Edit tour

Linux Analysis Report
most-sh4.elf

Overview

General Information

Sample name:	most-sh4.elf
Analysis ID:	1567765
MD5:	81bb7d7c9e8353398b2ea69e9747d4de
SHA1:	f7568c01ff37ae53122739a704f9d6dd4d5b8fd6
SHA256:	39aabaf3663b2e90f19a123c084443c3f082641ce202fbdde94d006a6395085e
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mirai

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Uses dynamic DNS services

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567765
Start date and time:	2024-12-03 21:06:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	most-sh4.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/510@258/0

Runtime Messages

Command:	/tmp/most-sh4.elf
PID:	5433
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	most
Standard Error:

Process Tree

system is lnxubuntu20

most-sh4.elf (PID: 5433, Parent: 5357, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/most-sh4.elf

most-sh4.elf New Fork (PID: 5435, Parent: 5433)

most-sh4.elf New Fork (PID: 5437, Parent: 5435)

most-sh4.elf New Fork (PID: 5439, Parent: 5437)

xfce4-session New Fork (PID: 5460, Parent: 2984)

xfdesktop (PID: 5460, Parent: 2984, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528

xfce4-session New Fork (PID: 5461, Parent: 2984)

xfdesktop (PID: 5461, Parent: 2984, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528

xfce4-session New Fork (PID: 5462, Parent: 2984)

xfdesktop (PID: 5462, Parent: 2984, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528

xfce4-session New Fork (PID: 5467, Parent: 2984)

xfdesktop (PID: 5467, Parent: 2984, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528

xfce4-session New Fork (PID: 5468, Parent: 2984)

xfdesktop (PID: 5468, Parent: 2984, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
most-sh4.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
most-sh4.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x162c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1634c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1639c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1643c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5439.1.00007f27e8400000.00007f27e8419000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5439.1.00007f27e8400000.00007f27e8419000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x162c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1634c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1639c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1643c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5433.1.00007f27e8400000.00007f27e8419000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5433.1.00007f27e8400000.00007f27e8419000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x162c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x162fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1634c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1639c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x163ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1643c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: most-sh4.elf PID: 5433	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: most-sh4.elf PID: 5433	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x40ea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40fe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4112:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4126:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x413a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x414e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4162:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4176:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x418a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x419e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x41ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4202:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4216:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x422a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x423e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4252:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4266:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x427a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: most-sh4.elf PID: 5439	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: most-sh4.elf PID: 5439	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x7b04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7b90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7ba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7bb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7bcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7be0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7bf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Suricata Signatures

ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T21:06:59.761902+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56828	103.229.52.72	2023	TCP
2024-12-03T21:07:09.369762+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56830	103.229.52.72	2023	TCP
2024-12-03T21:07:18.778756+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56832	103.229.52.72	2023	TCP
2024-12-03T21:07:25.070904+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56834	103.229.52.72	2023	TCP
2024-12-03T21:07:30.447828+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56836	103.229.52.72	2023	TCP
2024-12-03T21:07:36.929807+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56838	103.229.52.72	2023	TCP
2024-12-03T21:07:47.346598+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56840	103.229.52.72	2023	TCP
2024-12-03T21:07:55.986532+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56842	103.229.52.72	2023	TCP
2024-12-03T21:08:03.999404+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56844	103.229.52.72	2023	TCP
2024-12-03T21:08:12.907300+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56846	103.229.52.72	2023	TCP
2024-12-03T21:08:17.972302+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56848	103.229.52.72	2023	TCP
2024-12-03T21:08:25.610629+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56850	103.229.52.72	2023	TCP
2024-12-03T21:08:33.012097+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56852	103.229.52.72	2023	TCP
2024-12-03T21:08:37.895251+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56854	103.229.52.72	2023	TCP
2024-12-03T21:08:46.263421+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56856	103.229.52.72	2023	TCP
2024-12-03T21:08:52.645440+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	56858	103.229.52.72	2023	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: most-sh4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: most-sh4.elf

ReversingLabs: Detection: 63%

Source: most-sh4.elf

String: HTTP/1.1 200 OKmost-armmost-arm5most-arm6most-arm7most-mipsmost-mpslmost-x86_64most-sh4./pkillkillallwgetbusyboxtopcurlrebootpsftptftppgrepgrepxargsawktoybox./dvr_gui./upnp_server./dvr_app/procKh

Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56836 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56832 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56834 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56828 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56838 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56830 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56840 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56844 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56842 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56846 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56848 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56850 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56852 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56854 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56856 -> 103.229.52.72:2023
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:56858 -> 103.229.52.72:2023

Source: global traffic	DNS traffic detected: malformed DNS query: commemay.dns.navy. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: Vet-killer.io.v. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: net-killer.ooguy.com. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: net-killer.cameraddns.net. [malformed]
Source: global traffic	DNS traffic detected: malformed DNS query: netkiller.free-ddns.com. [malformed]

Source: unknown	DNS query: name: net-killer.cameraddns.net
Source: unknown	DNS query: name: net-killer.cameraddns.net. [malformed]

Source: global traffic	DNS traffic detected: DNS query: net-killer.ooguy.com
Source: global traffic	DNS traffic detected: DNS query: commemay.dns.navy. [malformed]
Source: global traffic	DNS traffic detected: DNS query: net-killer.cameraddns.net
Source: global traffic	DNS traffic detected: DNS query: Vet-killer.io.v. [malformed]
Source: global traffic	DNS traffic detected: DNS query: net-killer.ooguy.com. [malformed]
Source: global traffic	DNS traffic detected: DNS query: net-killer.cameraddns.net. [malformed]
Source: global traffic	DNS traffic detected: DNS query: netkiller.free-ddns.com. [malformed]

Source: most-sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5439.1.00007f27e8400000.00007f27e8419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5433.1.00007f27e8400000.00007f27e8419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: most-sh4.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: most-sh4.elf PID: 5439, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: /tmp/most-sh4.elf (PID: 5437)	SIGKILL sent: pid: 914, result: successful	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	SIGKILL sent: pid: 3158, result: successful	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	SIGKILL sent: pid: 5460, result: successful	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	SIGKILL sent: pid: 5462, result: successful	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	SIGKILL sent: pid: 5467, result: successful	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	SIGKILL sent: pid: 5468, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKmost-armmost-arm5most-arm6most-arm7most-mipsmost-mpslmost-x86_64most-sh4./pkillkillallwgetbusyboxtopcurlrebootpsftptftppgrepgrepxargsawktoybox./dvr_gui./upnp_server./dvr_app/procKh

Source: /usr/bin/xfdesktop (PID: 5461)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5462)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5467)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior

Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/5381/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/3633/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/5276/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/most-sh4.elf (PID: 5437)	File opened: /proc/30/cmdline	Jump to behavior

Source: /tmp/most-sh4.elf (PID: 5433)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5461)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5462)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5467)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5468)	Queries kernel information via 'uname':	Jump to behavior

Source: most-sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5439.1.00007f27e8400000.00007f27e8419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5433.1.00007f27e8400000.00007f27e8419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: most-sh4.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: most-sh4.elf PID: 5439, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: most-sh4.elf, 5433.1.0000562611d07000.0000562611d6a000.rw-.sdmp, most-sh4.elf, 5439.1.0000562611d07000.0000562611d6a000.rw-.sdmp	Binary or memory string: &V5!/etc/qemu-binfmt/sh4
Source: most-sh4.elf, 5433.1.00007fff70f92000.00007fff70fb3000.rw-.sdmp, most-sh4.elf, 5439.1.00007fff70f92000.00007fff70fb3000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: most-sh4.elf, 5433.1.00007fff70f92000.00007fff70fb3000.rw-.sdmp, most-sh4.elf, 5439.1.00007fff70f92000.00007fff70fb3000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/most-sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/most-sh4.elf
Source: most-sh4.elf, 5433.1.0000562611d07000.0000562611d6a000.rw-.sdmp, most-sh4.elf, 5439.1.0000562611d07000.0000562611d6a000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source: Yara match	File source: most-sh4.elf, type: SAMPLE
Source: Yara match	File source: 5439.1.00007f27e8400000.00007f27e8419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.00007f27e8400000.00007f27e8419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: most-sh4.elf PID: 5433, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: most-sh4.elf PID: 5439, type: MEMORYSTR

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Source	Detection	Scanner	Label	Link
most-sh4.elf	63%	ReversingLabs	Linux.Trojan.Mirai
most-sh4.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	IP	Active	Malicious	Reputation
net-killer.cameraddns.net	103.229.52.72	true	true	unknown
net-killer.ooguy.com	103.229.52.72	true	true	unknown
commemay.dns.navy. [malformed]	unknown	unknown	true	unknown
netkiller.free-ddns.com. [malformed]	unknown	unknown	true	unknown
net-killer.ooguy.com. [malformed]	unknown	unknown	true	unknown
net-killer.cameraddns.net. [malformed]	unknown	unknown	true	unknown
Vet-killer.io.v. [malformed]	unknown	unknown	true	unknown

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
103.229.52.72	debug.dbg.elf	Get hash	malicious	Mirai	Browse
103.229.52.72	most-m68k.elf	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AIS-AS-APAustralianITSolutionsGroupAU	debug.dbg.elf	Get hash	malicious	Mirai	Browse	103.229.52.72
	most-m68k.elf	Get hash	malicious	Mirai	Browse	103.229.52.72
	lvyr5dba4i	Get hash	malicious	Mirai	Browse	103.229.53.11

Process:	/tmp/most-sh4.elf
File Type:	data
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.725480556997868
Encrypted:	false
SSDEEP:	3:TgmG5n:TgVn
MD5:	68E57377E379DC2C3C039B7C817BFA24
SHA1:	1B47BF1F84E2B6008EC7B3E2F3D0CED9191E9AEA
SHA-256:	C58AD580C1230F6BF57D30DA98A513899A254CA0EA4F75134F6CBE4AB4B96CD5
SHA-512:	4AD5C67D2D64436F20B4B01F450CFFA4980EAAFB44F2E811D0F8E3F1BC4C0EF3132AADB209F95F0606903ACC9CAAE7AAD0A65DC846401691982D35DCA5877165
Malicious:	false
Reputation:	low
Preview:	/tmp/most-sh4.elf.

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.177477381570292
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	most-sh4.elf
File size:	121'440 bytes
MD5:	81bb7d7c9e8353398b2ea69e9747d4de
SHA1:	f7568c01ff37ae53122739a704f9d6dd4d5b8fd6
SHA256:	39aabaf3663b2e90f19a123c084443c3f082641ce202fbdde94d006a6395085e
SHA512:	3be9ca12e197b9f054e1ecc34fc2a25830caa9ebe4956c39c7a1cb70b590c2213fd7d90f82d2a3a5ac51ef19e41a7d1a8d08ee65b676407d511b0eb5deb1a1bd
SSDEEP:	1536:samgAGMAOOPlwvSLfxM+WrC7KA31imQTs7pkuWy6DNvD6z8Y5:sIAsPlwunWrfAqTsauWHDNvk8Y5
TLSH:	35C36B73C826AF58C155D0B8B0B08FB92F53A69182872FBA15B7C2B48447DCDF505BB8
File Content Preview:	.ELF.....................@.4...........4. ...(...............@...@...........................B...B.dH..............Q.td............................././"O.n........#.@........#.*@.`...o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	121000
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x160e0	0x0	0x6	AX	32
.fini	PROGBITS	0x4161c0	0x161c0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x4161e4	0x161e4	0x2734	0x0	0x2	A	4
.ctors	PROGBITS	0x429000	0x19000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x42900c	0x1900c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x429020	0x19020	0x4830	0x0	0x3	WA	32
.got	PROGBITS	0x42d850	0x1d850	0x14	0x4	0x3	WA	4
.bss	NOBITS	0x42d864	0x1d864	0x4574	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1d864	0x43	0x0	0x0		1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report most-sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0CnETj (deleted)

/tmp/qemu-open.0MOydi (deleted)

/tmp/qemu-open.0QWZZl (deleted)

/tmp/qemu-open.0ZQHXi (deleted)

/tmp/qemu-open.0eZowi (deleted)

/tmp/qemu-open.0ffkSl (deleted)

/tmp/qemu-open.0iSxWk (deleted)

/tmp/qemu-open.0nvCil (deleted)

/tmp/qemu-open.0paggi (deleted)

/tmp/qemu-open.0wIkbl (deleted)

/tmp/qemu-open.12HiLj (deleted)

/tmp/qemu-open.1D13Ql (deleted)

/tmp/qemu-open.1M3Fnk (deleted)

/tmp/qemu-open.1OzCti (deleted)

/tmp/qemu-open.26V1Fi (deleted)

/tmp/qemu-open.2Vhpfk (deleted)

/tmp/qemu-open.2Yxzkl (deleted)

/tmp/qemu-open.2b8CNk (deleted)

/tmp/qemu-open.2foKPh (deleted)

/tmp/qemu-open.2h6nNk (deleted)

/tmp/qemu-open.2lKJVh (deleted)

/tmp/qemu-open.31tnsi (deleted)

/tmp/qemu-open.3akcBi (deleted)

/tmp/qemu-open.3kyOii (deleted)

/tmp/qemu-open.3mCwui (deleted)

/tmp/qemu-open.3sC2Qk (deleted)

/tmp/qemu-open.3uG8kl (deleted)

/tmp/qemu-open.45j63k (deleted)

Linux Analysis Report
most-sh4.elf

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x18918	0x18918	6.9025	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x19000	0x429000	0x429000	0x4864	0x8dd8	0.3279	0x6	RW	0x10000	.ctors .dtors .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 21:06:59.637844086 CET	56828	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:06:59.757966995 CET	2023	56828	103.229.52.72	192.168.2.13
Dec 3, 2024 21:06:59.758033037 CET	56828	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:06:59.761902094 CET	56828	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:06:59.878664017 CET	2023	56828	103.229.52.72	192.168.2.13
Dec 3, 2024 21:06:59.878910065 CET	56828	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:06:59.882045984 CET	2023	56828	103.229.52.72	192.168.2.13
Dec 3, 2024 21:06:59.999281883 CET	2023	56828	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:09.247570992 CET	56830	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:09.368400097 CET	2023	56830	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:09.368475914 CET	56830	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:09.369761944 CET	56830	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:09.489298105 CET	2023	56830	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:09.489362955 CET	56830	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:09.490104914 CET	2023	56830	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:09.609296083 CET	2023	56830	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:18.657999039 CET	56832	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:18.777903080 CET	2023	56832	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:18.777966976 CET	56832	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:18.778755903 CET	56832	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:18.898379087 CET	2023	56832	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:18.898442030 CET	56832	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:18.898799896 CET	2023	56832	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:19.018377066 CET	2023	56832	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:24.950145960 CET	56834	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:25.070261002 CET	2023	56834	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:25.070326090 CET	56834	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:25.070904016 CET	56834	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:25.190537930 CET	2023	56834	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:25.190622091 CET	56834	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:25.190757990 CET	2023	56834	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:25.311161995 CET	2023	56834	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:30.327100039 CET	56836	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:30.447153091 CET	2023	56836	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:30.447218895 CET	56836	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:30.447828054 CET	56836	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:30.567569017 CET	2023	56836	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:30.567661047 CET	56836	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:30.567706108 CET	2023	56836	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:30.687642097 CET	2023	56836	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:36.809093952 CET	56838	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:36.929076910 CET	2023	56838	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:36.929138899 CET	56838	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:36.929806948 CET	56838	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:37.049761057 CET	2023	56838	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:37.049849033 CET	56838	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:37.050107002 CET	2023	56838	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:37.169809103 CET	2023	56838	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:47.225604057 CET	56840	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:47.345887899 CET	2023	56840	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:47.345948935 CET	56840	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:47.346597910 CET	56840	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:47.466092110 CET	2023	56840	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:47.466195107 CET	56840	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:47.466480970 CET	2023	56840	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:47.586169958 CET	2023	56840	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:55.865042925 CET	56842	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:55.985470057 CET	2023	56842	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:55.985615969 CET	56842	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:55.986531973 CET	56842	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:56.105948925 CET	2023	56842	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:56.106051922 CET	56842	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:07:56.106750965 CET	2023	56842	103.229.52.72	192.168.2.13
Dec 3, 2024 21:07:56.226049900 CET	2023	56842	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:03.877764940 CET	56844	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:03.998620987 CET	2023	56844	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:03.998717070 CET	56844	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:03.999403954 CET	56844	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:04.119040012 CET	2023	56844	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:04.119128942 CET	56844	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:04.119283915 CET	2023	56844	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:04.239064932 CET	2023	56844	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:12.786456108 CET	56846	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:12.906503916 CET	2023	56846	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:12.906568050 CET	56846	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:12.907299995 CET	56846	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:13.026679993 CET	2023	56846	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:13.026779890 CET	56846	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:13.027182102 CET	2023	56846	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:13.146871090 CET	2023	56846	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:17.851290941 CET	56848	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:17.971534967 CET	2023	56848	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:17.971610069 CET	56848	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:17.972301960 CET	56848	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:18.091952085 CET	2023	56848	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:18.092120886 CET	56848	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:18.092152119 CET	2023	56848	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:18.212968111 CET	2023	56848	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:25.489979982 CET	56850	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:25.609925985 CET	2023	56850	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:25.609986067 CET	56850	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:25.610629082 CET	56850	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:25.730909109 CET	2023	56850	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:25.731014013 CET	56850	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:25.731214046 CET	2023	56850	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:25.853331089 CET	2023	56850	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:32.890830040 CET	56852	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:33.011285067 CET	2023	56852	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:33.011353970 CET	56852	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:33.012096882 CET	56852	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:33.131758928 CET	2023	56852	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:33.131833076 CET	56852	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:33.131989956 CET	2023	56852	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:33.251959085 CET	2023	56852	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:37.774434090 CET	56854	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:37.894541979 CET	2023	56854	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:37.894632101 CET	56854	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:37.895251036 CET	56854	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:38.014945984 CET	2023	56854	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:38.015033007 CET	56854	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:38.015131950 CET	2023	56854	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:38.135715961 CET	2023	56854	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:46.142483950 CET	56856	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:46.262778997 CET	2023	56856	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:46.262828112 CET	56856	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:46.263421059 CET	56856	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:46.383028984 CET	2023	56856	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:46.383097887 CET	56856	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:46.383358955 CET	2023	56856	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:46.503247023 CET	2023	56856	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:52.524796963 CET	56858	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:52.644767046 CET	2023	56858	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:52.644846916 CET	56858	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:52.645440102 CET	56858	2023	192.168.2.13	103.229.52.72
Dec 3, 2024 21:08:52.765633106 CET	2023	56858	103.229.52.72	192.168.2.13
Dec 3, 2024 21:08:52.766144037 CET	2023	56858	103.229.52.72	192.168.2.13

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 21:06:59.636960983 CET	8.8.8.8	192.168.2.13	0xed67	No error (0)	net-killer.ooguy.com	103.229.52.72	A (IP address)	IN (0x0001)	false
Dec 3, 2024 21:07:09.246953964 CET	8.8.8.8	192.168.2.13	0xb38a	No error (0)	net-killer.cameraddns.net	103.229.52.72	A (IP address)	IN (0x0001)	false
Dec 3, 2024 21:07:24.949737072 CET	8.8.8.8	192.168.2.13	0xd344	No error (0)	net-killer.cameraddns.net	103.229.52.72	A (IP address)	IN (0x0001)	false
Dec 3, 2024 21:07:30.326705933 CET	8.8.8.8	192.168.2.13	0x53fb	No error (0)	net-killer.cameraddns.net	103.229.52.72	A (IP address)	IN (0x0001)	false
Dec 3, 2024 21:07:55.864255905 CET	8.8.8.8	192.168.2.13	0x45ac	No error (0)	net-killer.cameraddns.net	103.229.52.72	A (IP address)	IN (0x0001)	false
Dec 3, 2024 21:08:03.877183914 CET	8.8.8.8	192.168.2.13	0xcc2	No error (0)	net-killer.cameraddns.net	103.229.52.72	A (IP address)	IN (0x0001)	false
Dec 3, 2024 21:08:12.786003113 CET	8.8.8.8	192.168.2.13	0x3eca	No error (0)	net-killer.cameraddns.net	103.229.52.72	A (IP address)	IN (0x0001)	false
Dec 3, 2024 21:08:17.850817919 CET	8.8.8.8	192.168.2.13	0x4e30	No error (0)	net-killer.cameraddns.net	103.229.52.72	A (IP address)	IN (0x0001)	false
Dec 3, 2024 21:08:25.489582062 CET	8.8.8.8	192.168.2.13	0xb6ed	No error (0)	net-killer.cameraddns.net	103.229.52.72	A (IP address)	IN (0x0001)	false
Dec 3, 2024 21:08:37.774065018 CET	8.8.8.8	192.168.2.13	0x5f8	No error (0)	net-killer.cameraddns.net	103.229.52.72	A (IP address)	IN (0x0001)	false

Start time (UTC):	20:06:57
Start date (UTC):	03/12/2024
Path:	/tmp/most-sh4.elf
Arguments:	/tmp/most-sh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	20:06:58
Start date (UTC):	03/12/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	20:07:00
Start date (UTC):	03/12/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	20:07:02
Start date (UTC):	03/12/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	20:07:03
Start date (UTC):	03/12/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre