Linux Analysis Report
x86.elf

Overview

General Information

Sample name: x86.elf
Analysis ID: 1579324
MD5: a502ac9de4ec361b154701997bb56f9e
SHA1: 239a8b683f3ff2ebd8ca139267adddfa1b6bc294
SHA256: 7a9cc801d7121f2acafe1b3463a106314cb187432cd71974ffbb31ccdf19154a
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai, Moobot
Score: 84
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Moobot
Machine Learning detection for sample
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
Name Description Attribution Blogpost URLs Link
MooBot No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: x86.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: x86.elf Virustotal: Detection: 60% Perma Link
Source: x86.elf ReversingLabs: Detection: 76%
Machine Learning detection for sample
Source: x86.elf Joe Sandbox ML: detected
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:51882 -> 209.141.47.117:1999
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 209.141.47.117
Source: unknown TCP traffic detected without corresponding DNS query: 198.175.75.172
Source: unknown TCP traffic detected without corresponding DNS query: 216.93.31.47
Source: unknown TCP traffic detected without corresponding DNS query: 128.8.77.121
Source: unknown TCP traffic detected without corresponding DNS query: 14.88.221.234
Source: unknown TCP traffic detected without corresponding DNS query: 108.124.196.252
Source: unknown TCP traffic detected without corresponding DNS query: 19.122.91.19
Source: unknown TCP traffic detected without corresponding DNS query: 67.108.27.229
Source: unknown TCP traffic detected without corresponding DNS query: 5.46.91.2
Source: unknown TCP traffic detected without corresponding DNS query: 53.14.67.140
Source: unknown TCP traffic detected without corresponding DNS query: 120.40.56.251
Source: unknown TCP traffic detected without corresponding DNS query: 250.146.26.168
Source: unknown TCP traffic detected without corresponding DNS query: 59.49.206.6
Source: unknown TCP traffic detected without corresponding DNS query: 185.249.98.0
Source: unknown TCP traffic detected without corresponding DNS query: 48.199.192.37
Source: unknown TCP traffic detected without corresponding DNS query: 184.107.179.209
Source: unknown TCP traffic detected without corresponding DNS query: 57.62.74.74
Source: unknown TCP traffic detected without corresponding DNS query: 176.219.16.96
Source: unknown TCP traffic detected without corresponding DNS query: 12.88.164.239
Source: unknown TCP traffic detected without corresponding DNS query: 240.95.78.190
Source: unknown TCP traffic detected without corresponding DNS query: 2.106.129.177
Source: unknown TCP traffic detected without corresponding DNS query: 91.156.66.4
Source: unknown TCP traffic detected without corresponding DNS query: 250.211.92.14
Source: unknown TCP traffic detected without corresponding DNS query: 219.96.228.214
Source: unknown TCP traffic detected without corresponding DNS query: 147.49.63.202
Source: unknown TCP traffic detected without corresponding DNS query: 19.136.234.29
Source: unknown TCP traffic detected without corresponding DNS query: 173.221.147.138
Source: unknown TCP traffic detected without corresponding DNS query: 17.137.140.4
Source: unknown TCP traffic detected without corresponding DNS query: 203.205.252.60
Source: unknown TCP traffic detected without corresponding DNS query: 41.152.185.229
Source: unknown TCP traffic detected without corresponding DNS query: 57.122.63.78
Source: unknown TCP traffic detected without corresponding DNS query: 88.130.209.125
Source: unknown TCP traffic detected without corresponding DNS query: 178.217.32.148
Source: unknown TCP traffic detected without corresponding DNS query: 201.185.183.63
Source: unknown TCP traffic detected without corresponding DNS query: 154.90.63.187
Source: unknown TCP traffic detected without corresponding DNS query: 103.118.23.29
Source: unknown TCP traffic detected without corresponding DNS query: 222.225.40.149
Source: unknown TCP traffic detected without corresponding DNS query: 179.191.228.173
Source: unknown TCP traffic detected without corresponding DNS query: 108.92.246.249
Source: unknown TCP traffic detected without corresponding DNS query: 202.90.244.33
Source: unknown TCP traffic detected without corresponding DNS query: 172.82.24.235
Source: unknown TCP traffic detected without corresponding DNS query: 169.99.140.177
Source: unknown TCP traffic detected without corresponding DNS query: 2.30.79.77
Source: unknown TCP traffic detected without corresponding DNS query: 204.241.15.110
Source: unknown TCP traffic detected without corresponding DNS query: 211.36.246.250
Source: unknown TCP traffic detected without corresponding DNS query: 148.223.154.52
Source: unknown TCP traffic detected without corresponding DNS query: 102.101.212.59
Source: unknown TCP traffic detected without corresponding DNS query: 67.216.157.236
Source: unknown TCP traffic detected without corresponding DNS query: 126.223.109.139
Source: unknown TCP traffic detected without corresponding DNS query: 120.3.133.124
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: x86.elf PID: 6236, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: x86.elf PID: 6236, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: x86.elf PID: 6238, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: x86.elf PID: 6238, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: x86.elf PID: 6241, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: x86.elf PID: 6241, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: x86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: x86.elf PID: 6236, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: x86.elf PID: 6236, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: x86.elf PID: 6238, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: x86.elf PID: 6238, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: x86.elf PID: 6241, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: x86.elf PID: 6241, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal84.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1582/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2033/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2275/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/3088/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/6190/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1612/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1579/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1699/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1335/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1698/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2028/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1334/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1576/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2302/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/3236/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2025/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2146/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/910/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/4445/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/912/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/4446/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/517/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/759/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/4447/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/4448/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2307/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/918/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/6243/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/6242/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1594/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2285/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2281/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1349/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1623/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/761/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1622/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/884/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1983/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2038/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1344/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1465/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1586/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1860/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1463/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2156/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/800/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/801/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/6237/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1629/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1627/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1900/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/6135/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/3021/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/491/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2294/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2050/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1877/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/772/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1633/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/4509/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1599/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1632/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/774/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1477/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/654/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/896/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1476/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1872/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2048/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/655/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1475/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2289/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/656/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/777/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/657/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/658/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/419/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/936/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1639/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1638/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2208/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2180/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/4481/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/4486/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1809/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1494/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1890/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2063/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2062/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1888/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1886/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/420/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1489/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/785/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1642/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/788/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/667/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/789/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/1648/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2078/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2077/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2074/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2195/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/670/cmdline Jump to behavior
Source: /tmp/x86.elf (PID: 6240) File opened: /proc/2746/cmdline Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: x86.elf, type: SAMPLE
Source: Yara match File source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: x86.elf PID: 6236, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: x86.elf PID: 6238, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: x86.elf PID: 6241, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: x86.elf, type: SAMPLE
Source: Yara match File source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: x86.elf, type: SAMPLE
Source: Yara match File source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: x86.elf PID: 6236, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: x86.elf PID: 6238, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: x86.elf PID: 6241, type: MEMORYSTR
Yara detected Moobot
Source: Yara match File source: x86.elf, type: SAMPLE
Source: Yara match File source: 6241.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6236.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
1.147.212.156
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
119.229.24.65
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
243.170.68.170
 unknown Reserved
unknown unknown false
174.156.114.113
 unknown United States
10507 SPCSUS false
185.167.210.127
 unknown Czech Republic
199657 TOUSKOVNETCZ false
92.113.237.42
 unknown Ukraine
6849 UKRTELNETUA false
93.148.204.212
 unknown Italy
30722 VODAFONE-IT-ASNIT false
124.172.173.28
 unknown China
134764 CT-FOSHAN-IDCCHINANETGuangdongprovincenetworkCN false
38.196.44.138
 unknown United States
174 COGENT-174US false
196.253.231.35
 unknown South Africa
8094 PUKNETZA false
65.169.236.15
 unknown United States
1239 SPRINTLINKUS false
247.143.54.110
 unknown Reserved
unknown unknown false
240.5.96.57
 unknown Reserved
unknown unknown false
4.66.38.61
 unknown United States
3356 LEVEL3US false
122.94.61.221
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
206.53.237.35
 unknown United States
62839 FADVUS false
40.135.202.64
 unknown United States
7029 WINDSTREAMUS false
194.230.199.135
 unknown Switzerland
6730 SUNRISECH false
251.131.117.127
 unknown Reserved
unknown unknown false
147.233.212.206
 unknown Israel
378 MACHBA-ASILANIL false
110.12.228.96
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
101.68.105.27
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
68.136.90.218
 unknown United States
23148 TERRENAPUS false
94.35.224.50
 unknown Italy
8612 TISCALI-IT false
183.243.103.47
 unknown China
56048 CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN false
36.242.230.14
 unknown Japan 37903 EMOBILEYmobileCorporationJP false
80.185.114.108
 unknown France
41272 MOSELLE-TELECOM-ASFR false
105.153.195.100
 unknown Morocco
6713 IAM-ASMA false
114.163.252.7
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
124.104.210.229
 unknown Philippines
9299 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH false
93.36.234.160
 unknown Italy
12874 FASTWEBIT false
81.72.64.129
 unknown Italy
3269 ASN-IBSNAZIT false
217.150.26.58
 unknown Russian Federation
20483 EUROCOM141407RussiaRU false
207.104.29.62
 unknown United States
7018 ATT-INTERNET4US false
58.236.85.150
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
9.6.120.5
 unknown United States
3356 LEVEL3US false
246.36.138.248
 unknown Reserved
unknown unknown false
216.26.247.206
 unknown United States
7029 WINDSTREAMUS false
58.245.235.39
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
175.192.154.249
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
200.156.110.221
 unknown Brazil
2715 FundacaoCarlosChagasFilhodeAmparoaPesquisaBR false
139.255.236.155
 unknown Indonesia
9905 LINKNET-ID-APLinknetASNID false
152.193.245.21
 unknown United States
701 UUNETUS false
80.30.7.208
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
202.149.254.164
 unknown China
9811 BJGYsritcorpbeijingCN false
123.149.29.131
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
244.3.138.191
 unknown Reserved
unknown unknown false
43.70.85.134
 unknown Japan 4249 LILLY-ASUS false
119.39.62.130
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
162.220.144.34
 unknown United States
13904 COSLINKUS false
108.11.242.105
 unknown United States
701 UUNETUS false
86.96.59.208
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
164.15.65.248
 unknown Belgium
2611 BELNETBE false
130.27.218.101
 unknown United States
367 DNIC-ASBLK-00306-00371US false
192.201.224.99
 unknown United States
10912 INTERNAP-BLKUS false
158.21.178.113
 unknown United States
32033 EXXONMOBIL-UTEC-ASUS false
4.152.41.207
 unknown United States
3356 LEVEL3US false
114.37.193.164
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
31.124.30.70
 unknown United Kingdom
12576 EELtdGB false
37.98.251.20
 unknown Russian Federation
12668 MIRALOGIC-ASRU false
201.65.24.89
 unknown Brazil
4230 CLAROSABR false
219.185.117.240
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
14.141.238.1
 unknown India
4755 TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP false
162.190.179.8
 unknown United States
21928 T-MOBILE-AS21928US false
48.104.145.237
 unknown United States
2686 ATGS-MMD-ASUS false
80.196.209.219
 unknown Denmark
3292 TDCTDCASDK false
4.42.242.129
 unknown United States
3356 LEVEL3US false
44.90.182.47
 unknown United States
7377 UCSDUS false
202.195.26.39
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
89.210.78.19
 unknown Greece
3329 HOL-GRAthensGreeceGR false
176.28.88.17
 unknown Spain
29680 VOZTELECOMSpainEU false
252.28.48.229
 unknown Reserved
unknown unknown false
212.194.130.148
 unknown France
5410 BOUYGTEL-ISPFR false
217.252.206.57
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
139.190.86.97
 unknown Pakistan
38547 WITRIBE-AS-APWITRIBEPAKISTANLIMITEDPK false
186.137.17.192
 unknown Argentina
10318 TelecomArgentinaSAAR false
191.41.190.237
 unknown Brazil
7738 TelemarNorteLesteSABR false
78.119.45.94
 unknown France
8228 CEGETEL-ASFR false
65.240.210.6
 unknown United States
701 UUNETUS false
188.160.154.163
 unknown Syrian Arab Republic
29256 INT-PDN-STE-ASSTEPDNInternalASSY false
135.234.115.141
 unknown United States
10455 LUCENT-CIOUS false
156.207.57.161
 unknown Egypt
8452 TE-ASTE-ASEG false
27.61.234.151
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
172.152.233.48
 unknown United States
7018 ATT-INTERNET4US false
60.109.253.110
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
185.61.249.211
 unknown Netherlands
204627 CROWDXSNL false
43.21.213.179
 unknown Japan 4249 LILLY-ASUS false
69.42.128.210
 unknown United States
32953 MHCV-AS1US false
251.250.0.92
 unknown Reserved
unknown unknown false
198.84.33.99
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
86.76.92.161
 unknown France
15557 LDCOMNETFR false
71.65.54.116
 unknown United States
10796 TWC-10796-MIDWESTUS false
249.15.127.12
 unknown Reserved
unknown unknown false
142.96.87.201
 unknown Canada
5769 VIDEOTRONCA false
211.223.156.204
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
108.176.28.37
 unknown United States
12271 TWC-12271-NYCUS false
62.86.66.172
 unknown Italy
3269 ASN-IBSNAZIT false
179.18.115.225
 unknown Colombia
22698 AVANTELSASCO false
97.173.110.116
 unknown United States
6167 CELLCO-PARTUS false
183.167.68.199
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false