Edit tour

Linux Analysis Report
zmap.x86.elf

Overview

General Information

Sample name:	zmap.x86.elf
Analysis ID:	1547455
MD5:	8edb75406d233f4201e85fd2d746c114
SHA1:	79272fc7bf16c8f354efa0b4b59bcdf0f929fa0a
SHA256:	e1f60f41d27140942ad74ef1f1bae26fc98787fed03c91d3c4a33e5390b6d3be
Tags:	elfuser-abuse_ch
Infos:

Detection

Okiru

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Okiru

Machine Learning detection for sample

Sample deletes itself

Detected TCP or UDP traffic on non-standard ports

Sample has stripped symbol table

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1547455
Start date and time:	2024-11-02 15:12:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	zmap.x86.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/0@19/0

Warnings

VT rate limit hit for: zmap.x86.elf

Runtime Messages

Command:	/tmp/zmap.x86.elf
PID:	5489
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VagneRHere
Standard Error:

Process Tree

system is lnxubuntu20

zmap.x86.elf (PID: 5489, Parent: 5416, MD5: 8edb75406d233f4201e85fd2d746c114) Arguments: /tmp/zmap.x86.elf

zmap.x86.elf New Fork (PID: 5490, Parent: 5489)

zmap.x86.elf New Fork (PID: 5491, Parent: 5490)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
zmap.x86.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
zmap.x86.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0xb20:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
zmap.x86.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x84e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
zmap.x86.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xb670:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
zmap.x86.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x9f91:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
zmap.x86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x84b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5491.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5491.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0xb20:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5491.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x84e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5491.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xb670:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5491.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x9f91:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5491.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x84b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
5489.1.0000000008048000.0000000008057000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5489.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0xb20:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
5489.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x84e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
5489.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xb670:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5489.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x9f91:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
5489.1.0000000008048000.0000000008057000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x84b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: zmap.x86.elf PID: 5489	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: zmap.x86.elf PID: 5491	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Click to see the 9 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: zmap.x86.elf

ReversingLabs: Detection: 60%

Machine Learning detection for sample

Source: zmap.x86.elf

Joe Sandbox ML: detected

Source: global traffic

TCP traffic: 192.168.2.14:47358 -> 154.216.16.38:59962

Source: global traffic

DNS traffic detected: DNS query: server.myway-ing.win

System Summary

Malicious sample detected (through community Yara rule)

Source: zmap.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: zmap.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: zmap.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: zmap.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: zmap.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5491.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5491.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5491.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5491.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5491.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5489.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5489.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5489.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5489.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5489.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Source: ELF static info symbol of initial sample

.symtab present: no

Source: zmap.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: zmap.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: zmap.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: zmap.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: zmap.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5491.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5491.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5491.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5491.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5489.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5489.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5489.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5489.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal72.troj.evad.linELF@0/0@19/0

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/zmap.x86.elf (PID: 5489)

File: /tmp/zmap.x86.elf

Jump to behavior

Stealing of Sensitive Information

Yara detected Okiru

Source: Yara match	File source: zmap.x86.elf, type: SAMPLE
Source: Yara match	File source: 5491.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zmap.x86.elf PID: 5489, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zmap.x86.elf PID: 5491, type: MEMORYSTR

Remote Access Functionality

Yara detected Okiru

Source: Yara match	File source: zmap.x86.elf, type: SAMPLE
Source: Yara match	File source: 5491.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zmap.x86.elf PID: 5489, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zmap.x86.elf PID: 5491, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
zmap.x86.elf	61%	ReversingLabs	Linux.Trojan.LnxMirai
zmap.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
server.myway-ing.win	154.216.16.38	true	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.216.16.38	server.myway-ing.win	Seychelles		135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
154.216.16.38	zmap.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	debug.dbg.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.mips.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.arm.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.spc.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
server.myway-ing.win	zmap.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.16.38

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	zmap.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.16.38
	qkehusl.elf	Get hash	malicious	Mirai	Browse	154.216.19.76
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	154.216.19.76
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	154.216.19.76
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	154.216.19.76
	vsbeps.elf	Get hash	malicious	Mirai	Browse	154.216.19.76
	qkbfi86.elf	Get hash	malicious	Mirai	Browse	154.216.19.76
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	154.216.19.64
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	154.216.19.64
	boatnet.ppc.elf	Get hash	malicious	Unknown	Browse	154.216.19.64

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.522977840229838
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	zmap.x86.elf
File size:	62'640 bytes
MD5:	8edb75406d233f4201e85fd2d746c114
SHA1:	79272fc7bf16c8f354efa0b4b59bcdf0f929fa0a
SHA256:	e1f60f41d27140942ad74ef1f1bae26fc98787fed03c91d3c4a33e5390b6d3be
SHA512:	df424a671363b4a9d6480a3210e9b135dfbce80bb9e8af7f2b931c5ba51deb8256d54b505dd418091f03c4139ccec955cc00cfeb1456e791c37d7abb5a1253c5
SSDEEP:	1536:1BGfyT5OGMMt4cesUTeFIv5TzHhWKg80CIjOepn2Z:1caT5OGMMtmaATzBWKp07Kan0
TLSH:	74534AC4E583DCFAEC5605705173EB368B77F13B1268DA87C7A89923F852B02E54629C
File Content Preview:	.ELF....................d...4... .......4. ...(..............................................p...p.......*..........Q.td............................U..S.......w....h........[]...$.............U......=.r...t..5....$p.....$p......u........t....h.o..........

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	62240
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xd106	0x0	0x6	AX	16
.fini	PROGBITS	0x80551b6	0xd1b6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x80551e0	0xd1e0	0x1e1c	0x0	0x2	A	32
.ctors	PROGBITS	0x8057000	0xf000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x8057008	0xf008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8057020	0xf020	0x2c0	0x0	0x3	WA	32
.bss	NOBITS	0x80572e0	0xf2e0	0x27c0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0xf2e0	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xeffc	0xeffc	6.5569	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0xf000	0x8057000	0x8057000	0x2e0	0x2aa0	3.7358	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 2, 2024 15:12:59.054897070 CET	47358	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:12:59.059752941 CET	59962	47358	154.216.16.38	192.168.2.14
Nov 2, 2024 15:12:59.059825897 CET	47358	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:12:59.059840918 CET	47358	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:12:59.064774036 CET	59962	47358	154.216.16.38	192.168.2.14
Nov 2, 2024 15:12:59.064837933 CET	47358	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:12:59.069681883 CET	59962	47358	154.216.16.38	192.168.2.14
Nov 2, 2024 15:12:59.948862076 CET	59962	47358	154.216.16.38	192.168.2.14
Nov 2, 2024 15:12:59.948971033 CET	47358	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:12:59.949121952 CET	47358	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:12:59.956326008 CET	47360	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:12:59.962156057 CET	59962	47360	154.216.16.38	192.168.2.14
Nov 2, 2024 15:12:59.962214947 CET	47360	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:12:59.962232113 CET	47360	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:12:59.967447042 CET	59962	47360	154.216.16.38	192.168.2.14
Nov 2, 2024 15:12:59.967489004 CET	47360	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:12:59.972462893 CET	59962	47360	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:00.860641003 CET	59962	47360	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:00.860799074 CET	47360	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:00.860886097 CET	47360	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:00.868096113 CET	47362	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:00.873017073 CET	59962	47362	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:00.873064995 CET	47362	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:00.873079062 CET	47362	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:00.877919912 CET	59962	47362	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:00.877958059 CET	47362	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:00.882895947 CET	59962	47362	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:01.773111105 CET	59962	47362	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:01.773235083 CET	47362	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:01.773272038 CET	47362	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:01.780802011 CET	47364	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:01.785721064 CET	59962	47364	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:01.785808086 CET	47364	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:01.785824060 CET	47364	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:01.790739059 CET	59962	47364	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:01.790790081 CET	47364	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:01.795732021 CET	59962	47364	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:02.667843103 CET	59962	47364	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:02.668031931 CET	47364	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:02.668158054 CET	47364	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:02.719225883 CET	47366	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:02.724427938 CET	59962	47366	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:02.724478960 CET	47366	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:02.724499941 CET	47366	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:02.729494095 CET	59962	47366	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:02.729537964 CET	47366	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:02.734344006 CET	59962	47366	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:03.615190983 CET	59962	47366	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:03.615426064 CET	47366	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:03.615453959 CET	47366	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:03.622709036 CET	47368	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:03.627607107 CET	59962	47368	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:03.627682924 CET	47368	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:03.627760887 CET	47368	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:03.632555008 CET	59962	47368	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:03.632601023 CET	47368	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:03.637507915 CET	59962	47368	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:04.508093119 CET	59962	47368	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:04.508203983 CET	47368	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:04.508279085 CET	47368	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:04.515588999 CET	47370	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:04.520442009 CET	59962	47370	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:04.520514965 CET	47370	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:04.520591974 CET	47370	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:04.525461912 CET	59962	47370	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:04.525521994 CET	47370	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:04.530340910 CET	59962	47370	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:05.415667057 CET	59962	47370	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:05.415812016 CET	47370	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:05.415880919 CET	47370	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:05.426841021 CET	47372	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:05.434706926 CET	59962	47372	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:05.434793949 CET	47372	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:05.434858084 CET	47372	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:05.442943096 CET	59962	47372	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:05.442996979 CET	47372	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:05.448910952 CET	59962	47372	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:06.375041008 CET	59962	47372	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:06.375143051 CET	47372	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:06.375181913 CET	47372	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:06.389513016 CET	47374	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:06.394395113 CET	59962	47374	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:06.394572020 CET	47374	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:06.394572020 CET	47374	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:06.399535894 CET	59962	47374	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:06.399602890 CET	47374	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:06.404515028 CET	59962	47374	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:07.277285099 CET	59962	47374	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:07.277431965 CET	47374	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:07.277479887 CET	47374	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:07.285316944 CET	47376	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:07.290291071 CET	59962	47376	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:07.290368080 CET	47376	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:07.290452003 CET	47376	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:07.295320988 CET	59962	47376	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:07.295382977 CET	47376	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:07.300362110 CET	59962	47376	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:08.200709105 CET	59962	47376	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:08.200850964 CET	47376	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:08.200876951 CET	47376	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:08.208029032 CET	47378	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:08.213965893 CET	59962	47378	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:08.214083910 CET	47378	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:08.214135885 CET	47378	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:08.222414970 CET	59962	47378	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:08.222480059 CET	47378	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:08.227731943 CET	59962	47378	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:09.140635014 CET	59962	47378	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:09.140707970 CET	47378	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:09.140770912 CET	47378	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:09.148343086 CET	47380	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:09.153430939 CET	59962	47380	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:09.153503895 CET	47380	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:09.153553009 CET	47380	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:09.158886909 CET	59962	47380	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:09.158951998 CET	47380	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:09.164123058 CET	59962	47380	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:10.033519983 CET	59962	47380	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:10.033678055 CET	47380	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:10.033725023 CET	47380	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:10.041162014 CET	47382	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:10.046061993 CET	59962	47382	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:10.046199083 CET	47382	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:10.046247005 CET	47382	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:10.051129103 CET	59962	47382	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:10.051192999 CET	47382	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:10.056236029 CET	59962	47382	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:10.934580088 CET	59962	47382	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:10.934993029 CET	47382	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:10.934993029 CET	47382	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:10.947063923 CET	47384	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:10.955117941 CET	59962	47384	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:10.955185890 CET	47384	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:10.955260038 CET	47384	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:10.960344076 CET	59962	47384	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:10.960422993 CET	47384	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:10.966312885 CET	59962	47384	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:11.843719006 CET	59962	47384	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:11.843944073 CET	47384	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:11.843944073 CET	47384	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:11.851605892 CET	47386	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:11.856399059 CET	59962	47386	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:11.856498003 CET	47386	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:11.856514931 CET	47386	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:11.861517906 CET	59962	47386	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:11.861573935 CET	47386	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:11.866449118 CET	59962	47386	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:12.749929905 CET	59962	47386	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:12.749948025 CET	59962	47386	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:12.750318050 CET	47386	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:12.750318050 CET	47386	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:12.757380009 CET	47388	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:12.762676001 CET	59962	47388	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:12.762739897 CET	47388	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:12.762770891 CET	47388	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:12.767896891 CET	59962	47388	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:12.767937899 CET	47388	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:12.772799015 CET	59962	47388	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:13.653168917 CET	59962	47388	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:13.653368950 CET	47388	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:13.653368950 CET	47388	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:13.653474092 CET	59962	47388	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:13.653578043 CET	47388	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:13.661115885 CET	47390	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:13.666645050 CET	59962	47390	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:13.666790009 CET	47390	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:13.666843891 CET	47390	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:13.673151016 CET	59962	47390	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:13.673209906 CET	47390	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:13.677998066 CET	59962	47390	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:14.550237894 CET	59962	47390	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:14.550534964 CET	47390	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:14.550705910 CET	47390	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:14.557944059 CET	47392	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:14.562969923 CET	59962	47392	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:14.563064098 CET	47392	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:14.563113928 CET	47392	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:14.567950010 CET	59962	47392	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:14.568032980 CET	47392	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:14.572969913 CET	59962	47392	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:15.442326069 CET	59962	47392	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:15.442643881 CET	47392	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:15.442698002 CET	47392	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:15.450140953 CET	47394	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:15.455018997 CET	59962	47394	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:15.455110073 CET	47394	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:15.455153942 CET	47394	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:15.459995985 CET	59962	47394	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:15.460053921 CET	47394	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:15.465123892 CET	59962	47394	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:25.464972019 CET	47394	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:13:25.470295906 CET	59962	47394	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:25.736279011 CET	59962	47394	154.216.16.38	192.168.2.14
Nov 2, 2024 15:13:25.736377001 CET	47394	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:14:25.742095947 CET	47394	59962	192.168.2.14	154.216.16.38
Nov 2, 2024 15:14:25.747047901 CET	59962	47394	154.216.16.38	192.168.2.14
Nov 2, 2024 15:14:26.195364952 CET	59962	47394	154.216.16.38	192.168.2.14
Nov 2, 2024 15:14:26.195631981 CET	47394	59962	192.168.2.14	154.216.16.38

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 2, 2024 15:12:59.013602018 CET	59117	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:12:59.054795980 CET	53	59117	8.8.8.8	192.168.2.14
Nov 2, 2024 15:12:59.949171066 CET	46388	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:12:59.956254005 CET	53	46388	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:00.860937119 CET	54298	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:00.868033886 CET	53	54298	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:01.773298979 CET	43702	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:01.780714035 CET	53	43702	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:02.668210983 CET	56433	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:02.719038010 CET	53	56433	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:03.615487099 CET	51328	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:03.622622013 CET	53	51328	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:04.508389950 CET	43637	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:04.515470028 CET	53	43637	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:05.415982962 CET	49519	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:05.426729918 CET	53	49519	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:06.375242949 CET	40568	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:06.389436960 CET	53	40568	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:07.277546883 CET	37488	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:07.285197973 CET	53	37488	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:08.200917959 CET	60526	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:08.207904100 CET	53	60526	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:09.140877008 CET	38183	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:09.148232937 CET	53	38183	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:10.033829927 CET	48230	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:10.041053057 CET	53	48230	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:10.935007095 CET	34754	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:10.946819067 CET	53	34754	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:11.843940020 CET	56926	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:11.851538897 CET	53	56926	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:12.750313997 CET	56998	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:12.757296085 CET	53	56998	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:13.653368950 CET	42206	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:13.660958052 CET	53	42206	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:14.550791025 CET	58478	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:14.557811022 CET	53	58478	8.8.8.8	192.168.2.14
Nov 2, 2024 15:13:15.442811012 CET	34041	53	192.168.2.14	8.8.8.8
Nov 2, 2024 15:13:15.450025082 CET	53	34041	8.8.8.8	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 2, 2024 15:12:59.013602018 CET	192.168.2.14	8.8.8.8	0x4135	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:12:59.949171066 CET	192.168.2.14	8.8.8.8	0x5149	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:00.860937119 CET	192.168.2.14	8.8.8.8	0x6ab4	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:01.773298979 CET	192.168.2.14	8.8.8.8	0xa4bb	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:02.668210983 CET	192.168.2.14	8.8.8.8	0xd90a	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:03.615487099 CET	192.168.2.14	8.8.8.8	0xaa38	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:04.508389950 CET	192.168.2.14	8.8.8.8	0xc556	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:05.415982962 CET	192.168.2.14	8.8.8.8	0x955b	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:06.375242949 CET	192.168.2.14	8.8.8.8	0x5b77	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:07.277546883 CET	192.168.2.14	8.8.8.8	0xff6c	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:08.200917959 CET	192.168.2.14	8.8.8.8	0x74f8	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:09.140877008 CET	192.168.2.14	8.8.8.8	0x7e77	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:10.033829927 CET	192.168.2.14	8.8.8.8	0x8ba8	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:10.935007095 CET	192.168.2.14	8.8.8.8	0x4119	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:11.843940020 CET	192.168.2.14	8.8.8.8	0x8be6	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:12.750313997 CET	192.168.2.14	8.8.8.8	0x9418	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:13.653368950 CET	192.168.2.14	8.8.8.8	0xfd58	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:14.550791025 CET	192.168.2.14	8.8.8.8	0xa91f	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:15.442811012 CET	192.168.2.14	8.8.8.8	0x33f8	Standard query (0)	server.myway-ing.win	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 2, 2024 15:12:59.054795980 CET	8.8.8.8	192.168.2.14	0x4135	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:12:59.956254005 CET	8.8.8.8	192.168.2.14	0x5149	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:00.868033886 CET	8.8.8.8	192.168.2.14	0x6ab4	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:01.780714035 CET	8.8.8.8	192.168.2.14	0xa4bb	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:02.719038010 CET	8.8.8.8	192.168.2.14	0xd90a	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:03.622622013 CET	8.8.8.8	192.168.2.14	0xaa38	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:04.515470028 CET	8.8.8.8	192.168.2.14	0xc556	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:05.426729918 CET	8.8.8.8	192.168.2.14	0x955b	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:06.389436960 CET	8.8.8.8	192.168.2.14	0x5b77	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:07.285197973 CET	8.8.8.8	192.168.2.14	0xff6c	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:08.207904100 CET	8.8.8.8	192.168.2.14	0x74f8	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:09.148232937 CET	8.8.8.8	192.168.2.14	0x7e77	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:10.041053057 CET	8.8.8.8	192.168.2.14	0x8ba8	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:10.946819067 CET	8.8.8.8	192.168.2.14	0x4119	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:11.851538897 CET	8.8.8.8	192.168.2.14	0x8be6	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:12.757296085 CET	8.8.8.8	192.168.2.14	0x9418	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:13.660958052 CET	8.8.8.8	192.168.2.14	0xfd58	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:14.557811022 CET	8.8.8.8	192.168.2.14	0xa91f	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false
Nov 2, 2024 15:13:15.450025082 CET	8.8.8.8	192.168.2.14	0x33f8	No error (0)	server.myway-ing.win	154.216.16.38	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: zmap.x86.elf PID: 5489, Parent PID: 5416

General

Start time (UTC):	14:12:58
Start date (UTC):	02/11/2024
Path:	/tmp/zmap.x86.elf
Arguments:	/tmp/zmap.x86.elf
File size:	62640 bytes
MD5 hash:	8edb75406d233f4201e85fd2d746c114

Chronological Activities

Analysis Process: zmap.x86.elf PID: 5490, Parent PID: 5489

General

Start time (UTC):	14:12:58
Start date (UTC):	02/11/2024
Path:	/tmp/zmap.x86.elf
Arguments:	-
File size:	62640 bytes
MD5 hash:	8edb75406d233f4201e85fd2d746c114

Chronological Activities

Analysis Process: zmap.x86.elf PID: 5491, Parent PID: 5490

General

Start time (UTC):	14:12:58
Start date (UTC):	02/11/2024
Path:	/tmp/zmap.x86.elf
Arguments:	-
File size:	62640 bytes
MD5 hash:	8edb75406d233f4201e85fd2d746c114

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report zmap.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: zmap.x86.elf PID: 5489, Parent PID: 5416

General

Chronological Activities

Analysis Process: zmap.x86.elf PID: 5490, Parent PID: 5489

General

Chronological Activities

Analysis Process: zmap.x86.elf PID: 5491, Parent PID: 5490

General

Chronological Activities

Linux Analysis Report
zmap.x86.elf