Edit tour

Linux Analysis Report
QH1v8Gya9C.elf

Overview

General Information

Sample name:	QH1v8Gya9C.elf renamed because original name is a hash value
Original sample name:	22da69b45c1b3aa37763b8310e75a329.elf
Analysis ID:	1448244
MD5:	22da69b45c1b3aa37763b8310e75a329
SHA1:	f656934ce58f8f18047d19a6915aafd86898ec23
SHA256:	d1e2d17121b354cfc9f4acadd85a65fa545d32e35f1ac47ab9cb25966bb516fe
Tags:	32elfmipsmirai
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1448244
Start date and time:	2024-05-28 06:26:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	QH1v8Gya9C.elf renamed because original name is a hash value
Original Sample Name:	22da69b45c1b3aa37763b8310e75a329.elf
Detection:	MAL
Classification:	mal64.spre.troj.evad.linELF@0/82@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/QH1v8Gya9C.elf
PID:	5433
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	snow slide
Standard Error:

Process Tree

system is lnxubuntu20

QH1v8Gya9C.elf (PID: 5433, Parent: 5354, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/QH1v8Gya9C.elf

QH1v8Gya9C.elf New Fork (PID: 5436, Parent: 5433)

QH1v8Gya9C.elf New Fork (PID: 5438, Parent: 5436)

QH1v8Gya9C.elf New Fork (PID: 5440, Parent: 5436)

gnome-session-binary New Fork (PID: 5464, Parent: 1588)

sh (PID: 5464, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 5464, Parent: 1588, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

systemd New Fork (PID: 5465, Parent: 1)

rsyslogd (PID: 5465, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gnome-session-binary New Fork (PID: 5468, Parent: 1588)

sh (PID: 5468, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 5468, Parent: 1588, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 5471, Parent: 1588)

sh (PID: 5471, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 5471, Parent: 1588, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 5472, Parent: 1588)

sh (PID: 5472, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 5472, Parent: 1588, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 5473, Parent: 1588)

sh (PID: 5473, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 5473, Parent: 1588, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gvfsd-fuse New Fork (PID: 5474, Parent: 3122)

fusermount (PID: 5474, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

gnome-session-binary New Fork (PID: 5475, Parent: 1588)

sh (PID: 5475, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5475, Parent: 1588, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 5476, Parent: 1588)

sh (PID: 5476, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 5476, Parent: 1588, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 5477, Parent: 1588)

sh (PID: 5477, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 5477, Parent: 1588, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 5495, Parent: 1588)

sh (PID: 5495, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 5495, Parent: 1588, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 5497, Parent: 1588)

sh (PID: 5497, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 5497, Parent: 1588, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 5500, Parent: 1588)

sh (PID: 5500, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 5500, Parent: 1588, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 5505, Parent: 1588)

sh (PID: 5505, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 5505, Parent: 1588, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gnome-session-binary New Fork (PID: 5508, Parent: 1588)

sh (PID: 5508, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 5508, Parent: 1588, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 5509, Parent: 1588)

sh (PID: 5509, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 5509, Parent: 1588, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

systemd New Fork (PID: 5514, Parent: 1)

rsyslogd (PID: 5514, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5542, Parent: 1)

rsyslogd (PID: 5542, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5546, Parent: 1)

rsyslogd (PID: 5546, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5550, Parent: 1)

rsyslogd (PID: 5550, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5556, Parent: 1)

rsyslogd (PID: 5556, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5562, Parent: 1)

rsyslogd (PID: 5562, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Yara Signatures

⊘No yara matches

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: QH1v8Gya9C.elf	Virustotal: Detection: 30%			Perma Link
Source: QH1v8Gya9C.elf	ReversingLabs: Detection: 28%

Source: QH1v8Gya9C.elf

String: %x/proc//exe/usr/bin//usr/lib//sbin//fd/fd//proc/net/tcp/var/bin//usr/local/bin//fh/extend//www//cmdline/procwgetcurlftpnctftpsshtelnetechontpdate@

Source: /usr/sbin/rsyslogd (PID: 5465)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5514)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5542)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5546)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5550)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5556)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5562)	Reads hosts file: /etc/hosts	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 24.232.65.140
Source: unknown	TCP traffic detected without corresponding DNS query: 173.153.113.204
Source: unknown	TCP traffic detected without corresponding DNS query: 103.127.77.106
Source: unknown	TCP traffic detected without corresponding DNS query: 198.73.245.204
Source: unknown	TCP traffic detected without corresponding DNS query: 137.40.43.31
Source: unknown	TCP traffic detected without corresponding DNS query: 108.158.147.189
Source: unknown	TCP traffic detected without corresponding DNS query: 104.57.50.150
Source: unknown	TCP traffic detected without corresponding DNS query: 53.147.7.226
Source: unknown	TCP traffic detected without corresponding DNS query: 175.47.215.170
Source: unknown	TCP traffic detected without corresponding DNS query: 201.127.183.115
Source: unknown	TCP traffic detected without corresponding DNS query: 25.136.122.241
Source: unknown	TCP traffic detected without corresponding DNS query: 41.95.90.168
Source: unknown	TCP traffic detected without corresponding DNS query: 118.218.253.70
Source: unknown	TCP traffic detected without corresponding DNS query: 219.171.23.117
Source: unknown	TCP traffic detected without corresponding DNS query: 79.86.131.128
Source: unknown	TCP traffic detected without corresponding DNS query: 200.136.92.128
Source: unknown	TCP traffic detected without corresponding DNS query: 204.142.247.50
Source: unknown	TCP traffic detected without corresponding DNS query: 167.254.8.62
Source: unknown	TCP traffic detected without corresponding DNS query: 69.137.117.160
Source: unknown	TCP traffic detected without corresponding DNS query: 88.213.182.104
Source: unknown	TCP traffic detected without corresponding DNS query: 222.34.139.166
Source: unknown	TCP traffic detected without corresponding DNS query: 115.170.231.248
Source: unknown	TCP traffic detected without corresponding DNS query: 213.239.59.9
Source: unknown	TCP traffic detected without corresponding DNS query: 86.6.17.158
Source: unknown	TCP traffic detected without corresponding DNS query: 148.40.33.190
Source: unknown	TCP traffic detected without corresponding DNS query: 170.118.179.156
Source: unknown	TCP traffic detected without corresponding DNS query: 19.167.4.99
Source: unknown	TCP traffic detected without corresponding DNS query: 137.37.88.241
Source: unknown	TCP traffic detected without corresponding DNS query: 61.115.216.131
Source: unknown	TCP traffic detected without corresponding DNS query: 59.80.171.107
Source: unknown	TCP traffic detected without corresponding DNS query: 37.141.83.191
Source: unknown	TCP traffic detected without corresponding DNS query: 182.34.195.44
Source: unknown	TCP traffic detected without corresponding DNS query: 203.88.53.181
Source: unknown	TCP traffic detected without corresponding DNS query: 119.240.117.127
Source: unknown	TCP traffic detected without corresponding DNS query: 105.101.181.174
Source: unknown	TCP traffic detected without corresponding DNS query: 204.58.209.253
Source: unknown	TCP traffic detected without corresponding DNS query: 98.232.200.204
Source: unknown	TCP traffic detected without corresponding DNS query: 154.4.29.192
Source: unknown	TCP traffic detected without corresponding DNS query: 173.155.161.218
Source: unknown	TCP traffic detected without corresponding DNS query: 95.47.30.209
Source: unknown	TCP traffic detected without corresponding DNS query: 112.58.113.83
Source: unknown	TCP traffic detected without corresponding DNS query: 217.140.246.245
Source: unknown	TCP traffic detected without corresponding DNS query: 136.21.180.82
Source: unknown	TCP traffic detected without corresponding DNS query: 139.254.163.122
Source: unknown	TCP traffic detected without corresponding DNS query: 184.36.50.7
Source: unknown	TCP traffic detected without corresponding DNS query: 138.118.139.106
Source: unknown	TCP traffic detected without corresponding DNS query: 144.107.112.239
Source: unknown	TCP traffic detected without corresponding DNS query: 54.113.239.42
Source: unknown	TCP traffic detected without corresponding DNS query: 154.197.82.126
Source: unknown	TCP traffic detected without corresponding DNS query: 207.43.233.174

Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 803, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 855, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 914, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1588, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1604, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1748, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1751, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1755, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1765, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1866, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1875, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1879, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1881, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1891, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1906, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1921, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1922, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1925, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1930, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1940, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1944, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1946, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1969, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 1982, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3095, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3117, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3209, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3225, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3310, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3336, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3375, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3413, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3424, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3434, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3448, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 3634, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5464, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5465, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5468, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5471, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5472, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5473, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5475, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5476, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5477, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5495, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5497, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5500, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5505, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5508, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5509, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5514, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5542, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5546, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5550, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5556, result: successful	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	SIGKILL sent: pid: 5562, result: successful	Jump to behavior

Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/230/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/110/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/231/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/111/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/232/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/112/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/233/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/113/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/234/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/114/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/235/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/115/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/236/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/116/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/237/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/117/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/238/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/118/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/239/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/119/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/10/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/11/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/12/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/13/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/14/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/15/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/5276/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/5276/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/16/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/3770/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/3770/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/17/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/18/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/19/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/240/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/120/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/241/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/121/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/242/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/122/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/243/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/2/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/123/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/244/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/3/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/124/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/245/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/1588/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/125/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/4/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/246/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/126/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/5/fd	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/QH1v8Gya9C.elf (PID: 5440)	File opened: /proc/247/fd	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5465)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5514)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5542)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5546)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5550)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5556)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5562)	Log file created: /var/log/kern.log	Jump to dropped file

Source: /tmp/QH1v8Gya9C.elf (PID: 5433)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5465)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5514)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5542)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5546)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5550)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5556)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5562)	Queries kernel information via 'uname':	Jump to behavior

Source: QH1v8Gya9C.elf, 5433.1.00007ffc4f4e8000.00007ffc4f509000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/QH1v8Gya9C.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/QH1v8Gya9C.elf
Source: QH1v8Gya9C.elf, 5433.1.000055814a4aa000.000055814a531000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mips
Source: QH1v8Gya9C.elf, 5433.1.000055814a4aa000.000055814a531000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: QH1v8Gya9C.elf, 5433.1.00007ffc4f4e8000.00007ffc4f509000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
QH1v8Gya9C.elf	30%	Virustotal		Browse
QH1v8Gya9C.elf	29%	ReversingLabs	Linux.Trojan.Mirai

IP	Domain	Country	ASN	ASN Name	Malicious
90.162.244.73	unknown	Spain	12479	UNI2-ASES	false
111.200.104.121	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
211.40.72.66	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
195.179.156.234	unknown	Germany	6659	NEXINTO-DE	false
100.134.166.220	unknown	United States	21928	T-MOBILE-AS21928US	false
41.108.48.182	unknown	Algeria	36947	ALGTEL-ASDZ	false
17.131.192.183	unknown	United States	714	APPLE-ENGINEERINGUS	false
142.58.123.101	unknown	Canada	11105	SFU-ASCA	false
82.210.22.56	unknown	France	34177	CELESTE-ASCELESTE-InternetservicesproviderFR	false
144.222.63.16	unknown	United States	7896	NU-ASUS	false
49.86.47.198	unknown	China	137697	CHINATELECOM-JIANGSU-YANGZHOU-IDCCHINATELECOMJiangSuYangZ	false
181.60.189.147	unknown	Colombia	10620	TelmexColombiaSACO	false
189.221.175.99	unknown	Mexico	18734	OperbesSAdeCVMX	false
50.211.0.221	unknown	United States	7922	COMCAST-7922US	false
137.89.231.213	unknown	United States	14977	STATE-OF-WYOMING-ASNUS	false
115.112.78.0	unknown	India	4755	TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP	false
45.46.191.207	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
132.5.240.76	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
129.114.194.125	unknown	United States	14104	OTS-AS-14104US	false
184.185.167.206	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
108.34.112.168	unknown	United States	701	UUNETUS	false
83.13.128.97	unknown	Poland	5617	TPNETPL	false
169.35.14.228	unknown	Switzerland	37611	AfrihostZA	false
128.181.37.146	unknown	United States	6522	LEHIGHUS	false
114.28.76.170	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
182.220.67.24	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
31.40.18.202	unknown	Ukraine	197131	ASBAGNJUKUA	false
136.23.9.151	unknown	United States	394699	GOOGLE-ACCESS-NYCUS	false
212.61.181.210	unknown	Netherlands	8426	CLARANET-ASClaraNETLTDGB	false
116.226.221.117	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
79.111.64.218	unknown	Russian Federation	12714	TI-ASMoscowRussiaRU	false
95.144.254.32	unknown	United Kingdom	12576	EELtdGB	false
191.78.54.248	unknown	Colombia	26611	COMCELSACO	false
177.192.204.109	unknown	Brazil	28573	CLAROSABR	false
139.87.159.66	unknown	United States	20054	AS13832US	false
85.0.146.249	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
149.4.146.188	unknown	United States	31822	CITY-UNIVERSITY-OF-NEW-YORKUS	false
96.1.104.17	unknown	Canada	852	ASN852CA	false
8.61.32.140	unknown	United States	3356	LEVEL3US	false
203.207.38.159	unknown	Taiwan; Republic of China (ROC)	24155	APBW-AS-TWAsiaPacificBroadbandWirelessCommunicationsIn	false
109.219.115.66	unknown	France	3215	FranceTelecom-OrangeFR	false
12.129.210.100	unknown	United States	17233	ATT-CERFNET-BLOCKUS	false
67.127.118.187	unknown	United States	7018	ATT-INTERNET4US	false
69.110.86.244	unknown	United States	7018	ATT-INTERNET4US	false
52.172.59.104	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
153.129.10.92	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
161.235.81.35	unknown	United States	13695	AEPUS	false
49.82.207.111	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
66.139.105.223	unknown	United States	7018	ATT-INTERNET4US	false
34.73.153.114	unknown	United States	15169	GOOGLEUS	false
39.86.138.45	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
110.97.239.177	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
217.153.35.205	unknown	Poland	5588	GTSCEGTSCentralEuropeAntelGermanyCZ	false
160.18.111.236	unknown	Japan	9370	SAKURA-BSAKURAInternetIncJP	false
172.96.4.1	unknown	United States	32931	PEAKTERAUS	false
182.192.0.248	unknown	Korea Republic of	6619	SAMSUNGSDS-AS-KRSamsungSDSIncKR	false
71.3.55.108	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
196.186.70.203	unknown	Tunisia	5438	ATI-TN	false
139.16.199.222	unknown	Germany	9905	LINKNET-ID-APLinknetASNID	false
189.67.143.157	unknown	Brazil	26615	TIMSABR	false
19.252.74.63	unknown	United States	3	MIT-GATEWAYSUS	false
145.37.74.81	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
146.125.50.38	unknown	United States	3260	INTRACOMGR	false
54.221.108.28	unknown	United States	14618	AMAZON-AESUS	false
125.235.185.91	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
4.248.133.154	unknown	United States	3356	LEVEL3US	false
183.161.15.38	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
111.52.93.125	unknown	China	56042	CMNET-SHANXI-APChinaMobilecommunicationscorporationCN	false
114.161.164.255	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
42.242.112.229	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
42.226.45.166	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
23.110.182.60	unknown	United States	395954	LEASEWEB-USA-LAX-11US	false
68.210.193.167	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
190.80.201.31	unknown	Dominican Republic	6400	CompaniaDominicanadeTelefonosSADO	false
202.253.113.115	unknown	Japan	17505	SBMOBILESOFTBANKMOBILECorpJP	false
99.11.56.163	unknown	United States	7018	ATT-INTERNET4US	false
64.97.78.58	unknown	Cayman Islands	62831	UNIREGISTRYKY	false
203.232.42.104	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
47.55.133.123	unknown	Canada	855	CANET-ASN-4CA	false
5.143.119.4	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
209.208.9.71	unknown	United States	6364	ATLANTIC-NET-1US	false
172.243.43.87	unknown	United States	7155	VIASAT-SP-BACKBONEUS	false
76.21.100.203	unknown	United States	7922	COMCAST-7922US	false
112.156.109.175	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
83.233.86.236	unknown	Sweden	29518	BREDBAND2SE	false
12.94.26.45	unknown	United States	7018	ATT-INTERNET4US	false
52.227.193.153	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
189.107.56.7	unknown	Brazil	7738	TelemarNorteLesteSABR	false
25.138.159.62	unknown	United Kingdom	7922	COMCAST-7922US	false
14.101.227.82	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
69.114.228.160	unknown	United States	6128	CABLE-NET-1US	false
205.126.193.213	unknown	United States	210	WEST-NET-WESTUS	false
9.52.147.119	unknown	United States	3356	LEVEL3US	false
202.42.223.89	unknown	Japan	4628	PACIFICINTERNET-AS-APPacificInternetPteLtdSG	false
117.5.125.129	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
167.154.41.95	unknown	United States	21783	SILVERNETUS	false
4.191.229.23	unknown	United States	3356	LEVEL3US	false
108.160.93.119	unknown	Canada	11287	AS-MSEACA	false
178.171.248.221	unknown	Syrian Arab Republic	29256	INT-PDN-STE-ASSTEPDNInternalASSY	false
170.45.109.88	unknown	United States	264957	CoopercitrusCooperativadeProdutoresRuraisBR	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
139.87.159.66	460eBVV1g4.elf	Get hash	malicious	Unknown	Browse
79.111.64.218	aGm9hyTGHd.elf	Get hash	malicious	Unknown	Browse
41.108.48.182	notabotnet.mips-20220921-0647.elf	Get hash	malicious	Mirai	Browse
	OecE69snIe	Get hash	malicious	Mirai	Browse
	88rZLb0kPf	Get hash	malicious	Mirai	Browse
	fajkHDqLJS	Get hash	malicious	Mirai	Browse
182.220.67.24	mips	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
nakotne.pirate	eId5V85KKM.elf	Get hash	malicious	Unknown	Browse	94.103.84.230
	nzKl7TpAyk.elf	Get hash	malicious	Unknown	Browse	94.103.84.230
	hZ80PhOmKK.elf	Get hash	malicious	Unknown	Browse	94.103.84.230
	C4zDQjrSzj.elf	Get hash	malicious	Unknown	Browse	94.103.83.102
	PaRWfF3x5K.elf	Get hash	malicious	Unknown	Browse	94.103.91.233
	VgF8V1Q5pg.elf	Get hash	malicious	Unknown	Browse	195.2.81.97
	TfRuTBn5oX.elf	Get hash	malicious	Unknown	Browse	94.103.84.230
	Pvq4zSr7yY.elf	Get hash	malicious	Unknown	Browse	94.103.84.230
	rzfcEvDxkx.elf	Get hash	malicious	Unknown	Browse	195.2.81.97
	HHzrOvo2d3.elf	Get hash	malicious	Unknown	Browse	94.103.91.233

Process:	/tmp/QH1v8Gya9C.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:TgBW03:Tg403
MD5:	D5AFFA970E9DC9E88BBD14BE386D1755
SHA1:	0BEF4564AF083DF14185DDCDB02C9F24592CEE30
SHA-256:	EE8F558475AEBECBB876EB186A6318D19F6F2C22BFBD2C7B34A027542568FB30
SHA-512:	B22B63C134FB2D4AFF51A1BBD46460EB5FC7BC1B21CC21035075DF608A83EEAF434ED15B9DAF9A8C47249EA786F359F6D1AFDD86F5150104EE13E12C218CA26E
Malicious:	false
Reputation:	low
Preview:	/tmp/QH1v8Gya9C.elf.

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	4.759835948388944
Encrypted:	false
SSDEEP:	24:O95MjYoJ9mY899YE9gAInx593AInq8AIi1RdYKwYu9iYVbYQeYQcPYYA:O95MUoJ9X89yE9enx59ZnqCi1RSK9u94
MD5:	A426BCF97663A7B31A4FFA395062D190
SHA1:	4016428892F9CC5F1EB0E07D86A0597D0C77F30D
SHA-256:	15B7897325884FE7676CC6643AC57E59E3487AD769180D2F5AAB84E605100DB1
SHA-512:	39BF3A6DFEFB78D79E14520B179F6F3076294DC6C149F6EA1AC441A7032AA72BAABE2F485A0EBA98A91E9CE1B44F23451CA2BAFB3CDEA44E8141B670E17A85CB
Malicious:	false
Preview:	May 27 23:27:12 galassia kernel: [ 126.416510] blocking signal 9: 5440 -> 1588.May 27 23:27:12 galassia kernel: [ 126.435924] blocking signal 9: 5440 -> 767.May 27 23:27:12 galassia kernel: [ 126.443326] blocking signal 9: 5440 -> 936.May 27 23:27:12 galassia kernel: [ 126.744104] New task spawned: old: (tgid 5562, tid 5562), new (tgid: 5562, tid: 5563).May 27 23:27:12 galassia kernel: [ 126.744208] New task spawned: old: (tgid 5562, tid 5562), new (tgid: 5562, tid: 5564).May 27 23:27:14 galassia kernel: [ 126.745873] New task spawned: old: (tgid 5562, tid 5563), new (tgid: 5562, tid: 5565).May 27 23:27:14 galassia kernel: [ 128.208727] blocking signal 9: 5440 -> 660.May 27 23:27:14 galassia kernel: [ 128.209770] blocking signal 9: 5440 -> 778.May 27 23:27:14 galassia kernel: [ 128.210396] blocking signal 9: 5440 -> 803.May 27 23:27:14 galassia kernel: [ 128.211899] blocking signal 9: 5440 -> 855.May 27 23:27:14 galassia kernel: [ 128.214396] blocking signal 9: 5440 -> 936.M

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.379344008439406
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	QH1v8Gya9C.elf
File size:	105'376 bytes
MD5:	22da69b45c1b3aa37763b8310e75a329
SHA1:	f656934ce58f8f18047d19a6915aafd86898ec23
SHA256:	d1e2d17121b354cfc9f4acadd85a65fa545d32e35f1ac47ab9cb25966bb516fe
SHA512:	fc30e992486433ff45cfe59e2c0ebca6a5750b853ab44bfb9809723ad591e188bae7dcbc9ae633fe764f94a4031548a85c2a2f4b0c92d35600b9196e80fefcd9
SSDEEP:	1536:RWEaeqPw3wMIqj2myOmELsV/O9dIVtmuf1fnuf6kJf38GoUAveeitvA5qNA+di9C:RKyIyupzmuf1fnuf6vG89WoqGvvd6LF
TLSH:	E1A3C61E6A118FACF35D823547F74E30A36822D627F0C685D6ACDA205F6078E541FBB9
File Content Preview:	.ELF.....................@.p...4...H.....4. ...(.............@...@...........................E...E........=.........dt.Q............................<...'......!'.......................<...'......!........'9... ......................<...'......!... ....'9w

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400270
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	104776
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	14

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x17680	0x0	0x6	AX	16
.fini	PROGBITS	0x4177a0	0x177a0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x417800	0x17800	0xd80	0x0	0x2	A	16
.eh_frame	PROGBITS	0x459000	0x19000	0x4	0x0	0x3	WA	4
.ctors	PROGBITS	0x459004	0x19004	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x45900c	0x1900c	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x459014	0x19014	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x459020	0x19020	0x284	0x0	0x3	WA	16
.got	PROGBITS	0x4592b0	0x192b0	0x630	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x4598e0	0x198e0	0x1c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x459900	0x198e0	0x34c4	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0xd92	0x198e0	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x198e0	0x66	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x18580	0x18580	5.4945	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x19000	0x459000	0x459000	0x8e0	0x3dc4	3.7762	0x6	RW	0x10000	.eh_frame .ctors .dtors .jcr .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 28, 2024 06:26:53.438205004 CEST	130.61.64.122	192.168.2.13	0x4696	No error (0)	nakotne.pirate	94.103.91.233	A (IP address)	IN (0x0001)	false
May 28, 2024 06:26:53.438205004 CEST	130.61.64.122	192.168.2.13	0x4696	No error (0)	nakotne.pirate	94.103.83.102	A (IP address)	IN (0x0001)	false
May 28, 2024 06:26:53.438205004 CEST	130.61.64.122	192.168.2.13	0x4696	No error (0)	nakotne.pirate	94.103.84.230	A (IP address)	IN (0x0001)	false
May 28, 2024 06:26:53.438205004 CEST	130.61.64.122	192.168.2.13	0x4696	No error (0)	nakotne.pirate	89.110.90.159	A (IP address)	IN (0x0001)	false
May 28, 2024 06:26:53.438205004 CEST	130.61.64.122	192.168.2.13	0x4696	No error (0)	nakotne.pirate	195.2.81.97	A (IP address)	IN (0x0001)	false

Start time (UTC):	04:26:52
Start date (UTC):	28/05/2024
Path:	/tmp/QH1v8Gya9C.elf
Arguments:	/tmp/QH1v8Gya9C.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	04:26:53
Start date (UTC):	28/05/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	04:26:54
Start date (UTC):	28/05/2024
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report QH1v8Gya9C.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.09VBdy (deleted)

/tmp/qemu-open.176gFx (deleted)

/tmp/qemu-open.1pHM3y (deleted)

/tmp/qemu-open.3tgtUw (deleted)

/tmp/qemu-open.4D1tfw (deleted)

/tmp/qemu-open.4NK9fw (deleted)

/tmp/qemu-open.53t0Yv (deleted)

/tmp/qemu-open.5LyTow (deleted)

/tmp/qemu-open.5y9kIz (deleted)

/tmp/qemu-open.6Lqhcx (deleted)

/tmp/qemu-open.7I3MBz (deleted)

/tmp/qemu-open.8kZYMw (deleted)

/tmp/qemu-open.AZPnVw (deleted)

/tmp/qemu-open.CQcxpx (deleted)

/tmp/qemu-open.DnHbXx (deleted)

/tmp/qemu-open.Ef5uoy (deleted)

/tmp/qemu-open.EmsA7y (deleted)

/tmp/qemu-open.Gy96cx (deleted)

/tmp/qemu-open.HJIMKv (deleted)

/tmp/qemu-open.IKtCLv (deleted)

/tmp/qemu-open.Ig87Sy (deleted)

/tmp/qemu-open.JbxfVx (deleted)

/tmp/qemu-open.JmoIvz (deleted)

/tmp/qemu-open.JraYhx (deleted)

/tmp/qemu-open.K1uBLx (deleted)

/tmp/qemu-open.K8FOvz (deleted)

/tmp/qemu-open.LrppKx (deleted)

/tmp/qemu-open.MHmLjw (deleted)

/tmp/qemu-open.MIlBWz (deleted)

/tmp/qemu-open.N6454v (deleted)

/tmp/qemu-open.NPkufw (deleted)

Linux Analysis Report
QH1v8Gya9C.elf

Start time (UTC):	04:26:55
Start date (UTC):	28/05/2024
Path:	/usr/libexec/gsd-sound
Arguments:	/usr/libexec/gsd-sound
File size:	31248 bytes
MD5 hash:	4c7d3fb993463337b4a0eb5c80c760ee

Start time (UTC):	04:26:56
Start date (UTC):	28/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:27:05
Start date (UTC):	28/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:27:06
Start date (UTC):	28/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:27:08
Start date (UTC):	28/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:27:10
Start date (UTC):	28/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:27:12
Start date (UTC):	28/05/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre