%	ReversingLabs	Linux.Trojan.Mirai
HHzrOvo2d3.elf	14%	Virustotal		Browse

IP	Domain	Country	ASN	ASN Name	Malicious
200.197.82.125	unknown	Brazil	10733	DCMATRIXINTERNETSABR	false
17.233.53.195	unknown	United States	714	APPLE-ENGINEERINGUS	false
32.206.187.94	unknown	United States	2686	ATGS-MMD-ASUS	false
63.242.201.230	unknown	United States	7018	ATT-INTERNET4US	false
43.90.242.235	unknown	Japan	4249	LILLY-ASUS	false
38.123.47.230	unknown	United States	40166	DAEMEN-COLLEGEUS	false
135.192.197.192	unknown	United States	14962	NCR-252US	false
103.139.200.34	unknown	China	45187	RACKSPACE-APRackspaceITHostingASITHostingProviderHon	false
212.180.56.59	unknown	France	4589	EASYNETEasynetGlobalServicesEU	false
95.109.251.124	unknown	Ukraine	34610	RIKSNETSE	false
95.170.39.13	unknown	France	12684	SES-LUX-ASLU	false
222.233.103.167	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
108.156.39.3	unknown	United States	16509	AMAZON-02US	false
89.0.8.140	unknown	Germany	8422	NETCOLOGNEDE	false
75.13.203.81	unknown	United States	7018	ATT-INTERNET4US	false
196.37.49.143	unknown	South Africa	3741	ISZA	false
18.73.72.51	unknown	United States	3	MIT-GATEWAYSUS	false
87.85.42.126	unknown	United Kingdom	4589	EASYNETEasynetGlobalServicesEU	false
54.187.36.19	unknown	United States	16509	AMAZON-02US	false
139.201.146.34	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
130.131.86.142	unknown	United States	10455	LUCENT-CIOUS	false
23.75.77.51	unknown	United States	16625	AKAMAI-ASUS	false
141.119.206.241	unknown	Canada	3848	WORLDLINX-2CA	false
85.78.27.120	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
174.24.81.190	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
145.56.167.91	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
167.203.7.55	unknown	United Kingdom	12701	BARCAPLondonGB	false
169.85.142.201	unknown	United States	37611	AfrihostZA	false
179.72.65.129	unknown	Brazil	26615	TIMSABR	false
201.0.129.84	unknown	Brazil	27699	TELEFONICABRASILSABR	false
44.234.231.17	unknown	United States	16509	AMAZON-02US	false
4.108.169.163	unknown	United States	3356	LEVEL3US	false
32.23.10.41	unknown	United States	2686	ATGS-MMD-ASUS	false
83.56.33.31	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
108.72.94.142	unknown	United States	7018	ATT-INTERNET4US	false
14.45.199.31	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
204.10.135.143	unknown	United States	26470	WPP-IT-PISCATAWAYUS	false
137.135.22.234	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
199.63.123.193	unknown	United States	19807	ASNBLK-VTLA2US	false
202.213.235.79	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
114.6.118.6	unknown	Indonesia	4761	INDOSAT-INP-APINDOSATInternetNetworkProviderID	false
25.115.218.25	unknown	United Kingdom	7922	COMCAST-7922US	false
51.154.195.85	unknown	Switzerland	15796	SALT-CH	false
189.179.198.191	unknown	Mexico	8151	UninetSAdeCVMX	false
174.27.76.40	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
110.137.10.101	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	false
147.77.244.169	unknown	United Kingdom	10152	NEC-MELB-DC-AS-APNECAustraliaPtyLtdAU	false
80.224.50.51	unknown	Spain	6739	ONO-ASCableuropa-ONOES	false
47.32.66.124	unknown	United States	20115	CHARTER-20115US	false
4.123.137.123	unknown	United States	3356	LEVEL3US	false
109.127.255.133	unknown	Slovenia	2107	ARNES-NETAcademicandResearchNetworkofSloveniaSI	false
208.246.116.42	unknown	United States	4208	THE-ISERV-COMPANYUS	false
36.131.159.166	unknown	China	56044	CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	false
219.125.252.220	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
144.131.124.85	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
