Edit tour

Linux Analysis Report
tB114oiRY5.elf

Overview

General Information

Sample name:	tB114oiRY5.elf renamed because original name is a hash value
Original sample name:	0b13dcdc32bcdf568921cad70834a140.elf
Analysis ID:	1458306
MD5:	0b13dcdc32bcdf568921cad70834a140
SHA1:	e385c93c147c8240fb319492912173f35e4383f8
SHA256:	12d7da7f77aab771ffff6dd614209815565ee9f292e8b97854fa4af67b9ac291
Tags:	32armelfgafgyt
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1458306
Start date and time:	2024-06-17 14:29:56 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	tB114oiRY5.elf renamed because original name is a hash value
Original Sample Name:	0b13dcdc32bcdf568921cad70834a140.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@20/0

Runtime Messages

Command:	/tmp/tB114oiRY5.elf
PID:	5526
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

tB114oiRY5.elf (PID: 5526, Parent: 5450, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/tB114oiRY5.elf

tB114oiRY5.elf New Fork (PID: 5528, Parent: 5526)

tB114oiRY5.elf New Fork (PID: 5530, Parent: 5528)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
tB114oiRY5.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
tB114oiRY5.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
tB114oiRY5.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
tB114oiRY5.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1886c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1890c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1895c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
tB114oiRY5.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1872c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5526.1.00007f2eec017000.00007f2eec032000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5526.1.00007f2eec017000.00007f2eec032000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5526.1.00007f2eec017000.00007f2eec032000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5526.1.00007f2eec017000.00007f2eec032000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1886c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x188f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1890c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18920:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18934:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18948:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1895c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18970:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18984:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18998:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x189fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5526.1.00007f2eec017000.00007f2eec032000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1872c:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: tB114oiRY5.elf PID: 5526	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: tB114oiRY5.elf PID: 5526	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: tB114oiRY5.elf PID: 5526	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: tB114oiRY5.elf PID: 5526	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x26d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x281:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x295:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x321:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x335:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x349:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x35d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x371:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x385:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x399:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: tB114oiRY5.elf PID: 5526	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x153:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 5 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:32:38.247396
SID:	2030490
Source Port:	36144
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:57.561004
SID:	2030490
Source Port:	36112
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:37.759008
SID:	2030490
Source Port:	36122
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:43.383963
SID:	2030490
Source Port:	36124
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:49.894046
SID:	2030490
Source Port:	36110
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:06.218351
SID:	2030490
Source Port:	36114
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:32:06.940047
SID:	2030490
Source Port:	36132
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:32:17.190616
SID:	2030490
Source Port:	36136
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:37.574872
SID:	2030490
Source Port:	36106
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:16.859930
SID:	2030490
Source Port:	36116
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:30.131367
SID:	2030490
Source Port:	36120
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:52.046551
SID:	2030490
Source Port:	36126
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:32:00.672642
SID:	2030490
Source Port:	36128
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:32:27.486237
SID:	2030490
Source Port:	36140
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:32:31.114419
SID:	2030490
Source Port:	36142
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:32:02.308501
SID:	2030490
Source Port:	36130
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:32:25.809812
SID:	2030490
Source Port:	36138
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:30:44.190337
SID:	2030490
Source Port:	36108
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:31:21.504352
SID:	2030490
Source Port:	36118
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.15 - Destination IP: 146.185.209.82

Timestamp:	06/17/24-14:32:12.565813
SID:	2030490
Source Port:	36134
Destination Port:	47925
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: tB114oiRY5.elf	Virustotal: Detection: 57%			Perma Link
Source: tB114oiRY5.elf	ReversingLabs: Detection: 55%

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36106 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36108 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36110 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36112 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36114 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36116 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36118 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36120 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36122 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36124 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36126 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36128 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36130 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36132 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36134 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36136 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36138 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36140 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36142 -> 146.185.209.82:47925
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.15:36144 -> 146.185.209.82:47925

Source: tB114oiRY5.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: tB114oiRY5.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5526.1.00007f2eec017000.00007f2eec032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5526.1.00007f2eec017000.00007f2eec032000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: tB114oiRY5.elf PID: 5526, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: tB114oiRY5.elf PID: 5526, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/3874/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/133/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/265/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/145/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/266/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/267/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/268/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/269/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/1806/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/tB114oiRY5.elf (PID: 5530)	File opened: /proc/270/cmdline	Jump to behavior

Source: tB114oiRY5.elf, 5526.1.000055dd3534a000.000055dd3549a000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: tB114oiRY5.elf, 5526.1.000055dd3534a000.000055dd3549a000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: tB114oiRY5.elf, 5526.1.00007fff94f28000.00007fff94f49000.rw-.sdmp	Binary or memory string: RcU`x86_64/usr/bin/qemu-arm/tmp/tB114oiRY5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/tB114oiRY5.elf
Source: tB114oiRY5.elf, 5526.1.00007fff94f28000.00007fff94f49000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Yara match	File source: tB114oiRY5.elf, type: SAMPLE
Source: Yara match	File source: 5526.1.00007f2eec017000.00007f2eec032000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tB114oiRY5.elf PID: 5526, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
tB114oiRY5.elf	57%	Virustotal		Browse
tB114oiRY5.elf	55%	ReversingLabs	Linux.Trojan.Mirai
tB114oiRY5.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
146.185.209.82	UpgzkaAmBp.elf	Get hash	malicious	Mirai, Okiru	Browse
146.185.209.82	Buj4LG5Eu4.elf	Get hash	malicious	Mirai, Okiru	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
seyfhg.work.gd	UpgzkaAmBp.elf	Get hash	malicious	Mirai, Okiru	Browse	146.185.209.82
seyfhg.work.gd	Buj4LG5Eu4.elf	Get hash	malicious	Mirai, Okiru	Browse	146.185.209.82

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MATTEOGB	UpgzkaAmBp.elf	Get hash	malicious	Mirai, Okiru	Browse	146.185.209.82
	Buj4LG5Eu4.elf	Get hash	malicious	Mirai, Okiru	Browse	146.185.209.82
	TradingView.exe	Get hash	malicious	RedLine	Browse	91.243.59.21
	3.apk	Get hash	malicious	TEABot	Browse	91.243.34.26
	fEOqmNHQhu.exe	Get hash	malicious	Cerber	Browse	31.184.234.34
	n2vBPxeTmB.exe	Get hash	malicious	DCRat, RedLine	Browse	91.243.32.178
	[Cracked By Grizzly] BLTools.exe	Get hash	malicious	RedLine	Browse	91.243.59.21
	4sEgS3BBbZ.exe	Get hash	malicious	RedLine	Browse	91.243.59.24
	p8pt2tWWQ5.exe	Get hash	malicious	RedLine	Browse	91.243.59.61
	nplv4.exe	Get hash	malicious	RedLine	Browse	91.243.59.6

Process:	/tmp/tB114oiRY5.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887362
Encrypted:	false
SSDEEP:	3:TgBUURXMQCn:Tgi8MQC
MD5:	A18C675C0066D7CF32E2F8EF8E55D3FA
SHA1:	38AC067ACE28B087A4E896C0CD5A8FFFBC60CE2F
SHA-256:	76610327D8B5F298EBD2AD80F3D121D9E519EC7FFB9D97F973A5B12410703E5C
SHA-512:	3F91C7713341CFB20D1B156687F6E8F1DD075400FCF5C889B9BCCA9647BE83342441D05D8037D0EE4628F2950FE515B74F9D6AB3ACDDEBB9ED482F169BEF73DD
Malicious:	false
Reputation:	low
Preview:	/tmp/tB114oiRY5.elf.

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.9927932535161395
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	tB114oiRY5.elf
File size:	184'862 bytes
MD5:	0b13dcdc32bcdf568921cad70834a140
SHA1:	e385c93c147c8240fb319492912173f35e4383f8
SHA256:	12d7da7f77aab771ffff6dd614209815565ee9f292e8b97854fa4af67b9ac291
SHA512:	075b0b8d13af1cca702b3dc70065c71f14ae05fe3aa37802d7ddb073dc0516902775c1c584d409727d3316ca54d9fe239cab43eef48bb8d7506285b96db1e7a9
SSDEEP:	3072:OqSwFNKWClO1TvknaBn4qfdQSCcQzWo6y6/YpEoGM/Rxb044jSB:rSIN8lOBMnaBn4qFQ/Oo/6/yJGM/Rxb1
TLSH:	FB043A45EA414B13C0D72BB9F6DF42453323A7A497EB73069528AFF43F8279E4E22905
File Content Preview:	.ELF..............(.........4..../......4. ...(........ph...h%..h%..p...p................................................................V..........................................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	143280
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x17f9c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x2008c	0x1808c	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x200a0	0x180a0	0x24b0	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x22550	0x1a550	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x22568	0x1a568	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2a6d8	0x1a6d8	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x2a6dc	0x1a6dc	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x2a6e0	0x1a6e0	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2a6e0	0x1a6e0	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2a6e4	0x1a6e4	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2a6e8	0x1a6e8	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2a6ec	0x1a6ec	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2a7ac	0x1a7ac	0x2f4	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2aaa0	0x1aaa0	0x5304	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1aaa0	0xea4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1b948	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1baa8	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1bce6	0x29df	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1e6c5	0x986	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1f04b	0x10da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x20128	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x20464	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x20f20	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x2274a	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x22e7a	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x22e90	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x23460	0x6570	0x10	0x0		29	937	4
.strtab	STRTAB	0x0	0x299d0	0x384e	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1a568	0x22568	0x22568	0x170	0x170	4.7151	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1a6d8	0x1a6d8	6.1431	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1a6d8	0x2a6d8	0x2a6d8	0x3c8	0x56cc	4.2799	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1a6dc	0x2a6dc	0x2a6dc	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 17, 2024 14:30:37.552196980 CEST	36106	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:37.557315111 CEST	47925	36106	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:37.557390928 CEST	36106	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:37.574872017 CEST	36106	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:37.580359936 CEST	47925	36106	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:38.162185907 CEST	47925	36106	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:38.162584066 CEST	36106	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:38.167680979 CEST	47925	36106	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:44.179806948 CEST	36108	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:44.185992956 CEST	47925	36108	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:44.186044931 CEST	36108	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:44.190336943 CEST	36108	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:44.196464062 CEST	47925	36108	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:44.817902088 CEST	47925	36108	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:44.818047047 CEST	36108	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:44.823059082 CEST	47925	36108	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:49.888215065 CEST	36110	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:49.893228054 CEST	47925	36110	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:49.893330097 CEST	36110	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:49.894046068 CEST	36110	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:49.899210930 CEST	47925	36110	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:51.546204090 CEST	47925	36110	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:51.546394110 CEST	36110	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:51.546761036 CEST	47925	36110	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:51.546818018 CEST	36110	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:51.546966076 CEST	47925	36110	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:51.547029018 CEST	36110	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:51.547420025 CEST	47925	36110	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:51.547487020 CEST	36110	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:51.551400900 CEST	47925	36110	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:57.555450916 CEST	36112	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:57.560297966 CEST	47925	36112	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:57.560362101 CEST	36112	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:57.561003923 CEST	36112	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:57.565783978 CEST	47925	36112	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:58.203744888 CEST	47925	36112	146.185.209.82	192.168.2.15
Jun 17, 2024 14:30:58.203872919 CEST	36112	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:30:58.208800077 CEST	47925	36112	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:06.212730885 CEST	36114	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:06.217618942 CEST	47925	36114	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:06.217684031 CEST	36114	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:06.218350887 CEST	36114	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:06.223304987 CEST	47925	36114	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:06.845630884 CEST	47925	36114	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:06.845738888 CEST	36114	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:06.850708008 CEST	47925	36114	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:16.854557991 CEST	36116	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:16.859371901 CEST	47925	36116	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:16.859420061 CEST	36116	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:16.859930038 CEST	36116	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:16.864975929 CEST	47925	36116	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:17.487890005 CEST	47925	36116	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:17.488048077 CEST	36116	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:17.492940903 CEST	47925	36116	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:21.498019934 CEST	36118	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:21.503808975 CEST	47925	36118	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:21.503875017 CEST	36118	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:21.504352093 CEST	36118	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:21.509558916 CEST	47925	36118	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:22.115823030 CEST	47925	36118	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:22.115973949 CEST	36118	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:22.120860100 CEST	47925	36118	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:30.125648975 CEST	36120	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:30.130481005 CEST	47925	36120	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:30.130575895 CEST	36120	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:30.131366968 CEST	36120	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:30.136243105 CEST	47925	36120	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:30.744299889 CEST	47925	36120	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:30.744492054 CEST	36120	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:30.749613047 CEST	47925	36120	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:37.753460884 CEST	36122	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:37.758318901 CEST	47925	36122	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:37.758382082 CEST	36122	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:37.759007931 CEST	36122	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:37.763926983 CEST	47925	36122	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:38.368663073 CEST	47925	36122	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:38.368952990 CEST	36122	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:38.373804092 CEST	47925	36122	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:43.378062010 CEST	36124	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:43.383420944 CEST	47925	36124	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:43.383497000 CEST	36124	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:43.383963108 CEST	36124	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:43.388819933 CEST	47925	36124	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:43.989203930 CEST	47925	36124	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:43.989481926 CEST	36124	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:43.994426966 CEST	47925	36124	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:52.040960073 CEST	36126	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:52.045872927 CEST	47925	36126	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:52.045952082 CEST	36126	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:52.046550989 CEST	36126	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:52.051317930 CEST	47925	36126	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:52.657375097 CEST	47925	36126	146.185.209.82	192.168.2.15
Jun 17, 2024 14:31:52.657572985 CEST	36126	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:31:52.662533045 CEST	47925	36126	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:00.665858030 CEST	36128	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:00.672008038 CEST	47925	36128	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:00.672118902 CEST	36128	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:00.672641993 CEST	36128	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:00.677716970 CEST	47925	36128	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:01.293750048 CEST	47925	36128	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:01.293898106 CEST	36128	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:01.298849106 CEST	47925	36128	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:02.302786112 CEST	36130	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:02.307867050 CEST	47925	36130	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:02.307980061 CEST	36130	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:02.308501005 CEST	36130	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:02.313391924 CEST	47925	36130	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:02.924417019 CEST	47925	36130	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:02.924576044 CEST	36130	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:02.930347919 CEST	47925	36130	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:06.934489965 CEST	36132	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:06.939471006 CEST	47925	36132	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:06.939532042 CEST	36132	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:06.940047026 CEST	36132	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:06.944807053 CEST	47925	36132	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:07.551331997 CEST	47925	36132	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:07.551467896 CEST	36132	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:07.556253910 CEST	47925	36132	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:12.560136080 CEST	36134	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:12.564990044 CEST	47925	36134	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:12.565062046 CEST	36134	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:12.565813065 CEST	36134	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:12.570851088 CEST	47925	36134	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:13.175926924 CEST	47925	36134	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:13.176307917 CEST	36134	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:13.181113005 CEST	47925	36134	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:17.185064077 CEST	36136	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:17.190097094 CEST	47925	36136	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:17.190156937 CEST	36136	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:17.190615892 CEST	36136	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:17.195564985 CEST	47925	36136	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:17.794399977 CEST	47925	36136	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:17.794531107 CEST	36136	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:17.800052881 CEST	47925	36136	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:25.803960085 CEST	36138	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:25.809169054 CEST	47925	36138	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:25.809390068 CEST	36138	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:25.809812069 CEST	36138	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:25.815124989 CEST	47925	36138	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:26.470171928 CEST	47925	36138	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:26.470338106 CEST	36138	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:26.475166082 CEST	47925	36138	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:27.480345011 CEST	36140	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:27.485240936 CEST	47925	36140	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:27.485347033 CEST	36140	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:27.486237049 CEST	36140	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:27.491147041 CEST	47925	36140	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:28.098354101 CEST	47925	36140	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:28.098515987 CEST	36140	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:28.105463028 CEST	47925	36140	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:31.108287096 CEST	36142	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:31.113702059 CEST	47925	36142	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:31.113816977 CEST	36142	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:31.114418983 CEST	36142	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:31.122984886 CEST	47925	36142	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:32.232520103 CEST	47925	36142	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:32.232558966 CEST	47925	36142	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:32.232569933 CEST	47925	36142	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:32.232642889 CEST	36142	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:32.232695103 CEST	36142	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:32.232695103 CEST	36142	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:32.237601042 CEST	47925	36142	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:38.241991997 CEST	36144	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:38.246861935 CEST	47925	36144	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:38.246923923 CEST	36144	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:38.247395992 CEST	36144	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:38.255305052 CEST	47925	36144	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:38.855288982 CEST	47925	36144	146.185.209.82	192.168.2.15
Jun 17, 2024 14:32:38.855465889 CEST	36144	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:38.855465889 CEST	36144	47925	192.168.2.15	146.185.209.82
Jun 17, 2024 14:32:38.860244036 CEST	47925	36144	146.185.209.82	192.168.2.15

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 17, 2024 14:30:37.530657053 CEST	41905	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:30:37.537712097 CEST	53	41905	8.8.8.8	192.168.2.15
Jun 17, 2024 14:30:44.170564890 CEST	35552	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:30:44.178581953 CEST	53	35552	8.8.8.8	192.168.2.15
Jun 17, 2024 14:30:49.821305990 CEST	44312	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:30:49.887702942 CEST	53	44312	8.8.8.8	192.168.2.15
Jun 17, 2024 14:30:57.547822952 CEST	50174	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:30:57.555041075 CEST	53	50174	8.8.8.8	192.168.2.15
Jun 17, 2024 14:31:06.205138922 CEST	52489	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:31:06.212177992 CEST	53	52489	8.8.8.8	192.168.2.15
Jun 17, 2024 14:31:16.847135067 CEST	53874	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:31:16.854211092 CEST	53	53874	8.8.8.8	192.168.2.15
Jun 17, 2024 14:31:21.489481926 CEST	55177	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:31:21.497674942 CEST	53	55177	8.8.8.8	192.168.2.15
Jun 17, 2024 14:31:30.117654085 CEST	41277	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:31:30.125216007 CEST	53	41277	8.8.8.8	192.168.2.15
Jun 17, 2024 14:31:37.746536016 CEST	43647	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:31:37.753077984 CEST	53	43647	8.8.8.8	192.168.2.15
Jun 17, 2024 14:31:43.370250940 CEST	60870	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:31:43.377671957 CEST	53	60870	8.8.8.8	192.168.2.15
Jun 17, 2024 14:31:51.991111040 CEST	52739	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:31:52.040280104 CEST	53	52739	8.8.8.8	192.168.2.15
Jun 17, 2024 14:32:00.658886909 CEST	47452	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:32:00.665503979 CEST	53	47452	8.8.8.8	192.168.2.15
Jun 17, 2024 14:32:02.295362949 CEST	45659	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:32:02.302443027 CEST	53	45659	8.8.8.8	192.168.2.15
Jun 17, 2024 14:32:06.926321030 CEST	47881	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:32:06.934119940 CEST	53	47881	8.8.8.8	192.168.2.15
Jun 17, 2024 14:32:12.553056955 CEST	33655	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:32:12.559736013 CEST	53	33655	8.8.8.8	192.168.2.15
Jun 17, 2024 14:32:17.177656889 CEST	42487	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:32:17.184724092 CEST	53	42487	8.8.8.8	192.168.2.15
Jun 17, 2024 14:32:25.796289921 CEST	50280	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:32:25.803550005 CEST	53	50280	8.8.8.8	192.168.2.15
Jun 17, 2024 14:32:27.472800016 CEST	51460	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:32:27.479808092 CEST	53	51460	8.8.8.8	192.168.2.15
Jun 17, 2024 14:32:31.099912882 CEST	47100	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:32:31.107852936 CEST	53	47100	8.8.8.8	192.168.2.15
Jun 17, 2024 14:32:38.234498978 CEST	43726	53	192.168.2.15	8.8.8.8
Jun 17, 2024 14:32:38.241677999 CEST	53	43726	8.8.8.8	192.168.2.15

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report tB114oiRY5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.042V0k (deleted)

/tmp/qemu-open.04VI4n (deleted)

/tmp/qemu-open.05oh7j (deleted)

/tmp/qemu-open.0932rm (deleted)

/tmp/qemu-open.0MdhCn (deleted)

/tmp/qemu-open.0TMb5j (deleted)

/tmp/qemu-open.0Uslil (deleted)

/tmp/qemu-open.0V3IDj (deleted)

/tmp/qemu-open.0Z7jak (deleted)

/tmp/qemu-open.0ZlHil (deleted)

/tmp/qemu-open.0clinl (deleted)

/tmp/qemu-open.0dReil (deleted)

/tmp/qemu-open.0fbwhm (deleted)

/tmp/qemu-open.0lg08n (deleted)

/tmp/qemu-open.0qY3hl (deleted)

/tmp/qemu-open.0uB16m (deleted)

/tmp/qemu-open.0uHr4j (deleted)

/tmp/qemu-open.0uJNek (deleted)

/tmp/qemu-open.0yTbFm (deleted)

/tmp/qemu-open.0yzWRm (deleted)

/tmp/qemu-open.19yhPn (deleted)

/tmp/qemu-open.1DbMTk (deleted)

/tmp/qemu-open.1Gfrxk (deleted)

/tmp/qemu-open.1LMfrl (deleted)

/tmp/qemu-open.1PiwGk (deleted)

/tmp/qemu-open.1RWkRl (deleted)

/tmp/qemu-open.1XKXFm (deleted)

/tmp/qemu-open.1gqTQn (deleted)

/tmp/qemu-open.1hIUtl (deleted)

Linux Analysis Report
tB114oiRY5.elf

Start time (UTC):	12:30:37
Start date (UTC):	17/06/2024
Path:	/tmp/tB114oiRY5.elf
Arguments:	/tmp/tB114oiRY5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre