Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
zmap.mpsl.elf

Overview

General Information

Sample name:zmap.mpsl.elf
Analysis ID:1547428
MD5:b4458e4fa2efcf88bfa2aaeda864519e
SHA1:8263798736379ed4ce23ef75e4d1f606e05c815b
SHA256:146ef07d918f77546ba8112e9f307361f9d54af4886dba7fc4ba9e58bc8c5d47
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score:76
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Yara detected Mirai
Yara detected Okiru
Sample deletes itself
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1547428
Start date and time:2024-11-02 13:47:10 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 32s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:zmap.mpsl.elf
Detection:MAL
Classification:mal76.troj.evad.linELF@0/0@1/0
  • VT rate limit hit for: zmap.mpsl.elf
Command:/tmp/zmap.mpsl.elf
PID:6226
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
VagneRHere
Standard Error:
  • system is lnxubuntu20
  • zmap.mpsl.elf (PID: 6226, Parent: 6151, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/zmap.mpsl.elf
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
zmap.mpsl.elfJoeSecurity_OkiruYara detected OkiruJoe Security
    zmap.mpsl.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      zmap.mpsl.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x14988:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x1499c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x149b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x149c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x149d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x149ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14a00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14a14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14a28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14a3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14a50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14a64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14a78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14a8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14aa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14ab4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14ac8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14adc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14af0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14b04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x14b18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      SourceRuleDescriptionAuthorStrings
      6226.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
        6226.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          6226.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0x14988:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x1499c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x149b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x149c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x149d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x149ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14a00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14a14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14a28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14a3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14a50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14a64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14a78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14a8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14aa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14ab4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14ac8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14adc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14af0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14b04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x14b18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          6230.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
            6230.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
              Click to see the 7 entries
              No Suricata rule has matched

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Source: zmap.mpsl.elfAvira: detected
              Source: global trafficTCP traffic: 192.168.2.23:35766 -> 154.216.16.38:59962
              Source: /tmp/zmap.mpsl.elf (PID: 6226)Socket: 127.0.0.1:39148Jump to behavior
              Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
              Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
              Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
              Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
              Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
              Source: global trafficDNS traffic detected: DNS query: server.myway-ing.win
              Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

              System Summary

              barindex
              Source: zmap.mpsl.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: 6226.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: 6230.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: Process Memory Space: zmap.mpsl.elf PID: 6226, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: Process Memory Space: zmap.mpsl.elf PID: 6230, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: ELF static info symbol of initial sample.symtab present: no
              Source: zmap.mpsl.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: 6226.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: 6230.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: Process Memory Space: zmap.mpsl.elf PID: 6226, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: Process Memory Space: zmap.mpsl.elf PID: 6230, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: classification engineClassification label: mal76.troj.evad.linELF@0/0@1/0

              Hooking and other Techniques for Hiding and Protection

              barindex
              Source: /tmp/zmap.mpsl.elf (PID: 6226)File: /tmp/zmap.mpsl.elfJump to behavior
              Source: /tmp/zmap.mpsl.elf (PID: 6226)Queries kernel information via 'uname': Jump to behavior
              Source: zmap.mpsl.elf, 6226.1.0000555a37a64000.0000555a37aeb000.rw-.sdmp, zmap.mpsl.elf, 6230.1.0000555a37a64000.0000555a37aeb000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
              Source: zmap.mpsl.elf, 6226.1.0000555a37a64000.0000555a37aeb000.rw-.sdmp, zmap.mpsl.elf, 6230.1.0000555a37a64000.0000555a37aeb000.rw-.sdmpBinary or memory string: 7ZU!/etc/qemu-binfmt/mipsel
              Source: zmap.mpsl.elf, 6226.1.00007ffd9c083000.00007ffd9c0a4000.rw-.sdmp, zmap.mpsl.elf, 6230.1.00007ffd9c083000.00007ffd9c0a4000.rw-.sdmpBinary or memory string: #x86_64/usr/bin/qemu-mipsel/tmp/zmap.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/zmap.mpsl.elf
              Source: zmap.mpsl.elf, 6226.1.00007ffd9c083000.00007ffd9c0a4000.rw-.sdmp, zmap.mpsl.elf, 6230.1.00007ffd9c083000.00007ffd9c0a4000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel

              Stealing of Sensitive Information

              barindex
              Source: Yara matchFile source: zmap.mpsl.elf, type: SAMPLE
              Source: Yara matchFile source: 6226.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6230.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: zmap.mpsl.elf PID: 6226, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: zmap.mpsl.elf PID: 6230, type: MEMORYSTR
              Source: Yara matchFile source: zmap.mpsl.elf, type: SAMPLE
              Source: Yara matchFile source: 6226.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6230.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: zmap.mpsl.elf PID: 6226, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: zmap.mpsl.elf PID: 6230, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Source: Yara matchFile source: zmap.mpsl.elf, type: SAMPLE
              Source: Yara matchFile source: 6226.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6230.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: zmap.mpsl.elf PID: 6226, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: zmap.mpsl.elf PID: 6230, type: MEMORYSTR
              Source: Yara matchFile source: zmap.mpsl.elf, type: SAMPLE
              Source: Yara matchFile source: 6226.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6230.1.00007fa9c0400000.00007fa9c0417000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: zmap.mpsl.elf PID: 6226, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: zmap.mpsl.elf PID: 6230, type: MEMORYSTR
              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
              File Deletion
              OS Credential Dumping11
              Security Software Discovery
              Remote ServicesData from Local System1
              Encrypted Channel
              Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
              Non-Standard Port
              Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
              Non-Application Layer Protocol
              Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
              Application Layer Protocol
              Traffic DuplicationData Destruction
              No configs have been found
              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Number of created Files
              • Is malicious
              • Internet
              SourceDetectionScannerLabelLink
              zmap.mpsl.elf100%AviraEXP/ELF.Mirai.Z.A
              No Antivirus matches
              No Antivirus matches
              No Antivirus matches
              NameIPActiveMaliciousAntivirus DetectionReputation
              server.myway-ing.win
              154.216.16.38
              truefalse
                unknown
                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs
                IPDomainCountryFlagASNASN NameMalicious
                109.202.202.202
                unknownSwitzerland
                13030INIT7CHfalse
                154.216.16.38
                server.myway-ing.winSeychelles
                135357SKHT-ASShenzhenKatherineHengTechnologyInformationCofalse
                91.189.91.43
                unknownUnited Kingdom
                41231CANONICAL-ASGBfalse
                91.189.91.42
                unknownUnited Kingdom
                41231CANONICAL-ASGBfalse
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                154.216.16.38debug.dbg.elfGet hashmaliciousMirai, OkiruBrowse
                  zmap.m68k.elfGet hashmaliciousMirai, OkiruBrowse
                    zmap.mpsl.elfGet hashmaliciousMirai, OkiruBrowse
                      zmap.mips.elfGet hashmaliciousMirai, OkiruBrowse
                        zmap.arm.elfGet hashmaliciousMirai, OkiruBrowse
                          zmap.spc.elfGet hashmaliciousMirai, OkiruBrowse
                            zmap.sh4.elfGet hashmaliciousMirai, OkiruBrowse
                              zmap.ppc.elfGet hashmaliciousMirai, OkiruBrowse
                                zmap.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                  zmap.x86.elfGet hashmaliciousOkiruBrowse
                                    91.189.91.43qkbfi86.elfGet hashmaliciousMiraiBrowse
                                      .i.elfGet hashmaliciousUnknownBrowse
                                        linux_arm64.elfGet hashmaliciousUnknownBrowse
                                          .i.elfGet hashmaliciousUnknownBrowse
                                            10000.elfGet hashmaliciousBillGatesBrowse
                                              boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                boatnet.mips.elfGet hashmaliciousMiraiBrowse
                                                  boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                    .i.elfGet hashmaliciousUnknownBrowse
                                                      sshd.elfGet hashmaliciousUnknownBrowse
                                                        91.189.91.42jwwofba5.elfGet hashmaliciousMiraiBrowse
                                                          qkbfi86.elfGet hashmaliciousMiraiBrowse
                                                            .i.elfGet hashmaliciousUnknownBrowse
                                                              linux_arm64.elfGet hashmaliciousUnknownBrowse
                                                                .i.elfGet hashmaliciousUnknownBrowse
                                                                  10000.elfGet hashmaliciousBillGatesBrowse
                                                                    boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                                      boatnet.mips.elfGet hashmaliciousMiraiBrowse
                                                                        boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                                          .i.elfGet hashmaliciousUnknownBrowse
                                                                            No context
                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                            CANONICAL-ASGBjwwofba5.elfGet hashmaliciousMiraiBrowse
                                                                            • 91.189.91.42
                                                                            qkbfi86.elfGet hashmaliciousMiraiBrowse
                                                                            • 91.189.91.42
                                                                            .i.elfGet hashmaliciousUnknownBrowse
                                                                            • 91.189.91.42
                                                                            linux_arm64.elfGet hashmaliciousUnknownBrowse
                                                                            • 91.189.91.42
                                                                            .i.elfGet hashmaliciousUnknownBrowse
                                                                            • 91.189.91.42
                                                                            mcron-vip-1.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.125.190.26
                                                                            10000.elfGet hashmaliciousBillGatesBrowse
                                                                            • 91.189.91.42
                                                                            i.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.125.190.26
                                                                            boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                                            • 91.189.91.42
                                                                            boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                                                            • 185.125.190.26
                                                                            CANONICAL-ASGBjwwofba5.elfGet hashmaliciousMiraiBrowse
                                                                            • 91.189.91.42
                                                                            qkbfi86.elfGet hashmaliciousMiraiBrowse
                                                                            • 91.189.91.42
                                                                            .i.elfGet hashmaliciousUnknownBrowse
                                                                            • 91.189.91.42
                                                                            linux_arm64.elfGet hashmaliciousUnknownBrowse
                                                                            • 91.189.91.42
                                                                            .i.elfGet hashmaliciousUnknownBrowse
                                                                            • 91.189.91.42
                                                                            mcron-vip-1.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.125.190.26
                                                                            10000.elfGet hashmaliciousBillGatesBrowse
                                                                            • 91.189.91.42
                                                                            i.elfGet hashmaliciousUnknownBrowse
                                                                            • 185.125.190.26
                                                                            boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                                            • 91.189.91.42
                                                                            boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                                                            • 185.125.190.26
                                                                            SKHT-ASShenzhenKatherineHengTechnologyInformationCoqkehusl.elfGet hashmaliciousMiraiBrowse
                                                                            • 154.216.19.76
                                                                            jwwofba5.elfGet hashmaliciousMiraiBrowse
                                                                            • 154.216.19.76
                                                                            wheiuwa4.elfGet hashmaliciousMiraiBrowse
                                                                            • 154.216.19.76
                                                                            dvwkja7.elfGet hashmaliciousMiraiBrowse
                                                                            • 154.216.19.76
                                                                            vsbeps.elfGet hashmaliciousMiraiBrowse
                                                                            • 154.216.19.76
                                                                            qkbfi86.elfGet hashmaliciousMiraiBrowse
                                                                            • 154.216.19.76
                                                                            boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                                                                            • 154.216.19.64
                                                                            boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                                            • 154.216.19.64
                                                                            boatnet.ppc.elfGet hashmaliciousUnknownBrowse
                                                                            • 154.216.19.64
                                                                            boatnet.mips.elfGet hashmaliciousMiraiBrowse
                                                                            • 154.216.19.64
                                                                            INIT7CHjwwofba5.elfGet hashmaliciousMiraiBrowse
                                                                            • 109.202.202.202
                                                                            qkbfi86.elfGet hashmaliciousMiraiBrowse
                                                                            • 109.202.202.202
                                                                            .i.elfGet hashmaliciousUnknownBrowse
                                                                            • 109.202.202.202
                                                                            linux_arm64.elfGet hashmaliciousUnknownBrowse
                                                                            • 109.202.202.202
                                                                            .i.elfGet hashmaliciousUnknownBrowse
                                                                            • 109.202.202.202
                                                                            10000.elfGet hashmaliciousBillGatesBrowse
                                                                            • 109.202.202.202
                                                                            boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                                            • 109.202.202.202
                                                                            boatnet.mips.elfGet hashmaliciousMiraiBrowse
                                                                            • 109.202.202.202
                                                                            boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                                            • 109.202.202.202
                                                                            .i.elfGet hashmaliciousUnknownBrowse
                                                                            • 109.202.202.202
                                                                            No context
                                                                            No context
                                                                            No created / dropped files found
                                                                            File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
                                                                            Entropy (8bit):5.589085064936396
                                                                            TrID:
                                                                            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                            File name:zmap.mpsl.elf
                                                                            File size:97'100 bytes
                                                                            MD5:b4458e4fa2efcf88bfa2aaeda864519e
                                                                            SHA1:8263798736379ed4ce23ef75e4d1f606e05c815b
                                                                            SHA256:146ef07d918f77546ba8112e9f307361f9d54af4886dba7fc4ba9e58bc8c5d47
                                                                            SHA512:4aa6068f6e3ed09c6706c37f046cd4081a5c7de3e307860e67ff9fff426a281f33dbb027bbcb36b0fd9df6dccd083308d78f43948009ccdcc3676ed4ff063010
                                                                            SSDEEP:1536:IIdgIHlIodXYtj7eLM/eNLNnCt2ZIzAFy4JZ1BV6I5W/CQ:IIdgIHlIo4mLNCt2ZPFbJrYKQ
                                                                            TLSH:2293C709BF610FB7D85BDC3706A91B05248C695B22B47F3AB534D528B64B24F26E3CB4
                                                                            File Content Preview:.ELF....................`.@.4...Dy......4. ...(...............@...@.Pk..Pk...............p...pE..pE......-..........Q.td...............................<\..'!......'.......................<8..'!... .........9'.. ........................<...'!............H9

                                                                            ELF header

                                                                            Class:ELF32
                                                                            Data:2's complement, little endian
                                                                            Version:1 (current)
                                                                            Machine:MIPS R3000
                                                                            Version Number:0x1
                                                                            Type:EXEC (Executable file)
                                                                            OS/ABI:UNIX - System V
                                                                            ABI Version:0
                                                                            Entry Point Address:0x400260
                                                                            Flags:0x1007
                                                                            ELF Header Size:52
                                                                            Program Header Offset:52
                                                                            Program Header Size:32
                                                                            Number of Program Headers:3
                                                                            Section Header Offset:96580
                                                                            Section Header Size:40
                                                                            Number of Section Headers:13
                                                                            Header String Table Index:12
                                                                            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                            NULL0x00x00x00x00x0000
                                                                            .initPROGBITS0x4000940x940x8c0x00x6AX004
                                                                            .textPROGBITS0x4001200x1200x148000x00x6AX0016
                                                                            .finiPROGBITS0x4149200x149200x5c0x00x6AX004
                                                                            .rodataPROGBITS0x4149800x149800x21d00x00x2A0016
                                                                            .ctorsPROGBITS0x4570000x170000x80x00x3WA004
                                                                            .dtorsPROGBITS0x4570080x170080x80x00x3WA004
                                                                            .dataPROGBITS0x4570200x170200x3e00x00x3WA0016
                                                                            .gotPROGBITS0x4574000x174000x4ec0x40x10000003WAp0016
                                                                            .sbssNOBITS0x4578ec0x178ec0x1c0x00x10000003WAp004
                                                                            .bssNOBITS0x4579100x178ec0x23f80x00x3WA0016
                                                                            .mdebug.abi32PROGBITS0x9a20x178ec0x00x00x0001
                                                                            .shstrtabSTRTAB0x00x178ec0x570x00x0001
                                                                            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                            LOAD0x00x4000000x4000000x16b500x16b505.66450x5R E0x10000.init .text .fini .rodata
                                                                            LOAD0x170000x4570000x4570000x8ec0x2d083.76410x6RW 0x10000.ctors .dtors .data .got .sbss .bss
                                                                            GNU_STACK0x00x00x00x00x00.00000x7RWE0x4
                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                            Nov 2, 2024 13:47:56.210810900 CET3576659962192.168.2.23154.216.16.38
                                                                            Nov 2, 2024 13:47:56.215662956 CET5996235766154.216.16.38192.168.2.23
                                                                            Nov 2, 2024 13:47:56.215760946 CET3576659962192.168.2.23154.216.16.38
                                                                            Nov 2, 2024 13:47:56.218208075 CET3576659962192.168.2.23154.216.16.38
                                                                            Nov 2, 2024 13:47:56.223310947 CET5996235766154.216.16.38192.168.2.23
                                                                            Nov 2, 2024 13:47:56.223356962 CET3576659962192.168.2.23154.216.16.38
                                                                            Nov 2, 2024 13:47:56.228384018 CET5996235766154.216.16.38192.168.2.23
                                                                            Nov 2, 2024 13:47:58.465943098 CET43928443192.168.2.2391.189.91.42
                                                                            Nov 2, 2024 13:48:04.097278118 CET42836443192.168.2.2391.189.91.43
                                                                            Nov 2, 2024 13:48:05.121134996 CET4251680192.168.2.23109.202.202.202
                                                                            Nov 2, 2024 13:48:06.222851992 CET3576659962192.168.2.23154.216.16.38
                                                                            Nov 2, 2024 13:48:06.228662014 CET5996235766154.216.16.38192.168.2.23
                                                                            Nov 2, 2024 13:48:06.491214037 CET5996235766154.216.16.38192.168.2.23
                                                                            Nov 2, 2024 13:48:06.491504908 CET3576659962192.168.2.23154.216.16.38
                                                                            Nov 2, 2024 13:48:19.966959953 CET43928443192.168.2.2391.189.91.42
                                                                            Nov 2, 2024 13:48:30.205621004 CET42836443192.168.2.2391.189.91.43
                                                                            Nov 2, 2024 13:48:36.348649979 CET4251680192.168.2.23109.202.202.202
                                                                            Nov 2, 2024 13:49:00.921238899 CET43928443192.168.2.2391.189.91.42
                                                                            Nov 2, 2024 13:49:06.544358015 CET3576659962192.168.2.23154.216.16.38
                                                                            Nov 2, 2024 13:49:06.549487114 CET5996235766154.216.16.38192.168.2.23
                                                                            Nov 2, 2024 13:49:06.816150904 CET5996235766154.216.16.38192.168.2.23
                                                                            Nov 2, 2024 13:49:06.816234112 CET3576659962192.168.2.23154.216.16.38
                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                            Nov 2, 2024 13:47:56.166773081 CET3372453192.168.2.238.8.8.8
                                                                            Nov 2, 2024 13:47:56.205524921 CET53337248.8.8.8192.168.2.23
                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                            Nov 2, 2024 13:47:56.166773081 CET192.168.2.238.8.8.80x53eaStandard query (0)server.myway-ing.winA (IP address)IN (0x0001)false
                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                            Nov 2, 2024 13:47:56.205524921 CET8.8.8.8192.168.2.230x53eaNo error (0)server.myway-ing.win154.216.16.38A (IP address)IN (0x0001)false

                                                                            System Behavior

                                                                            Start time (UTC):12:47:55
                                                                            Start date (UTC):02/11/2024
                                                                            Path:/tmp/zmap.mpsl.elf
                                                                            Arguments:/tmp/zmap.mpsl.elf
                                                                            File size:5773336 bytes
                                                                            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                                                            Start time (UTC):12:47:55
                                                                            Start date (UTC):02/11/2024
                                                                            Path:/tmp/zmap.mpsl.elf
                                                                            Arguments:-
                                                                            File size:5773336 bytes
                                                                            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

                                                                            Start time (UTC):12:47:55
                                                                            Start date (UTC):02/11/2024
                                                                            Path:/tmp/zmap.mpsl.elf
                                                                            Arguments:-
                                                                            File size:5773336 bytes
                                                                            MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9