Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
bot.x86.elf

Overview

General Information

Sample name:bot.x86.elf
Analysis ID:1579535
MD5:3383ee8d13eb2229da66dabdd097cbdb
SHA1:9930815fbd977d6e7831d669151226f9a452d03b
SHA256:4ffd080e157ddf698118da393e3fb76b8e819a6e21c150122c279ea4b6555d3c
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score:100
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Detected Mirai
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Mirai
Yara detected Okiru
Connects to many ports of the same IP (likely port scanning)
Machine Learning detection for sample
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Yara signature match

Classification

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1579535
Start date and time:2024-12-22 22:57:04 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 32s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:bot.x86.elf
Detection:MAL
Classification:mal100.troj.linELF@0/0@1/0
Command:/tmp/bot.x86.elf
PID:6238
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
done.
Standard Error:
  • system is lnxubuntu20
  • bot.x86.elf (PID: 6238, Parent: 6162, MD5: 3383ee8d13eb2229da66dabdd097cbdb) Arguments: /tmp/bot.x86.elf
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
bot.x86.elfJoeSecurity_OkiruYara detected OkiruJoe Security
    bot.x86.elfJoeSecurity_Mirai_3Yara detected MiraiJoe Security
      bot.x86.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        bot.x86.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0x10704:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x10718:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x1072c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x10740:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x10754:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x10768:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x1077c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x10790:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x107a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x107b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x107cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x107e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x107f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x10808:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x1081c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x10830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x10844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x10858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x1086c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x10880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x10894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        bot.x86.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
        • 0x105e4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
        Click to see the 7 entries
        SourceRuleDescriptionAuthorStrings
        6238.1.0000000008048000.000000000805b000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
          6238.1.0000000008048000.000000000805b000.r-x.sdmpJoeSecurity_Mirai_3Yara detected MiraiJoe Security
            6238.1.0000000008048000.000000000805b000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
              6238.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
              • 0x10704:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x10718:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x1072c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x10740:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x10754:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x10768:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x1077c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x10790:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x107a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x107b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x107cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x107e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x107f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x10808:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x1081c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x10830:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x10844:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x10858:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x1086c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x10880:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              • 0x10894:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
              6238.1.0000000008048000.000000000805b000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
              • 0x105e4:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
              Click to see the 12 entries
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2024-12-22T22:57:53.348994+010020304901Malware Command and Control Activity Detected192.168.2.233308087.120.112.23447925TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2024-12-22T22:57:54.512239+010020304891Malware Command and Control Activity Detected87.120.112.23447925192.168.2.2333080TCP
              2024-12-22T22:58:13.255094+010020304891Malware Command and Control Activity Detected87.120.112.23447925192.168.2.2333080TCP
              2024-12-22T22:58:33.260242+010020304891Malware Command and Control Activity Detected87.120.112.23447925192.168.2.2333080TCP
              2024-12-22T22:58:53.265431+010020304891Malware Command and Control Activity Detected87.120.112.23447925192.168.2.2333080TCP
              2024-12-22T22:59:13.270817+010020304891Malware Command and Control Activity Detected87.120.112.23447925192.168.2.2333080TCP
              2024-12-22T22:59:33.276516+010020304891Malware Command and Control Activity Detected87.120.112.23447925192.168.2.2333080TCP
              2024-12-22T22:59:53.283008+010020304891Malware Command and Control Activity Detected87.120.112.23447925192.168.2.2333080TCP

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Source: bot.x86.elfAvira: detected
              Source: bot.x86.elfReversingLabs: Detection: 68%
              Source: bot.x86.elfJoe Sandbox ML: detected
              Source: bot.x86.elfString: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

              Networking

              barindex
              Source: Network trafficSuricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33080 -> 87.120.112.234:47925
              Source: Network trafficSuricata IDS: 2030489 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response : 87.120.112.234:47925 -> 192.168.2.23:33080
              Source: global trafficTCP traffic: 87.120.112.234 ports 47925,2,4,5,7,9
              Source: global trafficTCP traffic: 192.168.2.23:33080 -> 87.120.112.234:47925
              Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
              Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
              Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
              Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
              Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
              Source: global trafficDNS traffic detected: DNS query: botnet.sharkcdn.net
              Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

              System Summary

              barindex
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
              Source: Process Memory Space: bot.x86.elf PID: 6238, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: Process Memory Space: bot.x86.elf PID: 6238, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
              Source: Initial sampleString containing 'busybox' found: /bin/busybox
              Source: Initial sampleString containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurl/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemdshellmnt/sys/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/anko-app/ankosample _8182T_1104/usr/libexec/openssh/sftp-serverabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f
              Source: ELF static info symbol of initial sample.symtab present: no
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
              Source: bot.x86.elf, type: SAMPLEMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
              Source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
              Source: Process Memory Space: bot.x86.elf PID: 6238, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: Process Memory Space: bot.x86.elf PID: 6238, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
              Source: classification engineClassification label: mal100.troj.linELF@0/0@1/0
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1582/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/3088/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/230/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/110/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/231/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/111/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/232/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1579/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/112/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/233/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1699/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/113/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/234/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1335/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1698/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/114/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/235/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1334/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1576/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/2302/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/115/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/236/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/116/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/237/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/117/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/118/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/910/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/119/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/912/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/10/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/2307/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/11/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/918/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/12/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/6240/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/13/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/14/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/15/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/16/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/17/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/18/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1594/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/120/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/121/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1349/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/122/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/243/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/123/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/2/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/124/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/3/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/4/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/125/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/126/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1344/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1465/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1586/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/127/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/6/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/248/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/128/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/249/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1463/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/800/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/9/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/801/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/6239/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/20/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/21/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1900/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/22/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/23/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/24/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/25/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/26/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/27/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/28/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/29/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/491/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/250/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/130/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/251/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/252/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/132/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/253/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/254/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/255/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/256/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1599/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/257/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1477/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/379/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/258/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1476/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/259/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1475/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/936/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/4503/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/30/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/2208/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/35/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1809/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/1494/cmdlineJump to behavior
              Source: /tmp/bot.x86.elf (PID: 6240)File opened: /proc/260/cmdlineJump to behavior

              Stealing of Sensitive Information

              barindex
              Source: Yara matchFile source: bot.x86.elf, type: SAMPLE
              Source: Yara matchFile source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: bot.x86.elf PID: 6238, type: MEMORYSTR
              Source: Yara matchFile source: bot.x86.elf, type: SAMPLE
              Source: Yara matchFile source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: bot.x86.elf PID: 6238, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: TrafficSuricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response
              Source: Yara matchFile source: bot.x86.elf, type: SAMPLE
              Source: Yara matchFile source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: bot.x86.elf PID: 6238, type: MEMORYSTR
              Source: Yara matchFile source: bot.x86.elf, type: SAMPLE
              Source: Yara matchFile source: 6238.1.0000000008048000.000000000805b000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: bot.x86.elf PID: 6238, type: MEMORYSTR
              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity Information1
              Scripting
              Valid AccountsWindows Management Instrumentation1
              Scripting
              Path InterceptionDirect Volume Access1
              OS Credential Dumping
              System Service DiscoveryRemote ServicesData from Local System1
              Encrypted Channel
              Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
              Non-Standard Port
              Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
              Non-Application Layer Protocol
              Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
              Application Layer Protocol
              Traffic DuplicationData Destruction
              No configs have been found
              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Number of created Files
              • Is malicious
              • Internet
              SourceDetectionScannerLabelLink
              bot.x86.elf68%ReversingLabsLinux.Backdoor.Mirai
              bot.x86.elf100%AviraEXP/ELF.Mirai.Z.A
              bot.x86.elf100%Joe Sandbox ML
              No Antivirus matches
              No Antivirus matches
              No Antivirus matches
              NameIPActiveMaliciousAntivirus DetectionReputation
              botnet.sharkcdn.net
              87.120.112.234
              truefalse
                high
                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs
                IPDomainCountryFlagASNASN NameMalicious
                109.202.202.202
                unknownSwitzerland
                13030INIT7CHfalse
                87.120.112.234
                botnet.sharkcdn.netBulgaria
                25206UNACS-AS-BG8000BurgasBGfalse
                91.189.91.43
                unknownUnited Kingdom
                41231CANONICAL-ASGBfalse
                91.189.91.42
                unknownUnited Kingdom
                41231CANONICAL-ASGBfalse
                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                87.120.112.234bot.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                  bot.arm5.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                    bot.x86_64.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                      91.189.91.43loligang.m68k.elfGet hashmaliciousMiraiBrowse
                        bot.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                          bot.arm5.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                            loligang.arm5.elfGet hashmaliciousMiraiBrowse
                              loligang.arm6.elfGet hashmaliciousMiraiBrowse
                                woega6.elfGet hashmaliciousMiraiBrowse
                                  hidakibest.arm7.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    hidakibest.arm4.elfGet hashmaliciousGafgyt, MiraiBrowse
                                      Space.arm7.elfGet hashmaliciousMiraiBrowse
                                        Space.arm.elfGet hashmaliciousMiraiBrowse
                                          91.189.91.42loligang.m68k.elfGet hashmaliciousMiraiBrowse
                                            bot.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                              bot.arm5.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                loligang.arm5.elfGet hashmaliciousMiraiBrowse
                                                  loligang.arm6.elfGet hashmaliciousMiraiBrowse
                                                    woega6.elfGet hashmaliciousMiraiBrowse
                                                      hidakibest.ppc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                        hidakibest.arm7.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                          hidakibest.arm6.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                            hidakibest.arm4.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              botnet.sharkcdn.netbot.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                                              • 87.120.112.234
                                                              bot.arm5.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              • 87.120.112.234
                                                              bot.x86_64.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              • 87.120.112.234
                                                              bot.x86.elfGet hashmaliciousMirai, OkiruBrowse
                                                              • 154.213.187.106
                                                              bot.arm5.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              • 154.213.187.106
                                                              bot.arm.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              • 154.213.187.106
                                                              bot.m68k.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              • 154.213.187.106
                                                              bot.x86_64.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              • 154.213.187.106
                                                              bot.mpsl.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              • 154.213.187.106
                                                              bot.ppc.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              • 154.213.187.106
                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              CANONICAL-ASGBloligang.m68k.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              bot.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                                              • 91.189.91.42
                                                              bot.arm5.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              • 91.189.91.42
                                                              loligang.arm5.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              loligang.arm6.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              woega6.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              hidakibest.ppc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                              • 91.189.91.42
                                                              hidakibest.arm7.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                              • 91.189.91.42
                                                              hidakibest.arm5.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                              • 185.125.190.26
                                                              hidakibest.arm6.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                              • 91.189.91.42
                                                              CANONICAL-ASGBloligang.m68k.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              bot.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                                              • 91.189.91.42
                                                              bot.arm5.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              • 91.189.91.42
                                                              loligang.arm5.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              loligang.arm6.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              woega6.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              hidakibest.ppc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                              • 91.189.91.42
                                                              hidakibest.arm7.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                              • 91.189.91.42
                                                              hidakibest.arm5.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                              • 185.125.190.26
                                                              hidakibest.arm6.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                              • 91.189.91.42
                                                              INIT7CHloligang.m68k.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              bot.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                                              • 109.202.202.202
                                                              bot.arm5.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              • 109.202.202.202
                                                              loligang.arm5.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              loligang.arm6.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              woega6.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              hidakibest.ppc.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                              • 109.202.202.202
                                                              hidakibest.arm7.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                              • 109.202.202.202
                                                              hidakibest.arm6.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                              • 109.202.202.202
                                                              hidakibest.arm4.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                              • 109.202.202.202
                                                              UNACS-AS-BG8000BurgasBGbot.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                                              • 87.120.112.234
                                                              bot.arm5.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              • 87.120.112.234
                                                              bot.x86_64.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                                              • 87.120.112.234
                                                              t5lpvahkgypd7wy.vbsGet hashmaliciousGuLoader, RHADAMANTHYSBrowse
                                                              • 87.120.125.77
                                                              List of required items and services.pdf.vbsGet hashmaliciousGuLoader, RHADAMANTHYSBrowse
                                                              • 87.120.127.215
                                                              g8ix97hz.vbsGet hashmaliciousGuLoader, RHADAMANTHYSBrowse
                                                              • 87.120.127.215
                                                              305iz8bs.exeGet hashmaliciousUnknownBrowse
                                                              • 87.120.125.214
                                                              305iz8bs.exeGet hashmaliciousUnknownBrowse
                                                              • 87.120.125.214
                                                              https://www.google.gr/url?url=https://pniuvlpkjqhdwff&exox=rvhqtix&eaydny=ysf&gzfds=lqrwiz&nci=qtwmzch&iccvb=yhwtsp&vtqs=avtajyu&oagvzgp=irlq&mvdoc=embwrj&yylmwei=tmn&mntt=qqcvuhkd&lkydbjfiod=izjcgyubqc&q=amp/anre6g6.j%c2%adh%c2%adhn%c2%adt%c2%addd%c2%adsm%c2%ado%c2%admcw%c2%adw%c2%adgu%c2%adno.com%e2%80%8b/99twfh3p8&gcyx=ncgobia&yfevoul=wtloixvv&hukl=qfkmtky&nlhwnbr=bwkoiopy&eqfw=bmcpntp&vlvegw=zdbpajeyq&ghrv=kcdfwrl&kyddme=myxsnvtxf&asco=mgumegd&dvvibf=hzfexefeg&osme=bdyguyp&njtjvd=bkelfwmxg&bxrb=ltpyjsv&girpat=lswjchrwc&qapj=wwwowde&vahefc=ghseyzgyf&ahaj=zfqmkuo&pfsfeu=ttucmtamu&sffs=oxaajjo&hbwhgy=mgfzglmmo&bdwl=oifsufx&befsmv=jskhtmnps&sfjy=powmsnr&zixjqp=jyttdwbmu&fzkp=hztiqjm&jmzuvc=ufyoeqgfi&zujr=jxtbdtg&plvxoh=fxumxxddw&nkin=ykbzrdh&lghzli=agvbttfta&suag=ioudcjc&zpptpx=dxacgdnox&hmfz=yueoymp&fnshpz=wgayslegy&gjtg=qcjjozv&rymask=thcxzfpca&zcgn=ywtonnx&kqrpog=kgfvcqswk&imwa=wlvocxf&ggqznt=budaflbgp&zjhr=zscgach&esrhmq=qjdngljnl&ppoz=nhwzlik&zejsqg=vnvpaymyl&dnqb=kjswpyt&kunwbg=pzauoqliz&bqlz=qabnsnu&dlfnsr=dakxdfzen&uffg=uwnswdr&ywjevz=bnvkfavcb&rrob=celdmvn&czdusr=sjfjazfqw&ipgr=exylggn&fltcvh=sdfsricvf&byfs=apntxot&javhwh=nyphchiee&owbh=haflpez&mbyvqw=pdzpxeedx&ejov=taakkyw&oylsfz=qnzuplrnz&hxrq=ovegslq&duqjcc=pjwdpyvec&uoec=pjouxrb&eiezwk=okbkttiao&knji=kcmfaqe&qmathj=vymnqrvxa&gajs=riewukz&czxhiu=uysriqpma&avwe=gssbenk&jnwgpb=iqkroelwx&sjyt=zhxfzpx&liqoqs=bbajxgpxm&dqqu=ztzooam&haagcu=gkijlwgjy&mnsq=uervedi&yckhpb=ngqrbrqpc&pkne=nwisdfz&eqsiqu=mlrhvpuavGet hashmaliciousUnknownBrowse
                                                              • 87.120.114.172
                                                              17.12.2024 ________.exeGet hashmaliciousRedLineBrowse
                                                              • 87.120.120.86
                                                              No context
                                                              No context
                                                              No created / dropped files found
                                                              File type:ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
                                                              Entropy (8bit):5.77266945595552
                                                              TrID:
                                                              • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
                                                              • ELF Executable and Linkable format (generic) (4004/1) 49.84%
                                                              File name:bot.x86.elf
                                                              File size:93'768 bytes
                                                              MD5:3383ee8d13eb2229da66dabdd097cbdb
                                                              SHA1:9930815fbd977d6e7831d669151226f9a452d03b
                                                              SHA256:4ffd080e157ddf698118da393e3fb76b8e819a6e21c150122c279ea4b6555d3c
                                                              SHA512:ff46f4e43138379dec596f2fcf1e229945750d05c199de7cdbb2e7e68e1f2df04e2563f57926fdc4eb4c3aef6d7966276a0ccba7a1f19efcb67e139345eada23
                                                              SSDEEP:1536:oFd1IRgCXUzx7t0fMqlngcEiyhcgSnyy72wPZnWhZS5xtY+z:oFdmR9XUzxh0fMgngcEim8yHAdew5bz
                                                              TLSH:0C936CC4F243E5F1EC9709B16137EB374B32F0BA111AEA43C7699972DCA2541DA06B9C
                                                              File Content Preview:.ELF....................d...4....l......4. ...(......................$...$...............$...........G..8...........Q.td............................U..S.......o4...h....c...[]...$.............U......=.....t..5....$......$.......u........t....h............

                                                              ELF header

                                                              Class:ELF32
                                                              Data:2's complement, little endian
                                                              Version:1 (current)
                                                              Machine:Intel 80386
                                                              Version Number:0x1
                                                              Type:EXEC (Executable file)
                                                              OS/ABI:UNIX - System V
                                                              ABI Version:0
                                                              Entry Point Address:0x8048164
                                                              Flags:0x0
                                                              ELF Header Size:52
                                                              Program Header Offset:52
                                                              Program Header Size:32
                                                              Number of Program Headers:3
                                                              Section Header Offset:93368
                                                              Section Header Size:40
                                                              Number of Section Headers:10
                                                              Header String Table Index:9
                                                              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                              NULL0x00x00x00x00x0000
                                                              .initPROGBITS0x80480940x940x1c0x00x6AX001
                                                              .textPROGBITS0x80480b00xb00xfe860x00x6AX0016
                                                              .finiPROGBITS0x8057f360xff360x170x00x6AX001
                                                              .rodataPROGBITS0x8057f600xff600x25900x00x2A0032
                                                              .ctorsPROGBITS0x805b4f40x124f40xc0x00x3WA004
                                                              .dtorsPROGBITS0x805b5000x125000x80x00x3WA004
                                                              .dataPROGBITS0x805b5200x125200x47580x00x3WA0032
                                                              .bssNOBITS0x805fc800x16c780x49ac0x00x3WA0032
                                                              .shstrtabSTRTAB0x00x16c780x3e0x00x0001
                                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                              LOAD0x00x80480000x80480000x124f00x124f06.60550x5R E0x1000.init .text .fini .rodata
                                                              LOAD0x124f40x805b4f40x805b4f40x47840x91380.36420x6RW 0x1000.ctors .dtors .data .bss
                                                              GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
                                                              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                              2024-12-22T22:57:53.348994+01002030490ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)1192.168.2.233308087.120.112.23447925TCP
                                                              2024-12-22T22:57:54.512239+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response187.120.112.23447925192.168.2.2333080TCP
                                                              2024-12-22T22:58:13.255094+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response187.120.112.23447925192.168.2.2333080TCP
                                                              2024-12-22T22:58:33.260242+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response187.120.112.23447925192.168.2.2333080TCP
                                                              2024-12-22T22:58:53.265431+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response187.120.112.23447925192.168.2.2333080TCP
                                                              2024-12-22T22:59:13.270817+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response187.120.112.23447925192.168.2.2333080TCP
                                                              2024-12-22T22:59:33.276516+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response187.120.112.23447925192.168.2.2333080TCP
                                                              2024-12-22T22:59:53.283008+01002030489ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response187.120.112.23447925192.168.2.2333080TCP
                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Dec 22, 2024 22:57:52.919689894 CET43928443192.168.2.2391.189.91.42
                                                              Dec 22, 2024 22:57:53.228931904 CET3308047925192.168.2.2387.120.112.234
                                                              Dec 22, 2024 22:57:53.348900080 CET479253308087.120.112.234192.168.2.23
                                                              Dec 22, 2024 22:57:53.348963976 CET3308047925192.168.2.2387.120.112.234
                                                              Dec 22, 2024 22:57:53.348994017 CET3308047925192.168.2.2387.120.112.234
                                                              Dec 22, 2024 22:57:53.468820095 CET479253308087.120.112.234192.168.2.23
                                                              Dec 22, 2024 22:57:54.512238979 CET479253308087.120.112.234192.168.2.23
                                                              Dec 22, 2024 22:57:54.512315989 CET3308047925192.168.2.2387.120.112.234
                                                              Dec 22, 2024 22:57:58.294935942 CET42836443192.168.2.2391.189.91.43
                                                              Dec 22, 2024 22:57:59.063425064 CET4251680192.168.2.23109.202.202.202
                                                              Dec 22, 2024 22:58:04.518237114 CET3308047925192.168.2.2387.120.112.234
                                                              Dec 22, 2024 22:58:04.638010979 CET479253308087.120.112.234192.168.2.23
                                                              Dec 22, 2024 22:58:13.255094051 CET479253308087.120.112.234192.168.2.23
                                                              Dec 22, 2024 22:58:13.255187988 CET3308047925192.168.2.2387.120.112.234
                                                              Dec 22, 2024 22:58:14.164880037 CET43928443192.168.2.2391.189.91.42
                                                              Dec 22, 2024 22:58:24.403429985 CET42836443192.168.2.2391.189.91.43
                                                              Dec 22, 2024 22:58:28.498883009 CET4251680192.168.2.23109.202.202.202
                                                              Dec 22, 2024 22:58:33.260241985 CET479253308087.120.112.234192.168.2.23
                                                              Dec 22, 2024 22:58:33.260464907 CET3308047925192.168.2.2387.120.112.234
                                                              Dec 22, 2024 22:58:53.265430927 CET479253308087.120.112.234192.168.2.23
                                                              Dec 22, 2024 22:58:53.265638113 CET3308047925192.168.2.2387.120.112.234
                                                              Dec 22, 2024 22:58:55.119185925 CET43928443192.168.2.2391.189.91.42
                                                              Dec 22, 2024 22:59:13.270817041 CET479253308087.120.112.234192.168.2.23
                                                              Dec 22, 2024 22:59:13.271150112 CET3308047925192.168.2.2387.120.112.234
                                                              Dec 22, 2024 22:59:33.276515961 CET479253308087.120.112.234192.168.2.23
                                                              Dec 22, 2024 22:59:33.276634932 CET3308047925192.168.2.2387.120.112.234
                                                              Dec 22, 2024 22:59:53.283008099 CET479253308087.120.112.234192.168.2.23
                                                              Dec 22, 2024 22:59:53.283169985 CET3308047925192.168.2.2387.120.112.234
                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Dec 22, 2024 22:57:52.649267912 CET5187753192.168.2.238.8.8.8
                                                              Dec 22, 2024 22:57:53.228833914 CET53518778.8.8.8192.168.2.23
                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                              Dec 22, 2024 22:57:52.649267912 CET192.168.2.238.8.8.80x7164Standard query (0)botnet.sharkcdn.netA (IP address)IN (0x0001)false
                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                              Dec 22, 2024 22:57:53.228833914 CET8.8.8.8192.168.2.230x7164No error (0)botnet.sharkcdn.net87.120.112.234A (IP address)IN (0x0001)false

                                                              System Behavior

                                                              Start time (UTC):21:57:51
                                                              Start date (UTC):22/12/2024
                                                              Path:/tmp/bot.x86.elf
                                                              Arguments:/tmp/bot.x86.elf
                                                              File size:93768 bytes
                                                              MD5 hash:3383ee8d13eb2229da66dabdd097cbdb

                                                              Start time (UTC):21:57:51
                                                              Start date (UTC):22/12/2024
                                                              Path:/tmp/bot.x86.elf
                                                              Arguments:-
                                                              File size:93768 bytes
                                                              MD5 hash:3383ee8d13eb2229da66dabdd097cbdb

                                                              Start time (UTC):21:57:51
                                                              Start date (UTC):22/12/2024
                                                              Path:/tmp/bot.x86.elf
                                                              Arguments:-
                                                              File size:93768 bytes
                                                              MD5 hash:3383ee8d13eb2229da66dabdd097cbdb