39.178.243.88	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
148.143.10.225	unknown	France	3246	TDCSONGTele2BusinessTDCSwedenSE	false
123.196.122.209	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
161.177.63.65	unknown	United States	10695	WAL-MARTUS	false
49.239.222.104	unknown	China	58834	GCABLENETGuangdongCableCorporationLimitedCN	false
135.46.203.65	unknown	United States	54614	CIKTELECOM-CABLECA	false
2.116.59.242	unknown	Italy	3269	ASN-IBSNAZIT	false
43.236.170.62	unknown	China	17506	UCOMARTERIANetworksCorporationJP	false
58.62.51.188	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
210.207.35.77	unknown	Korea Republic of	9861	HIAM-AS-KRHiAssetManagementCoLtdKR	false
48.186.202.247	unknown	United States	2686	ATGS-MMD-ASUS	false
216.92.247.234	unknown	United States	7859	PAIR-NETWORKSUS	false
151.223.51.135	unknown	unknown	11003	PANDGUS	false
57.37.72.94	unknown	Belgium	2686	ATGS-MMD-ASUS	false
53.193.209.206	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
198.59.111.143	unknown	United States	11570	EASTERN-NEW-MEXICO-UNIVERITYUS	false
57.135.72.46	unknown	Belgium	2686	ATGS-MMD-ASUS	false
177.207.60.136	unknown	Brazil	18881	TELEFONICABRASILSABR	false
222.128.67.245	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
123.128.178.32	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
223.199.37.79	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
69.26.82.114	unknown	Canada	27181	KMTSNETCA	false
196.144.252.111	unknown	Egypt	36935	Vodafone-EG	false
76.236.235.230	unknown	United States	7018	ATT-INTERNET4US	false
185.33.46.21	unknown	Iraq	199826	IQSTC-IQ	false
184.67.53.109	unknown	Canada	6327	SHAWCA	false
100.248.154.208	unknown	United States	21928	T-MOBILE-AS21928US	false
24.178.88.145	unknown	United States	20115	CHARTER-20115US	false
198.226.204.9	unknown	United States	6167	CELLCO-PARTUS	false
1.159.110.239	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
143.116.123.200	unknown	United States	10599	MCKESSONUS	false
220.79.231.132	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
104.50.111.168	unknown	United States	7018	ATT-INTERNET4US	false
118.8.227.35	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
103.92.222.112	unknown	Australia	59362	KSNETWORK-AS-APKSNetworkLimitedBD	false
58.76.87.151	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
118.97.65.3	unknown	Indonesia	17974	TELKOMNET-AS2-APPTTelekomunikasiIndonesiaID	false
218.181.74.27	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
37.198.195.82	unknown	Sweden	1257	TELE2EU	false
66.178.10.184	unknown	United States	12684	SES-LUX-ASLU	false
223.104.132.2	unknown	China	56047	CMNET-HUNAN-APChinaMobilecommunicationscorporationCN	false
35.224.194.155	unknown	United States	15169	GOOGLEUS	false
112.23.65.208	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
58.51.227.59	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
165.75.217.189	unknown	United States	63474	SIRIUS-DATACENTERSUS	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
179.72.65.129	dYwkOHv4Hs	Get hash	malicious	Mirai	Browse
179.72.65.129	sora.x86	Get hash	malicious	Mirai	Browse
139.201.146.34	5vWJ6NI60h	Get hash	malicious	Mirai	Browse
130.131.86.142	UX1Kgk69dt.elf	Get hash	malicious	Unknown	Browse
108.156.39.3	pa0Z10IZQr.elf	Get hash	malicious	Mirai	Browse
89.0.8.140	oy3xod0xAq.elf	Get hash	malicious	Mirai	Browse
89.0.8.140	4e3qx6wbA6	Get hash	malicious	Mirai	Browse
43.90.242.235	Musf53V9Gz.elf	Get hash	malicious	Mirai	Browse
43.90.242.235	i686	Get hash	malicious	Mirai, Moobot	Browse
75.13.203.81	xMH41KPTli	Get hash	malicious	Mirai	Browse
145.56.167.91	Wf4ggEyLAG	Get hash	malicious	Mirai	Browse
167.203.7.55	x86	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATGS-MMD-ASUS	o77HTF1NHp.elf	Get hash	malicious	Unknown	Browse	34.136.63.140
	3DF6fqp3ME.elf	Get hash	malicious	Mirai	Browse	34.143.68.106
	inquiry EBS# 82785.exe	Get hash	malicious	FormBook	Browse	34.149.87.45
	https://paypalgiftcardgenerator.pages.dev/	Get hash	malicious	Unknown	Browse	34.141.179.97
	bWT2t63tyx.elf	Get hash	malicious	Mirai	Browse	48.248.64.7
	https://fbrestriction.wixsite.com/facebook	Get hash	malicious	Unknown	Browse	34.49.229.81
	https://uncovered-fragrant-climb.glitch.me/public/eleventy.js.html	Get hash	malicious	HTMLPhisher	Browse	34.160.236.64
	URocnz2wNj.elf	Get hash	malicious	Unknown	Browse	32.31.76.58
	8427xbk3Zt.elf	Get hash	malicious	Unknown	Browse	32.114.133.238
	M4huqujaBY.elf	Get hash	malicious	Unknown	Browse	48.148.253.28
ATT-INTERNET4US	o77HTF1NHp.elf	Get hash	malicious	Unknown	Browse	172.145.207.47
	3DF6fqp3ME.elf	Get hash	malicious	Mirai	Browse	108.243.92.155
	https://u44668105.ct.sendgrid.net/ls/click?upn=u001.BTMESiTo6NsF48uIW4-2BrJkEc2YVFzyAaMWnWwgGT9cZqZS45ZZqu4Y-2FXJmZd8BXA8cja_AHV3UK6XjfrXMiZ9J4igW-2FDEUbICycoJ744IkX0PR6FoPBD5ixGfLkyQ9ofRFx1gjy-2BP-2BDUWqu7bhyffh6xflqZsbtNZtMLnpgQoCGrYBrKDAQCrs-2BXh7tVhTtmxcULJOM-2BKcO31hWTdcLyh6xHaFmrsv6JFsx6tjkxHhVyYzmDL2WjDZWPIbWyOCKFNxt29pnc1D6Wos9by2AU7AhdVB3KlHpWThOWm6-2FAP-2Buqng4Vq-2BmwndZ6wQGKVc-2FG51viAW-2FpPzuJOGK4hC-2FF-2FfgyonvDWvDkNa4J3BejflmN-2BuGCUZSHoW4H7oETlKRzn4f7VwMbU0WFOF9ZUfOI6CISxhvZQTsnMYzitMow1nPeu-2Flg0-2FzAaZA27HnZ5WdxtR2wKofgxyBDPpPjMUDCXBmEfEWtT8NXGmNaNpBvJDLI13EkOwRxoG67u0CqbvxxYYK-2F5eu2B-2Bg9JTJRxFbICA7lEJgDZLYhBS-2BbGjIrrRDvHg0hAvMhBJ54TVAoWNvYZYG-2FCqbCuzJrUBI0DoaRAGLq44smm73hnjeG06IT3WQV3A8KkhlXB3fqBFue-2Fd4ydFypfr1PkBzxIk-2FPd1H2pJdMYF-2B7HONDoFax8K-2BBkvfgdiIY-3D	Get hash	malicious	Unknown	Browse	13.32.27.86
	https://paypalgiftcardgenerator.pages.dev/	Get hash	malicious	Unknown	Browse	13.32.27.54
	bWT2t63tyx.elf	Get hash	malicious	Mirai	Browse	13.192.127.45
	https://uncovered-fragrant-climb.glitch.me/public/eleventy.js.html	Get hash	malicious	HTMLPhisher	Browse	13.32.27.99
	URocnz2wNj.elf	Get hash	malicious	Unknown	Browse	67.64.172.20
	8427xbk3Zt.elf	Get hash	malicious	Unknown	Browse	99.58.47.47
	T57QiayIem.elf	Get hash	malicious	Unknown	Browse	12.56.151.230
	M4huqujaBY.elf	Get hash	malicious	Unknown	Browse	70.245.132.7
LILLY-ASUS	URocnz2wNj.elf	Get hash	malicious	Unknown	Browse	43.4.184.71
	8427xbk3Zt.elf	Get hash	malicious	Unknown	Browse	40.185.245.57
	T57QiayIem.elf	Get hash	malicious	Unknown	Browse	43.112.217.229
	M4huqujaBY.elf	Get hash	malicious	Unknown	Browse	42.138.239.49
	cVxP229sNF.elf	Get hash	malicious	Unknown	Browse	40.146.93.182
	3LI2VAvf26.elf	Get hash	malicious	Unknown	Browse	40.16.94.31
	ZVQBodhgp1.elf	Get hash	malicious	Mirai, Moobot	Browse	40.23.167.5
	BEddZjSb7A.elf	Get hash	malicious	Unknown	Browse	43.146.35.198
	QN5PrDr5St.elf	Get hash	malicious	Unknown	Browse	43.142.72.162
	mKBZo65Fcb.elf	Get hash	malicious	Mirai	Browse	42.143.115.161
DCMATRIXINTERNETSABR	xfO72LuQ7K.elf	Get hash	malicious	Unknown	Browse	200.197.22.82
	uOMKZwL0nj.elf	Get hash	malicious	Gafgyt, Mirai	Browse	200.197.22.68
	ivBwxLK2gm.elf	Get hash	malicious	Mirai	Browse	200.197.124.187
	skid.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	200.202.88.159
	mpsl.elf	Get hash	malicious	Mirai	Browse	200.197.58.22
	xfzak0pHUR.elf	Get hash	malicious	Mirai	Browse	200.197.22.41
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	200.197.22.98
	irq1	Get hash	malicious	Tsunami	Browse	200.197.185.99
	irq0	Get hash	malicious	Tsunami	Browse	200.202.87.11
	PkAjFJLyTE.elf	Get hash	malicious	Mirai	Browse	200.197.10.48

Process:	/tmp/HHzrOvo2d3.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:TgoA3:TgoG
MD5:	71D0A3DC3EEF29B7D4BB73374D1797BB
SHA1:	7A109DA043922CBEB90C36CCD794DF376257ED32
SHA-256:	7571A964BA243864A763DA5BCDB6F04211828A223589F8EDB3D5A752A142C1B2
SHA-512:	5D21CDEF460948A4021332CA96D414E11AE09CA6101A7D72DF85990CB85EF46BB689074332F5C7784C2793DB33774676114D92313B8823817B5420BC35C51660
Malicious:	false
Reputation:	low
Preview:	/tmp/HHzrOvo2d3.elf.

Process:	/tmp/HHzrOvo2d3.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:TgoA3:TgoG
MD5:	71D0A3DC3EEF29B7D4BB73374D1797BB
SHA1:	7A109DA043922CBEB90C36CCD794DF376257ED32
SHA-256:	7571A964BA243864A763DA5BCDB6F04211828A223589F8EDB3D5A752A142C1B2
SHA-512:	5D21CDEF460948A4021332CA96D414E11AE09CA6101A7D72DF85990CB85EF46BB689074332F5C7784C2793DB33774676114D92313B8823817B5420BC35C51660
Malicious:	false
Reputation:	low
Preview:	/tmp/HHzrOvo2d3.elf.

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	999
Entropy (8bit):	4.757416700011258
Encrypted:	false
SSDEEP:	24:aaQuNLZW9/0AIdlZAIUHjAI+H5DYpbH5SBH5emGSH50GFdH5cGm:aMNd2/adlfO9Y5DIz525ei5T52
MD5:	DB368210ED8618A486DF5F0F5025ACC2
SHA1:	CFA0E49F368016011CEF1989B0C473C41495D61A
SHA-256:	2E5BC35251EF7FE65B4D694828ACA21FD3105C6CFE38AB2E30301813A8A0F909
SHA-512:	A1B1D46BAC4E91F54B6CDB958D686A23929254B39D8494FB27A65D2F2A4BF2B4AE1EE347972FEF65C850AD4C3A4CF8AD0F5EDBBBD93178B6A72DC6CA00A376A8
Malicious:	false
Preview:	May 27 06:13:29 galassia kernel: [ 179.304502] blocking signal 9: 5526 -> 1498.May 27 06:13:29 galassia kernel: [ 179.324506] blocking signal 9: 5526 -> 766.May 27 06:13:29 galassia kernel: [ 179.332542] blocking signal 9: 5526 -> 933.May 27 06:13:29 galassia kernel: [ 179.578552] New task spawned: old: (tgid 5655, tid 5655), new (tgid: 5655, tid: 5656).May 27 06:13:29 galassia kernel: [ 179.579217] New task spawned: old: (tgid 5655, tid 5655), new (tgid: 5655, tid: 5657).May 27 06:13:30 galassia kernel: [ 179.585586] New task spawned: old: (tgid 5655, tid 5656), new (tgid: 5655, tid: 5658).May 27 06:13:30 galassia kernel: [ 180.685842] blocking signal 9: 5526 -> 658.May 27 06:13:30 galassia kernel: [ 180.687802] blocking signal 9: 5526 -> 777.May 27 06:13:30 galassia kernel: [ 180.688995] blocking signal 9: 5526 -> 804.May 27 06:13:30 galassia kernel: [ 180.691705] blocking signal 9: 5526 -> 850.May 27 06:13:30 galassia kernel: [ 180.695275] blocking signal 9: 5526 -> 933.

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.403874247258179
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	HHzrOvo2d3.elf
File size:	113'724 bytes
MD5:	707ee3fc1b799944f33a9240df1b4177
SHA1:	132c36da1c1f3abddfd18e871bc070605ac2202e
SHA256:	709c3f984b6bcd3554adb6db43f1cb3c0324ff02a9bfafbd6663473258bf5ce3
SHA512:	ac87d5ca781e1828a9b7600e09fe5f344b398961e65b3f7b9b2708bd5f1398cde8f48bc107c64b204d63aae0ed41698014f47f8de52261efa7777a34be534d09
SSDEEP:	1536:FOqxFwJ/WBPRwPAWLsBQmpwVp6TJz7yDduJ/3fengXpA1ojQ5Re7rWg/ZKXzFaAe:FT/iW2AbI6TJz7yDdVNWQa9mQAsPp
TLSH:	4FB3C51E6A218FACF35D833047F74E31A75823D226F0D641E2ACDA106F6069E545FBB9
File Content Preview:	.ELF.....................@.p...4.........4. ...(.............@...@...........................E...E.....\|..>d........dt.Q............................<...'.2....!'.......................<...'.2....!........'9... ......................<...'.2x...!... ....'9.

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400270
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	113124
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	14

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x19630	0x0	0x6	AX	16
.fini	PROGBITS	0x419750	0x19750	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x4197b0	0x197b0	0xdf0	0x0	0x2	A	16
.eh_frame	PROGBITS	0x45b000	0x1b000	0x4	0x0	0x3	WA	4
.ctors	PROGBITS	0x45b004	0x1b004	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x45b00c	0x1b00c	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x45b014	0x1b014	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x45b020	0x1b020	0x344	0x0	0x3	WA	16
.got	PROGBITS	0x45b370	0x1b370	0x60c	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x45b97c	0x1b97c	0x1c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x45b9a0	0x1b97c	0x34c4	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0xd92	0x1b97c	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x1b97c	0x66	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1a5a0	0x1a5a0	5.5018	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1b000	0x45b000	0x45b000	0x97c	0x3e64	4.2365	0x6	RW	0x10000	.eh_frame .ctors .dtors .jcr .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 27, 2024 13:13:07.473409891 CEST	94.247.43.254	192.168.2.15	0x3912	No error (0)	nakotne.pirate	94.103.91.233	A (IP address)	IN (0x0001)	false
May 27, 2024 13:13:07.473409891 CEST	94.247.43.254	192.168.2.15	0x3912	No error (0)	nakotne.pirate	195.2.81.97	A (IP address)	IN (0x0001)	false
May 27, 2024 13:13:07.473409891 CEST	94.247.43.254	192.168.2.15	0x3912	No error (0)	nakotne.pirate	89.110.90.159	A (IP address)	IN (0x0001)	false
May 27, 2024 13:13:07.473409891 CEST	94.247.43.254	192.168.2.15	0x3912	No error (0)	nakotne.pirate	94.103.83.102	A (IP address)	IN (0x0001)	false
May 27, 2024 13:13:07.473409891 CEST	94.247.43.254	192.168.2.15	0x3912	No error (0)	nakotne.pirate	94.103.84.230	A (IP address)	IN (0x0001)	false

Start time (UTC):	11:13:06
Start date (UTC):	27/05/2024
Path:	/tmp/HHzrOvo2d3.elf
Arguments:	/tmp/HHzrOvo2d3.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	11:13:08
Start date (UTC):	27/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:13:09
Start date (UTC):	27/05/2024
Path:	/usr/libexec/gsd-keyboard
Arguments:	/usr/libexec/gsd-keyboard
File size:	39760 bytes
MD5 hash:	8e288fd17c80bb0a1148b964b2ac2279

Start time (UTC):	11:13:10
Start date (UTC):	27/05/2024
Path:	/usr/libexec/gsd-screensaver-proxy
Arguments:	/usr/libexec/gsd-screensaver-proxy
File size:	27232 bytes
MD5 hash:	77e309450c87dceee43f1a9e50cc0d02

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report HHzrOvo2d3.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0N4Dv3 (deleted)

/tmp/qemu-open.0xYJZ2 (deleted)

/tmp/qemu-open.2w92q5 (deleted)

/tmp/qemu-open.3G2hL3 (deleted)

/tmp/qemu-open.3OMbV4 (deleted)

/tmp/qemu-open.5RT9i5 (deleted)

/tmp/qemu-open.6pzR62 (deleted)

/tmp/qemu-open.7rs1W0 (deleted)

/tmp/qemu-open.7ukZ43 (deleted)

/tmp/qemu-open.824gp1 (deleted)

/tmp/qemu-open.8BwqX2 (deleted)

/tmp/qemu-open.ADafj4 (deleted)

/tmp/qemu-open.AaxCS1 (deleted)

/tmp/qemu-open.Alx2y4 (deleted)

/tmp/qemu-open.Aok0p3 (deleted)

/tmp/qemu-open.CmOG33 (deleted)

/tmp/qemu-open.CwdW43 (deleted)

/tmp/qemu-open.D07dT0 (deleted)

/tmp/qemu-open.DmQ0L3 (deleted)

/tmp/qemu-open.EqpSe4 (deleted)

/tmp/qemu-open.HbciH3 (deleted)

/tmp/qemu-open.ISEWI4 (deleted)

/tmp/qemu-open.JH2qW4 (deleted)

/tmp/qemu-open.KEI1Z0 (deleted)

/tmp/qemu-open.LGvbg3 (deleted)

/tmp/qemu-open.LtKQG1 (deleted)

/tmp/qemu-open.McKm23 (deleted)

/tmp/qemu-open.O25QY2 (deleted)

/tmp/qemu-open.Ofjw63 (deleted)

/tmp/qemu-open.PCVP44 (deleted)

/tmp/qemu-open.RXpEI4 (deleted)

Linux Analysis Report
HHzrOvo2d3.elf

Start time (UTC):	11:13:11
Start date (UTC):	27/05/2024
Path:	/usr/libexec/gsd-sound
Arguments:	/usr/libexec/gsd-sound
File size:	31248 bytes
MD5 hash:	4c7d3fb993463337b4a0eb5c80c760ee

Start time (UTC):	11:13:12
Start date (UTC):	27/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:13:22
Start date (UTC):	27/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:13:24
Start date (UTC):	27/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:13:26
Start date (UTC):	27/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:13:28
Start date (UTC):	27/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:13:29
Start date (UTC):	27/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre