Edit tour

Linux Analysis Report
zerppc.elf

Overview

General Information

Sample name:	zerppc.elf
Analysis ID:	1580201
MD5:	44d0c239684c1065160bd9f9c82ff48d
SHA1:	85c4aa3ea33358381b4efcc277190a29e8c8a336
SHA256:	3cd7bc96919f59a7ffe00008a5a9a24063066108498b530ce5e10d56f5e5d60a
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580201
Start date and time:	2024-12-24 04:13:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	zerppc.elf
Detection:	MAL
Classification:	mal56.troj.linELF@0/0@12/0

Runtime Messages

Command:	/tmp/zerppc.elf
PID:	5462
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	The Peoples Bank of China.
Standard Error:

Process Tree

system is lnxubuntu20

zerppc.elf (PID: 5462, Parent: 5376, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/zerppc.elf

zerppc.elf New Fork (PID: 5464, Parent: 5462)

zerppc.elf New Fork (PID: 5466, Parent: 5464)

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: zerppc.elf	ReversingLabs: Detection: 31%
Source: zerppc.elf	Virustotal: Detection: 42%			Perma Link

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 154.216.16.244 ports 38241,1,2,3,4,8
Source: global traffic	TCP traffic: 154.216.16.250 ports 38241,1,2,3,4,8
Source: global traffic	TCP traffic: 209.38.192.73 ports 38241,1,2,3,4,8

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: serisbot.geek. [malformed]

Source: global traffic	TCP traffic: 192.168.2.13:48450 -> 209.38.192.73:38241
Source: global traffic	TCP traffic: 192.168.2.13:44654 -> 154.216.16.244:38241
Source: global traffic	TCP traffic: 192.168.2.13:58394 -> 154.216.16.250:38241

Source: /tmp/zerppc.elf (PID: 5462)

Socket: 127.0.0.1:39148

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 168.235.111.72
Source: unknown	UDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknown	UDP traffic detected without corresponding DNS query: 51.158.108.203
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 152.53.15.127
Source: unknown	UDP traffic detected without corresponding DNS query: 202.61.197.122
Source: unknown	UDP traffic detected without corresponding DNS query: 81.169.136.222
Source: unknown	UDP traffic detected without corresponding DNS query: 51.158.108.203

Source: global traffic	DNS traffic detected: DNS query: serisbot.geek
Source: global traffic	DNS traffic detected: DNS query: serisontop.dyn
Source: global traffic	DNS traffic detected: DNS query: serisbot.geek. [malformed]

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne >> > .d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal56.troj.linELF@0/0@12/0

Source: /tmp/zerppc.elf (PID: 5462)

Queries kernel information via 'uname':

Jump to behavior

Source: zerppc.elf, 5462.1.000055eb8707e000.000055eb8712e000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: zerppc.elf, 5462.1.000055eb8707e000.000055eb8712e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: zerppc.elf, 5462.1.00007ffd196dc000.00007ffd196fd000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: zerppc.elf, 5462.1.00007ffd196dc000.00007ffd196fd000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/zerppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/zerppc.elf

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
zerppc.elf	32%	ReversingLabs	Linux.Trojan.Mirai
zerppc.elf	43%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
serisontop.dyn	154.216.16.244	true	false	high
serisbot.geek	209.38.192.73	true	false	high
serisbot.geek. [malformed]	unknown	unknown	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.216.16.244	serisontop.dyn	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
154.216.16.250	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	true
185.125.190.26	unknown	United Kingdom	41231	CANONICAL-ASGB	false
209.38.192.73	serisbot.geek	United States	7018	ATT-INTERNET4US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
154.216.16.244	zerarm5.elf	Get hash	malicious	Unknown	Browse
	nabx86.elf	Get hash	malicious	Unknown	Browse
	nabsh4.elf	Get hash	malicious	Unknown	Browse
	nabmpsl.elf	Get hash	malicious	Unknown	Browse
	nabmips.elf	Get hash	malicious	Unknown	Browse
	zerspc.elf	Get hash	malicious	Unknown	Browse
	zerarm.elf	Get hash	malicious	Unknown	Browse
	zerx86.elf	Get hash	malicious	Unknown	Browse
154.216.16.250	zerspc.elf	Get hash	malicious	Unknown	Browse
	zermpsl.elf	Get hash	malicious	Unknown	Browse
	zerarm.elf	Get hash	malicious	Unknown	Browse
	zerx86.elf	Get hash	malicious	Unknown	Browse
185.125.190.26	zerarm5.elf	Get hash	malicious	Unknown	Browse
	zermips.elf	Get hash	malicious	Unknown	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	sh4.nn.elf	Get hash	malicious	Okiru	Browse
	jackmymips64.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm5.nn.elf	Get hash	malicious	Okiru	Browse
	arm.nn-20241223-1416.elf	Get hash	malicious	Okiru	Browse
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	vlxx.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse
209.38.192.73	zerarm5.elf	Get hash	malicious	Unknown	Browse
	zermips.elf	Get hash	malicious	Unknown	Browse
	zersh4.elf	Get hash	malicious	Unknown	Browse
	zerspc.elf	Get hash	malicious	Unknown	Browse
	zerm68k.elf	Get hash	malicious	Unknown	Browse
	zermpsl.elf	Get hash	malicious	Unknown	Browse
	zerarm.elf	Get hash	malicious	Unknown	Browse
	zerx86.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
serisontop.dyn	nabarm7.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	zerarm5.elf	Get hash	malicious	Unknown	Browse	209.38.192.73
	splarm5.elf	Get hash	malicious	Unknown	Browse	209.38.192.73
	splsh4.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	nabx86.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	splmips.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	nabppc.elf	Get hash	malicious	Unknown	Browse	209.38.192.73
	nabsh4.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	zersh4.elf	Get hash	malicious	Unknown	Browse	154.216.16.250

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	zerarm5.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	zermips.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	zerm68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	zerarm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	armv4eb.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	x86_32.nn.elf	Get hash	malicious	Okiru	Browse	91.189.91.42
	tftp.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm5.nn-20241224-0050.elf	Get hash	malicious	Okiru	Browse	91.189.91.42
	bot.sh4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	mipsel.nn.elf	Get hash	malicious	Okiru	Browse	91.189.91.42
ATT-INTERNET4US	nklspc.elf	Get hash	malicious	Unknown	Browse	99.108.133.174
	ppc.elf	Get hash	malicious	Unknown	Browse	63.201.18.112
	nabarm7.elf	Get hash	malicious	Unknown	Browse	107.253.222.14
	zerarm5.elf	Get hash	malicious	Unknown	Browse	209.38.192.73
	splarm5.elf	Get hash	malicious	Unknown	Browse	104.50.152.60
	splsh4.elf	Get hash	malicious	Unknown	Browse	12.167.12.161
	nabx86.elf	Get hash	malicious	Unknown	Browse	68.76.208.129
	splmips.elf	Get hash	malicious	Unknown	Browse	32.49.33.160
	zermips.elf	Get hash	malicious	Unknown	Browse	209.38.192.73
	nabppc.elf	Get hash	malicious	Unknown	Browse	70.137.219.150
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	zerarm5.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	nabx86.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	nabsh4.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	nabmpsl.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	nabmips.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	arm.elf	Get hash	malicious	Unknown	Browse	45.207.239.67
	zerspc.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	zermpsl.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	zerarm.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	zerx86.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	zerarm5.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	nabx86.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	nabsh4.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	nabmpsl.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	nabmips.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	arm.elf	Get hash	malicious	Unknown	Browse	45.207.239.67
	zerspc.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	zermpsl.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	zerarm.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	zerx86.elf	Get hash	malicious	Unknown	Browse	154.216.16.250

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.16904858126552
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	zerppc.elf
File size:	46'048 bytes
MD5:	44d0c239684c1065160bd9f9c82ff48d
SHA1:	85c4aa3ea33358381b4efcc277190a29e8c8a336
SHA256:	3cd7bc96919f59a7ffe00008a5a9a24063066108498b530ce5e10d56f5e5d60a
SHA512:	115030da37edcb6cc381d29e41e337ba374127256a2a27c9fe23fa16981fbd9b36db8b8692779977c9eba2ac78e7193fcfc24f1422d0e3addf89df563aff67df
SSDEEP:	768:gvxq32zARiw674rSHvb560gUGE0NtIdiSYz5766Th:WqGUElGiF60gRHNtgiSYF79Th
TLSH:	9D233B42721C0927C06257B4253E17E0E7FBBDA025F4FA88650FAB5A8575F372086F9E
File Content Preview:	.ELF...........................4.........4. ...(.......................$...$........................................dt.Q.............................!..\|......$H...H..5...$8!. \|...N.. .!..\|.......?.............../...@..\?........+../...A..$8...})......N..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	45528
Section Header Size:	40
Number of Section Headers:	13
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0xa68c	0x0	0x6	AX	4
.fini	PROGBITS	0x1000a744	0xa744	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1000a764	0xa764	0x7c0	0x0	0x2	A	4
.ctors	PROGBITS	0x1001b000	0xb000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1001b008	0xb008	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x1001b010	0xb010	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x1001b018	0xb018	0x148	0x0	0x3	WA	8
.sdata	PROGBITS	0x1001b160	0xb160	0x28	0x0	0x3	WA	4
.sbss	NOBITS	0x1001b188	0xb188	0x5c	0x0	0x3	WA	4
.bss	NOBITS	0x1001b1e4	0xb188	0x10c	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xb188	0x50	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0xaf24	0xaf24	6.2457	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xb000	0x1001b000	0x1001b000	0x188	0x2f0	0.8914	0x6	RW	0x10000	.ctors .dtors .jcr .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 04:14:27.722017050 CET	48450	38241	192.168.2.13	209.38.192.73
Dec 24, 2024 04:14:27.841568947 CET	38241	48450	209.38.192.73	192.168.2.13
Dec 24, 2024 04:14:27.841662884 CET	48450	38241	192.168.2.13	209.38.192.73
Dec 24, 2024 04:14:27.842621088 CET	48450	38241	192.168.2.13	209.38.192.73
Dec 24, 2024 04:14:27.962160110 CET	38241	48450	209.38.192.73	192.168.2.13
Dec 24, 2024 04:14:27.962490082 CET	48450	38241	192.168.2.13	209.38.192.73
Dec 24, 2024 04:14:28.081976891 CET	38241	48450	209.38.192.73	192.168.2.13
Dec 24, 2024 04:14:34.678073883 CET	48202	443	192.168.2.13	185.125.190.26
Dec 24, 2024 04:14:37.853200912 CET	48450	38241	192.168.2.13	209.38.192.73
Dec 24, 2024 04:14:37.972929955 CET	38241	48450	209.38.192.73	192.168.2.13
Dec 24, 2024 04:14:38.274146080 CET	38241	48450	209.38.192.73	192.168.2.13
Dec 24, 2024 04:14:38.274454117 CET	48450	38241	192.168.2.13	209.38.192.73
Dec 24, 2024 04:14:38.393898010 CET	38241	48450	209.38.192.73	192.168.2.13
Dec 24, 2024 04:14:39.595434904 CET	48452	38241	192.168.2.13	209.38.192.73
Dec 24, 2024 04:14:39.715109110 CET	38241	48452	209.38.192.73	192.168.2.13
Dec 24, 2024 04:14:39.715246916 CET	48452	38241	192.168.2.13	209.38.192.73
Dec 24, 2024 04:14:39.716221094 CET	48452	38241	192.168.2.13	209.38.192.73
Dec 24, 2024 04:14:39.835750103 CET	38241	48452	209.38.192.73	192.168.2.13
Dec 24, 2024 04:14:39.835958958 CET	48452	38241	192.168.2.13	209.38.192.73
Dec 24, 2024 04:14:39.955425978 CET	38241	48452	209.38.192.73	192.168.2.13
Dec 24, 2024 04:14:50.826834917 CET	38241	48452	209.38.192.73	192.168.2.13
Dec 24, 2024 04:14:50.827150106 CET	48452	38241	192.168.2.13	209.38.192.73
Dec 24, 2024 04:14:50.946629047 CET	38241	48452	209.38.192.73	192.168.2.13
Dec 24, 2024 04:14:52.070384979 CET	44654	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:14:52.189887047 CET	38241	44654	154.216.16.244	192.168.2.13
Dec 24, 2024 04:14:52.190001965 CET	44654	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:14:52.191333055 CET	44654	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:14:52.310795069 CET	38241	44654	154.216.16.244	192.168.2.13
Dec 24, 2024 04:14:52.310890913 CET	44654	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:14:52.430383921 CET	38241	44654	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:03.299141884 CET	38241	44654	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:03.299428940 CET	44654	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:03.419007063 CET	38241	44654	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:04.544327021 CET	44656	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:04.663738966 CET	38241	44656	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:04.663836002 CET	44656	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:04.665580034 CET	44656	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:04.785402060 CET	38241	44656	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:04.785495043 CET	44656	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:04.905002117 CET	38241	44656	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:06.934250116 CET	48202	443	192.168.2.13	185.125.190.26
Dec 24, 2024 04:15:15.771653891 CET	38241	44656	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:15.771910906 CET	44656	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:15.891362906 CET	38241	44656	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:17.013252974 CET	44658	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:17.132791996 CET	38241	44658	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:17.132915020 CET	44658	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:17.134135962 CET	44658	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:17.253101110 CET	38241	44658	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:17.253257990 CET	44658	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:17.254722118 CET	38241	44658	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:17.373142004 CET	38241	44658	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:18.500936985 CET	44660	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:18.621284008 CET	38241	44660	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:18.621439934 CET	44660	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:18.622571945 CET	44660	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:18.742084026 CET	38241	44660	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:18.742351055 CET	44660	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:18.861932039 CET	38241	44660	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:29.730752945 CET	38241	44660	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:29.731143951 CET	44660	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:15:29.850884914 CET	38241	44660	154.216.16.244	192.168.2.13
Dec 24, 2024 04:15:30.995995998 CET	58394	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:31.115576982 CET	38241	58394	154.216.16.250	192.168.2.13
Dec 24, 2024 04:15:31.115746975 CET	58394	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:31.117403030 CET	58394	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:31.236906052 CET	38241	58394	154.216.16.250	192.168.2.13
Dec 24, 2024 04:15:31.237051964 CET	58394	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:31.356559038 CET	38241	58394	154.216.16.250	192.168.2.13
Dec 24, 2024 04:15:42.225544930 CET	38241	58394	154.216.16.250	192.168.2.13
Dec 24, 2024 04:15:42.225929022 CET	58394	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:42.345449924 CET	38241	58394	154.216.16.250	192.168.2.13
Dec 24, 2024 04:15:43.479768038 CET	58396	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:43.599342108 CET	38241	58396	154.216.16.250	192.168.2.13
Dec 24, 2024 04:15:43.599689960 CET	58396	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:43.601195097 CET	58396	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:43.720598936 CET	38241	58396	154.216.16.250	192.168.2.13
Dec 24, 2024 04:15:43.720716000 CET	58396	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:43.840246916 CET	38241	58396	154.216.16.250	192.168.2.13
Dec 24, 2024 04:15:53.611377001 CET	58396	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:53.730848074 CET	38241	58396	154.216.16.250	192.168.2.13
Dec 24, 2024 04:15:54.031866074 CET	38241	58396	154.216.16.250	192.168.2.13
Dec 24, 2024 04:15:54.032157898 CET	58396	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:54.151550055 CET	38241	58396	154.216.16.250	192.168.2.13
Dec 24, 2024 04:15:55.276323080 CET	58398	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:55.395829916 CET	38241	58398	154.216.16.250	192.168.2.13
Dec 24, 2024 04:15:55.396008015 CET	58398	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:55.397342920 CET	58398	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:55.516767025 CET	38241	58398	154.216.16.250	192.168.2.13
Dec 24, 2024 04:15:55.516866922 CET	58398	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:15:55.636373997 CET	38241	58398	154.216.16.250	192.168.2.13
Dec 24, 2024 04:16:06.502777100 CET	38241	58398	154.216.16.250	192.168.2.13
Dec 24, 2024 04:16:06.502993107 CET	58398	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:16:06.622456074 CET	38241	58398	154.216.16.250	192.168.2.13
Dec 24, 2024 04:16:07.745050907 CET	58400	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:16:07.864500046 CET	38241	58400	154.216.16.250	192.168.2.13
Dec 24, 2024 04:16:07.864736080 CET	58400	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:16:07.866290092 CET	58400	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:16:07.985726118 CET	38241	58400	154.216.16.250	192.168.2.13
Dec 24, 2024 04:16:07.986013889 CET	58400	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:16:08.105683088 CET	38241	58400	154.216.16.250	192.168.2.13
Dec 24, 2024 04:16:18.971518040 CET	38241	58400	154.216.16.250	192.168.2.13
Dec 24, 2024 04:16:18.971715927 CET	58400	38241	192.168.2.13	154.216.16.250
Dec 24, 2024 04:16:19.091378927 CET	38241	58400	154.216.16.250	192.168.2.13
Dec 24, 2024 04:16:20.214579105 CET	44670	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:16:20.334158897 CET	38241	44670	154.216.16.244	192.168.2.13
Dec 24, 2024 04:16:20.334394932 CET	44670	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:16:20.335455894 CET	44670	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:16:20.454996109 CET	38241	44670	154.216.16.244	192.168.2.13
Dec 24, 2024 04:16:20.455184937 CET	44670	38241	192.168.2.13	154.216.16.244
Dec 24, 2024 04:16:20.576040983 CET	38241	44670	154.216.16.244	192.168.2.13

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 04:14:25.239579916 CET	55647	53	192.168.2.13	81.169.136.222
Dec 24, 2024 04:14:25.478101015 CET	53	55647	81.169.136.222	192.168.2.13
Dec 24, 2024 04:14:27.481241941 CET	48271	53	192.168.2.13	194.36.144.87
Dec 24, 2024 04:14:27.720827103 CET	53	48271	194.36.144.87	192.168.2.13
Dec 24, 2024 04:14:39.277281046 CET	36354	53	192.168.2.13	168.235.111.72
Dec 24, 2024 04:14:39.594444990 CET	53	36354	168.235.111.72	192.168.2.13
Dec 24, 2024 04:14:51.830513000 CET	41941	53	192.168.2.13	51.158.108.203
Dec 24, 2024 04:14:52.069561005 CET	53	41941	51.158.108.203	192.168.2.13
Dec 24, 2024 04:15:04.303280115 CET	47763	53	192.168.2.13	51.158.108.203
Dec 24, 2024 04:15:04.543057919 CET	53	47763	51.158.108.203	192.168.2.13
Dec 24, 2024 04:15:16.774518013 CET	44065	53	192.168.2.13	81.169.136.222
Dec 24, 2024 04:15:17.012433052 CET	53	44065	81.169.136.222	192.168.2.13
Dec 24, 2024 04:15:18.255887032 CET	40725	53	192.168.2.13	202.61.197.122
Dec 24, 2024 04:15:18.499969959 CET	53	40725	202.61.197.122	192.168.2.13
Dec 24, 2024 04:15:30.735974073 CET	49958	53	192.168.2.13	185.181.61.24
Dec 24, 2024 04:15:30.994853973 CET	53	49958	185.181.61.24	192.168.2.13
Dec 24, 2024 04:15:43.229182005 CET	55613	53	192.168.2.13	152.53.15.127
Dec 24, 2024 04:15:43.478591919 CET	53	55613	152.53.15.127	192.168.2.13
Dec 24, 2024 04:15:55.034626007 CET	50000	53	192.168.2.13	202.61.197.122
Dec 24, 2024 04:15:55.275574923 CET	53	50000	202.61.197.122	192.168.2.13
Dec 24, 2024 04:16:07.505822897 CET	39323	53	192.168.2.13	81.169.136.222
Dec 24, 2024 04:16:07.744119883 CET	53	39323	81.169.136.222	192.168.2.13
Dec 24, 2024 04:16:19.974411964 CET	60746	53	192.168.2.13	51.158.108.203
Dec 24, 2024 04:16:20.213875055 CET	53	60746	51.158.108.203	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 04:14:25.239579916 CET	192.168.2.13	81.169.136.222	0x4651	Standard query (0)	serisbot.geek	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:27.481241941 CET	192.168.2.13	194.36.144.87	0x1ccb	Standard query (0)	serisbot.geek	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:39.277281046 CET	192.168.2.13	168.235.111.72	0x8fb1	Standard query (0)	serisbot.geek	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:51.830513000 CET	192.168.2.13	51.158.108.203	0xf12c	Standard query (0)	serisontop.dyn	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:04.303280115 CET	192.168.2.13	51.158.108.203	0x823e	Standard query (0)	serisbot.geek. [malformed]	256	312	false
Dec 24, 2024 04:15:16.774518013 CET	192.168.2.13	81.169.136.222	0xcb4a	Standard query (0)	serisbot.geek. [malformed]	256	325	false
Dec 24, 2024 04:15:18.255887032 CET	192.168.2.13	202.61.197.122	0x4dad	Standard query (0)	serisontop.dyn	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:30.735974073 CET	192.168.2.13	185.181.61.24	0x137d	Standard query (0)	serisontop.dyn	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:43.229182005 CET	192.168.2.13	152.53.15.127	0x32e6	Standard query (0)	serisbot.geek. [malformed]	256	351	false
Dec 24, 2024 04:15:55.034626007 CET	192.168.2.13	202.61.197.122	0xd683	Standard query (0)	serisbot.geek. [malformed]	256	363	false
Dec 24, 2024 04:16:07.505822897 CET	192.168.2.13	81.169.136.222	0x8d90	Standard query (0)	serisbot.geek. [malformed]	256	375	false
Dec 24, 2024 04:16:19.974411964 CET	192.168.2.13	51.158.108.203	0x2841	Standard query (0)	serisontop.dyn	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 04:14:25.478101015 CET	81.169.136.222	192.168.2.13	0x4651	Refused (5)	serisbot.geek	none	none	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:27.720827103 CET	194.36.144.87	192.168.2.13	0x1ccb	No error (0)	serisbot.geek		209.38.192.73	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:39.594444990 CET	168.235.111.72	192.168.2.13	0x8fb1	No error (0)	serisbot.geek		154.216.16.244	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:39.594444990 CET	168.235.111.72	192.168.2.13	0x8fb1	No error (0)	serisbot.geek		154.216.16.250	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:39.594444990 CET	168.235.111.72	192.168.2.13	0x8fb1	No error (0)	serisbot.geek		209.38.192.73	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:52.069561005 CET	51.158.108.203	192.168.2.13	0xf12c	No error (0)	serisontop.dyn		154.216.16.244	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:52.069561005 CET	51.158.108.203	192.168.2.13	0xf12c	No error (0)	serisontop.dyn		209.38.192.73	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:14:52.069561005 CET	51.158.108.203	192.168.2.13	0xf12c	No error (0)	serisontop.dyn		154.216.16.250	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:04.543057919 CET	51.158.108.203	192.168.2.13	0x823e	Format error (1)	serisbot.geek. [malformed]	none	none	256	312	false
Dec 24, 2024 04:15:18.499969959 CET	202.61.197.122	192.168.2.13	0x4dad	No error (0)	serisontop.dyn		209.38.192.73	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:18.499969959 CET	202.61.197.122	192.168.2.13	0x4dad	No error (0)	serisontop.dyn		154.216.16.250	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:18.499969959 CET	202.61.197.122	192.168.2.13	0x4dad	No error (0)	serisontop.dyn		154.216.16.244	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:30.994853973 CET	185.181.61.24	192.168.2.13	0x137d	No error (0)	serisontop.dyn		154.216.16.250	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:30.994853973 CET	185.181.61.24	192.168.2.13	0x137d	No error (0)	serisontop.dyn		209.38.192.73	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:30.994853973 CET	185.181.61.24	192.168.2.13	0x137d	No error (0)	serisontop.dyn		154.216.16.244	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:15:43.478591919 CET	152.53.15.127	192.168.2.13	0x32e6	Format error (1)	serisbot.geek. [malformed]	none	none	256	351	false
Dec 24, 2024 04:16:20.213875055 CET	51.158.108.203	192.168.2.13	0x2841	No error (0)	serisontop.dyn		154.216.16.250	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:16:20.213875055 CET	51.158.108.203	192.168.2.13	0x2841	No error (0)	serisontop.dyn		154.216.16.244	A (IP address)	IN (0x0001)	false
Dec 24, 2024 04:16:20.213875055 CET	51.158.108.203	192.168.2.13	0x2841	No error (0)	serisontop.dyn		209.38.192.73	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: zerppc.elf PID: 5462, Parent PID: 5376

General

Start time (UTC):	03:14:24
Start date (UTC):	24/12/2024
Path:	/tmp/zerppc.elf
Arguments:	/tmp/zerppc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: zerppc.elf PID: 5464, Parent PID: 5462

General

Start time (UTC):	03:14:24
Start date (UTC):	24/12/2024
Path:	/tmp/zerppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: zerppc.elf PID: 5466, Parent PID: 5464

General

Start time (UTC):	03:14:24
Start date (UTC):	24/12/2024
Path:	/tmp/zerppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report zerppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: zerppc.elf PID: 5462, Parent PID: 5376

General

Chronological Activities

Analysis Process: zerppc.elf PID: 5464, Parent PID: 5462

General

Chronological Activities

Analysis Process: zerppc.elf PID: 5466, Parent PID: 5464

General

Chronological Activities

Linux Analysis Report
zerppc.elf