Edit tour

Linux Analysis Report
89.250.72.36-mips-2024-12-31T13_33_10.elf

Overview

General Information

Sample name:	89.250.72.36-mips-2024-12-31T13_33_10.elf
Analysis ID:	1582941
MD5:	4a6a5e3db369f3a1f929b2a190c9ff6d
SHA1:	e92c77e705a6e5e604eae97cbbd00ed0e906c476
SHA256:	55734f3e7ceefd13144b8d2f04f3c227465c6b4c75a5a6d8bf772f19c1e26c45
Tags:	elfuser-threatquery
Infos:

Detection

Gafgyt

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Contains symbols with names commonly found in malware

Contains symbols related to standard C library sleeps (sometimes used to evade sandboxing)

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582941
Start date and time:	2025-01-01 03:12:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	89.250.72.36-mips-2024-12-31T13_33_10.elf
Detection:	MAL
Classification:	mal76.troj.linELF@0/0@2/0
Cookbook Comments:	Analysis time extended to 480s due to sleep detection in submitted sample

Runtime Messages

Command:	/tmp/89.250.72.36-mips-2024-12-31T13_33_10.elf
PID:	5411
Exit Code:	255
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:	/lib/ld.so.1: No such file or directory

Process Tree

system is lnxubuntu20

89.250.72.36-mips-2024-12-31T13_33_10.elf (PID: 5411, Parent: 5335, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/89.250.72.36-mips-2024-12-31T13_33_10.elf

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
89.250.72.36-mips-2024-12-31T13_33_10.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
89.250.72.36-mips-2024-12-31T13_33_10.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x9ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa01c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa06c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5411.1.00007f413841a000.00007f413841c000.rw-.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5411.1.00007f4138400000.00007f413840b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x9ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9fe0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x9ff4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa008:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa01c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa030:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa044:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa058:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa06c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa080:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 89.250.72.36-mips-2024-12-31T13_33_10.elf PID: 5411	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x65ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6613:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6627:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x663b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x664f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6663:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6677:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x668b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x669f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x66b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x66c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x66db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x66ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6703:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6717:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x672b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x673f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6753:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6767:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x677b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x678f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 89.250.72.36-mips-2024-12-31T13_33_10.elf

Malware Configuration Extractor: Gafgyt {"C2 url": "89.250.72.36:666"}

Multi AV Scanner detection for submitted file

Source: 89.250.72.36-mips-2024-12-31T13_33_10.elf

Virustotal: Detection: 30%

Perma Link

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: 89.250.72.36-mips-2024-12-31T13_33_10.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5411.1.00007f413841a000.00007f413841c000.rw-.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5411.1.00007f4138400000.00007f413840b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 89.250.72.36-mips-2024-12-31T13_33_10.elf PID: 5411, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample

Name: vseattack

Source: 89.250.72.36-mips-2024-12-31T13_33_10.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5411.1.00007f413841a000.00007f413841c000.rw-.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5411.1.00007f4138400000.00007f413840b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 89.250.72.36-mips-2024-12-31T13_33_10.elf PID: 5411, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.troj.linELF@0/0@2/0

Source: ELF symbol in initial sample	Symbol name: sleep
Source: ELF symbol in initial sample	Symbol name: usleep

Source: /tmp/89.250.72.36-mips-2024-12-31T13_33_10.elf (PID: 5411)

Queries kernel information via 'uname':

Jump to behavior

Source: 89.250.72.36-mips-2024-12-31T13_33_10.elf, 5411.1.000055ec2fd20000.000055ec2fda7000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mips
Source: 89.250.72.36-mips-2024-12-31T13_33_10.elf, 5411.1.000055ec2fd20000.000055ec2fda7000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: 89.250.72.36-mips-2024-12-31T13_33_10.elf, 5411.1.00007ffe8cd7e000.00007ffe8cd9f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: 89.250.72.36-mips-2024-12-31T13_33_10.elf, 5411.1.00007ffe8cd7e000.00007ffe8cd9f000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/89.250.72.36-mips-2024-12-31T13_33_10.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/89.250.72.36-mips-2024-12-31T13_33_10.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match

File source: 89.250.72.36-mips-2024-12-31T13_33_10.elf, type: SAMPLE

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match

File source: 89.250.72.36-mips-2024-12-31T13_33_10.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Virtualization/Sandbox Evasion	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

Threatname: Gafgyt

{"C2 url": "89.250.72.36:666"}

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
89.250.72.36-mips-2024-12-31T13_33_10.elf	30%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
89.250.72.36:666	true		unknown

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, interpreter /lib/ld.so.1, BuildID[sha1]=0c76256e131ea719af530bff3ce05e4aeebc9e97, for GNU/Linux 3.2.0, not stripped
Entropy (8bit):	5.130385594489607
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	89.250.72.36-mips-2024-12-31T13_33_10.elf
File size:	52'788 bytes
MD5:	4a6a5e3db369f3a1f929b2a190c9ff6d
SHA1:	e92c77e705a6e5e604eae97cbbd00ed0e906c476
SHA256:	55734f3e7ceefd13144b8d2f04f3c227465c6b4c75a5a6d8bf772f19c1e26c45
SHA512:	08fb3a35b8a22436345230d88a41c372939c946549ab044aa2f46214ee5715c0aa50893cdea6cce10501ad463d7b6444ca5f5e7e57b0c2e9e186e41e9444dc09
SSDEEP:	768:cky5aZ8KaU8ve2PNDT4PXqPuxbVyKPcGlPKPgnVGnI9kyzHWgkmzLoRsD8M:ckyhle2x4PXqKkKUGRK4VGn6z2gHcRsZ
TLSH:	6633ED3EB310B7AFE6AC823415F15AF09A7210D266D25252D17DD9289DF621C0CDECEB
File Content Preview:	.ELF.....................@. ...4...4p....4. ...(. .........4.@.4.@.4...`...`.................@...@..................p........@...@..................p........@...@...........................@...@...........................A...A.....`..A..................@.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400c20
Flags:	0x70001007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	11
Section Header Offset:	51508
Section Header Size:	40
Number of Section Headers:	32
Header String Table Index:	31

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.interp	PROGBITS	0x400194	0x194	0xd	0x0	0x2	A	0	0	1
.MIPS.abiflags	MIPS_ABIFLAGS	0x4001a8	0x1a8	0x18	0x18	0x2	A	0	0	8
.reginfo	MIPS_REGINFO	0x4001c0	0x1c0	0x18	0x18	0x2	A	0	0	4
.note.gnu.build-id	NOTE	0x4001d8	0x1d8	0x24	0x0	0x2	A	0	0	4
.note.ABI-tag	NOTE	0x4001fc	0x1fc	0x20	0x0	0x2	A	0	0	4
.dynamic	DYNAMIC	0x40021c	0x21c	0xe8	0x8	0x2	A	9	0	4
.hash	HASH	0x400304	0x304	0x194	0x4	0x2	A	8	0	4
.dynsym	DYNSYM	0x400498	0x498	0x3e0	0x10	0x2	A	9	1	4
.dynstr	STRTAB	0x400878	0x878	0x23e	0x0	0x2	A	0	0	1
.gnu.version	VERSYM	0x400ab6	0xab6	0x7c	0x2	0x2	A	8	0	2
.gnu.version_r	VERNEED	0x400b34	0xb34	0x70	0x0	0x2	A	9	2	4
.init	PROGBITS	0x400ba4	0xba4	0x7c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x400c20	0xc20	0x8800	0x0	0x6	AX	0	0	16
.MIPS.stubs	PROGBITS	0x409420	0x9420	0x360	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x409780	0x9780	0x44	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x4097d0	0x97d0	0x1030	0x0	0x2	A	0	0	16
.eh_frame	PROGBITS	0x40a800	0xa800	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x41aff0	0xaff0	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x41aff8	0xaff8	0x8	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x41b000	0xb000	0x40	0x0	0x3	WA	0	0	16
.rld_map	PROGBITS	0x41b040	0xb040	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x41b050	0xb050	0xfc	0x4	0x10000003	WAp	0	0	16
.sdata	PROGBITS	0x41b14c	0xb14c	0x4	0x0	0x10000003	WAp	0	0	4
.bss	NOBITS	0x41b150	0xb150	0x4040	0x0	0x3	WA	0	0	16
.comment	PROGBITS	0x0	0xb150	0x25	0x1	0x30	MS	0	0	1
.pdr	PROGBITS	0x0	0xb178	0x4a0	0x0	0x0		0	0	4
.gnu.attributes	GNU_ATTRIBUTES	0x0	0xb618	0x10	0x0	0x0		0	0	1
.mdebug.abi32	PROGBITS	0x0	0xb628	0x0	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0xb628	0xae0	0x10	0x0		30	57	4
.strtab	STRTAB	0x0	0xc108	0x709	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0xc811	0x121	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
PHDR	0x34	0x400034	0x400034	0x160	0x160	2.4870	0x4	R	0x4
INTERP	0x194	0x400194	0x400194	0xd	0xd	3.2389	0x4	R	0x1	/lib/ld.so.1	.interp
ABIFLAGS	0x1a8	0x4001a8	0x4001a8	0x18	0x18	1.1387	0x4	R	0x8		.MIPS.abiflags
<unknown>	0x1c0	0x4001c0	0x4001c0	0x18	0x18	1.2220	0x4	R	0x4		.reginfo
LOAD	0x0	0x400000	0x400000	0xa804	0xa804	5.3126	0x5	R E	0x10000		.interp .MIPS.abiflags .reginfo .note.gnu.build-id .note.ABI-tag .dynamic .hash .dynsym .dynstr .gnu.version .gnu.version_r .init .text .MIPS.stubs .fini .rodata .eh_frame
LOAD	0xaff0	0x41aff0	0x41aff0	0x160	0x41a0	3.2377	0x6	RW	0x10000		.ctors .dtors .data .rld_map .got .sdata .bss
DYNAMIC	0x21c	0x40021c	0x40021c	0xe8	0xe8	2.7400	0x4	R	0x4		.dynamic
NOTE	0x1d8	0x4001d8	0x4001d8	0x44	0x44	3.3967	0x4	R	0x4		.note.gnu.build-id .note.ABI-tag
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x10
GNU_RELRO	0xaff0	0x41aff0	0x41aff0	0x10	0x10	1.0000	0x4	R	0x1		.ctors .dtors
NULL	0x0	0x0	0x0	0x0	0x0	0.0000	0x0		0x4

Dynamic Tags

Type	Meta	Value	Tag
DT_NEEDED	sharedlib	libc.so.6	0x1
DT_NEEDED	sharedlib	ld.so.1	0x1
DT_INIT	value	0x400ba4	0xc
DT_FINI	value	0x409780	0xd
DT_HASH	value	0x400304	0x4
DT_STRTAB	value	0x400878	0x5
DT_SYMTAB	value	0x400498	0x6
DT_STRSZ	bytes	574	0xa
DT_SYMENT	bytes	16	0xb
DT_MIPS_RLD_MAP	value	0x41b040	0x70000016
DT_MIPS_RLD_MAP_REL	value	0x1add4	0x70000035
DT_DEBUG	value	0x0	0x15
DT_PLTGOT	value	0x41b050	0x3
DT_MIPS_RLD_VERSION	value	0x1	0x70000001
DT_MIPS_FLAGS	value	0x2	0x70000005
DT_MIPS_BASE_ADDRESS	value	0x400000	0x70000006
DT_MIPS_LOCAL_GOTNO	value	0x6	0x7000000a
DT_MIPS_SYMTABNO	value	0x3e	0x70000011
DT_MIPS_UNREFEXTNO	value	0x1d	0x70000012
DT_MIPS_GOTSYM	value	0x5	0x70000013
DT_VERNEED	value	0x400b34	0x6ffffffe
DT_VERNEEDNUM	value	2	0x6fffffff
DT_VERSYM	value	0x400ab6	0x6ffffff0
DT_NULL	value	0x0	0x0

Symbols

Name	Version Info Name	Version Info File Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_DYNAMIC_LINKING			.dynsym	0x1	0	SECTION	<unknown>	DEFAULT	SHN_ABS
_IO_stdin_used			.dynsym	0x4097d0	4	OBJECT	<unknown>	DEFAULT	16
_ITM_deregisterTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_registerTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__RLD_MAP			.dynsym	0x41b040	0	OBJECT	<unknown>	DEFAULT	21
__errno_location	GLIBC_2.0	libc.so.6	.dynsym	0x409660	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__gmon_start__			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__libc_start_main	GLIBC_2.34	libc.so.6	.dynsym	0x409450	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__stack_chk_fail	GLIBC_2.4	libc.so.6	.dynsym	0x409520	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__stack_chk_guard	GLIBC_2.4	ld.so.1	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
_exit	GLIBC_2.0	libc.so.6	.dynsym	0x409470	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
access	GLIBC_2.0	libc.so.6	.dynsym	0x409680	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
atoi	GLIBC_2.0	libc.so.6	.dynsym	0x4096f0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
chdir	GLIBC_2.0	libc.so.6	.dynsym	0x409510	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
close	GLIBC_2.0	libc.so.6	.dynsym	0x409750	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
connect	GLIBC_2.0	libc.so.6	.dynsym	0x409730	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
exit	GLIBC_2.0	libc.so.6	.dynsym	0x4095c0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fcntl	GLIBC_2.28	libc.so.6	.dynsym	0x409650	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fork	GLIBC_2.0	libc.so.6	.dynsym	0x4096b0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free	GLIBC_2.0	libc.so.6	.dynsym	0x409490	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gethostbyname	GLIBC_2.0	libc.so.6	.dynsym	0x409720	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpid	GLIBC_2.0	libc.so.6	.dynsym	0x409590	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockname	GLIBC_2.0	libc.so.6	.dynsym	0x4096e0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockopt	GLIBC_2.0	libc.so.6	.dynsym	0x409540	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
htonl	GLIBC_2.0	libc.so.6	.dynsym	0x4096c0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
htons	GLIBC_2.0	libc.so.6	.dynsym	0x409530	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inet_addr	GLIBC_2.0	libc.so.6	.dynsym	0x409710	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inet_ntoa	GLIBC_2.0	libc.so.6	.dynsym	0x4094d0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ioctl	GLIBC_2.0	libc.so.6	.dynsym	0x409550	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
isspace	GLIBC_2.0	libc.so.6	.dynsym	0x4094b0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
kill	GLIBC_2.0	libc.so.6	.dynsym	0x4095d0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
main			.dynsym	0x408a78	2372	FUNC	<unknown>	DEFAULT	13
malloc	GLIBC_2.0	libc.so.6	.dynsym	0x4095a0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcpy	GLIBC_2.0	libc.so.6	.dynsym	0x4094a0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memmove	GLIBC_2.0	libc.so.6	.dynsym	0x409480	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memset	GLIBC_2.0	libc.so.6	.dynsym	0x409640	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ntohl	GLIBC_2.0	libc.so.6	.dynsym	0x4095b0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
open	GLIBC_2.0	libc.so.6	.dynsym	0x4095e0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rand	GLIBC_2.0	libc.so.6	.dynsym	0x409670	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
read	GLIBC_2.0	libc.so.6	.dynsym	0x409460	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recv	GLIBC_2.0	libc.so.6	.dynsym	0x409740	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
select	GLIBC_2.0	libc.so.6	.dynsym	0x409500	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
send	GLIBC_2.0	libc.so.6	.dynsym	0x409760	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sendto	GLIBC_2.0	libc.so.6	.dynsym	0x409690	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setsid	GLIBC_2.0	libc.so.6	.dynsym	0x4095f0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setsockopt	GLIBC_2.0	libc.so.6	.dynsym	0x409420	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
signal	GLIBC_2.0	libc.so.6	.dynsym	0x4094e0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sleep	GLIBC_2.0	libc.so.6	.dynsym	0x4094f0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
socket	GLIBC_2.0	libc.so.6	.dynsym	0x409700	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
srand	GLIBC_2.0	libc.so.6	.dynsym	0x409600	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strchr	GLIBC_2.0	libc.so.6	.dynsym	0x409610	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcmp	GLIBC_2.0	libc.so.6	.dynsym	0x409440	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcpy	GLIBC_2.0	libc.so.6	.dynsym	0x409580	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen	GLIBC_2.0	libc.so.6	.dynsym	0x409620	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strstr	GLIBC_2.0	libc.so.6	.dynsym	0x409430	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtok	GLIBC_2.0	libc.so.6	.dynsym	0x4096a0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
time	GLIBC_2.0	libc.so.6	.dynsym	0x4094c0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
toupper	GLIBC_2.0	libc.so.6	.dynsym	0x4096d0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
usleep	GLIBC_2.0	libc.so.6	.dynsym	0x409570	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
waitpid	GLIBC_2.0	libc.so.6	.dynsym	0x409560	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
write	GLIBC_2.0	libc.so.6	.dynsym	0x409630	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
			.symtab	0x400194	0	SECTION	<unknown>	DEFAULT	1
			.symtab	0x4001a8	0	SECTION	<unknown>	DEFAULT	2
			.symtab	0x4001c0	0	SECTION	<unknown>	DEFAULT	3
			.symtab	0x4001d8	0	SECTION	<unknown>	DEFAULT	4
	GLIBC_2.0	libc.so.6	.symtab	0x4001fc	0	SECTION	<unknown>	DEFAULT	5
	GLIBC_2.0	libc.so.6	.symtab	0x40021c	0	SECTION	<unknown>	DEFAULT	6
	GLIBC_2.0	libc.so.6	.symtab	0x400304	0	SECTION	<unknown>	DEFAULT	7
	GLIBC_2.0	libc.so.6	.symtab	0x400498	0	SECTION	<unknown>	DEFAULT	8
	GLIBC_2.0	libc.so.6	.symtab	0x400878	0	SECTION	<unknown>	DEFAULT	9
	GLIBC_2.0	libc.so.6	.symtab	0x400ab6	0	SECTION	<unknown>	DEFAULT	10
			.symtab	0x400b34	0	SECTION	<unknown>	DEFAULT	11
	GLIBC_2.0	libc.so.6	.symtab	0x400ba4	0	SECTION	<unknown>	DEFAULT	12
	GLIBC_2.0	libc.so.6	.symtab	0x400c20	0	SECTION	<unknown>	DEFAULT	13
	GLIBC_2.0	libc.so.6	.symtab	0x409420	0	SECTION	<unknown>	DEFAULT	14
	GLIBC_2.0	libc.so.6	.symtab	0x409780	0	SECTION	<unknown>	DEFAULT	15
	GLIBC_2.0	libc.so.6	.symtab	0x4097d0	0	SECTION	<unknown>	DEFAULT	16
	GLIBC_2.0	libc.so.6	.symtab	0x40a800	0	SECTION	<unknown>	DEFAULT	17
	GLIBC_2.0	libc.so.6	.symtab	0x41aff0	0	SECTION	<unknown>	DEFAULT	18
	GLIBC_2.0	libc.so.6	.symtab	0x41aff8	0	SECTION	<unknown>	DEFAULT	19
	GLIBC_2.0	libc.so.6	.symtab	0x41b000	0	SECTION	<unknown>	DEFAULT	20
	GLIBC_2.0	libc.so.6	.symtab	0x41b040	0	SECTION	<unknown>	DEFAULT	21
	GLIBC_2.0	libc.so.6	.symtab	0x41b050	0	SECTION	<unknown>	DEFAULT	22
	GLIBC_2.28	libc.so.6	.symtab	0x41b14c	0	SECTION	<unknown>	DEFAULT	23
	GLIBC_2.0	libc.so.6	.symtab	0x41b150	0	SECTION	<unknown>	DEFAULT	24
	GLIBC_2.0	libc.so.6	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	25
	GLIBC_2.0	libc.so.6	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	26
	GLIBC_2.0	libc.so.6	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	27
	GLIBC_2.0	libc.so.6	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	28
	GLIBC_2.0	libc.so.6	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
Q	GLIBC_2.0	libc.so.6	.symtab	0x41b184	16384	OBJECT	<unknown>	DEFAULT	24
SendSTD			.symtab	0x404924	472	FUNC	<unknown>	DEFAULT	13
SendSTDHEX			.symtab	0x403be4	496	FUNC	<unknown>	DEFAULT	13
SendSTD_HEX			.symtab	0x404ce0	544	FUNC	<unknown>	DEFAULT	13
SendUDP			.symtab	0x402e2c	1512	FUNC	<unknown>	DEFAULT	13
_DYNAMIC	GLIBC_2.0	libc.so.6	.symtab	0x40021c	0	OBJECT	<unknown>	DEFAULT	6
_DYNAMIC_LINKING			.symtab	0x1	0	SECTION	<unknown>	DEFAULT	SHN_ABS
_GLOBAL_OFFSET_TABLE_			.symtab	0x41b050	0	OBJECT	<unknown>	HIDDEN	22
_IO_stdin_used			.symtab	0x4097d0	4	OBJECT	<unknown>	DEFAULT	16
_ITM_deregisterTMCloneTable			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_registerTMCloneTable			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_MIPS_STUBS_	GLIBC_2.0	libc.so.6	.symtab	0x409420	0	FUNC	<unknown>	DEFAULT	14
__CTOR_END__	GLIBC_2.0	libc.so.6	.symtab	0x41aff4	0	OBJECT	<unknown>	DEFAULT	18
__CTOR_LIST__			.symtab	0x41aff0	0	OBJECT	<unknown>	DEFAULT	18
__DTOR_END__			.symtab	0x41affc	0	OBJECT	<unknown>	HIDDEN	19
__DTOR_LIST__	GLIBC_2.0	libc.so.6	.symtab	0x41aff8	0	OBJECT	<unknown>	DEFAULT	19
__FRAME_END__	GLIBC_2.4	libc.so.6	.symtab	0x40a800	0	OBJECT	<unknown>	DEFAULT	17
__RLD_MAP			.symtab	0x41b040	0	OBJECT	<unknown>	DEFAULT	21
__TMC_END__			.symtab	0x41b044	0	OBJECT	<unknown>	HIDDEN	21
__abi_tag	GLIBC_2.0	libc.so.6	.symtab	0x4001fc	32	OBJECT	<unknown>	DEFAULT	5
__bss_start			.symtab	0x41b150	0	NOTYPE	<unknown>	DEFAULT	24
__data_start			.symtab	0x41b000	0	NOTYPE	<unknown>	DEFAULT	20
__do_global_ctors_aux	GLIBC_2.0	libc.so.6	.symtab	0x4093c0	0	FUNC	<unknown>	DEFAULT	13
__do_global_dtors_aux	GLIBC_2.0	libc.so.6	.symtab	0x400d04	0	FUNC	<unknown>	DEFAULT	13
__dso_handle			.symtab	0x41b14c	0	OBJECT	<unknown>	HIDDEN	23
__errno_location@GLIBC_2.0			.symtab	0x409660	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__gmon_start__			.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__libc_start_main@GLIBC_2.34	GLIBC_2.0	libc.so.6	.symtab	0x409450	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__stack_chk_fail@GLIBC_2.4			.symtab	0x409520	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__stack_chk_guard@GLIBC_2.4			.symtab	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
__start			.symtab	0x400c20	0	FUNC	<unknown>	DEFAULT	13
_edata			.symtab	0x41b150	0	NOTYPE	<unknown>	DEFAULT	23
_end			.symtab	0x41f190	0	NOTYPE	<unknown>	DEFAULT	24
_exit@GLIBC_2.0			.symtab	0x409470	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_fbss			.symtab	0x41b150	0	NOTYPE	<unknown>	DEFAULT	24
_fdata			.symtab	0x41b000	0	NOTYPE	<unknown>	DEFAULT	20
_fini			.symtab	0x409780	0	FUNC	<unknown>	HIDDEN	15
_ftext			.symtab	0x400c20	0	NOTYPE	<unknown>	DEFAULT	13
_gp			.symtab	0x423040	0	NOTYPE	<unknown>	DEFAULT	22
_init			.symtab	0x400ba4	0	FUNC	<unknown>	HIDDEN	12
access@GLIBC_2.0			.symtab	0x409680	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
astd			.symtab	0x406464	492	FUNC	<unknown>	DEFAULT	13
atcp			.symtab	0x405c94	2000	FUNC	<unknown>	DEFAULT	13
atoi@GLIBC_2.0			.symtab	0x4096f0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
audp			.symtab	0x4054f0	1956	FUNC	<unknown>	DEFAULT	13
bot.c	GLIBC_2.0	libc.so.6	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
c	GLIBC_2.0	libc.so.6	.symtab	0x41b014	4	OBJECT	<unknown>	DEFAULT	20
chdir@GLIBC_2.0			.symtab	0x409510	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
close@GLIBC_2.0			.symtab	0x409750	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
commServer			.symtab	0x41b020	4	OBJECT	<unknown>	DEFAULT	20
completed.1	GLIBC_2.0	libc.so.6	.symtab	0x41b150	1	OBJECT	<unknown>	DEFAULT	24
connect@GLIBC_2.0			.symtab	0x409730	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
connectTimeout			.symtab	0x402560	872	FUNC	<unknown>	DEFAULT	13
crt1.o	GLIBC_2.0	libc.so.6	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	GLIBC_2.0	libc.so.6	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	GLIBC_2.0	libc.so.6	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum			.symtab	0x402ab0	312	FUNC	<unknown>	DEFAULT	13
currentServer			.symtab	0x41b010	4	OBJECT	<unknown>	DEFAULT	20
data_start			.symtab	0x41b000	0	NOTYPE	<unknown>	DEFAULT	20
deregister_tm_clones	GLIBC_2.0	libc.so.6	.symtab	0x400c80	0	FUNC	<unknown>	DEFAULT	13
dtor_idx.0	GLIBC_2.0	libc.so.6	.symtab	0x41b154	4	OBJECT	<unknown>	DEFAULT	24
exit@GLIBC_2.0			.symtab	0x4095c0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fcntl@GLIBC_2.28			.symtab	0x409650	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fdgets			.symtab	0x4010bc	240	FUNC	<unknown>	DEFAULT	13
fork@GLIBC_2.0			.symtab	0x4096b0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
frame_dummy	GLIBC_2.0	libc.so.6	.symtab	0x400db4	0	FUNC	<unknown>	DEFAULT	13
free@GLIBC_2.0			.symtab	0x409490	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ftcp			.symtab	0x403414	2000	FUNC	<unknown>	DEFAULT	13
getArch			.symtab	0x406650	40	FUNC	<unknown>	DEFAULT	13
getHost			.symtab	0x40207c	132	FUNC	<unknown>	DEFAULT	13
getOurIP			.symtab	0x4011ac	880	FUNC	<unknown>	DEFAULT	13
getPortz			.symtab	0x406678	316	FUNC	<unknown>	DEFAULT	13
getRandomIP			.symtab	0x401030	140	FUNC	<unknown>	DEFAULT	13
gethostbyname@GLIBC_2.0			.symtab	0x409720	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpid@GLIBC_2.0			.symtab	0x409590	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockname@GLIBC_2.0			.symtab	0x4096e0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockopt@GLIBC_2.0			.symtab	0x409540	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gotIP	GLIBC_2.0	libc.so.6	.symtab	0x41b164	4	OBJECT	<unknown>	DEFAULT	24
hlt	GLIBC_2.0	libc.so.6	.symtab	0x400c70	0	NOTYPE	<unknown>	DEFAULT	13
htonl@GLIBC_2.0			.symtab	0x4096c0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
htons@GLIBC_2.0			.symtab	0x409530	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
i.0	GLIBC_2.0	libc.so.6	.symtab	0x41b018	4	OBJECT	<unknown>	DEFAULT	20
inet_addr@GLIBC_2.0			.symtab	0x409710	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inet_ntoa@GLIBC_2.0			.symtab	0x4094d0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
initConnection			.symtab	0x408840	568	FUNC	<unknown>	DEFAULT	13
init_rand			.symtab	0x400dc0	260	FUNC	<unknown>	DEFAULT	13
ioctl@GLIBC_2.0			.symtab	0x409550	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
isspace@GLIBC_2.0			.symtab	0x4094b0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
kill@GLIBC_2.0			.symtab	0x4095d0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
listFork			.symtab	0x4028c8	488	FUNC	<unknown>	DEFAULT	13
macAddress			.symtab	0x41b17c	6	OBJECT	<unknown>	DEFAULT	24
main			.symtab	0x408a78	2372	FUNC	<unknown>	DEFAULT	13
mainCommSock			.symtab	0x41b160	4	OBJECT	<unknown>	DEFAULT	24
makeIPPacket			.symtab	0x402d50	220	FUNC	<unknown>	DEFAULT	13
makeRandomStr			.symtab	0x402100	176	FUNC	<unknown>	DEFAULT	13
makevsepacket			.symtab	0x403fa4	312	FUNC	<unknown>	DEFAULT	13
malloc@GLIBC_2.0			.symtab	0x4095a0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcpy@GLIBC_2.0			.symtab	0x4094a0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memmove@GLIBC_2.0			.symtab	0x409480	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memset@GLIBC_2.0			.symtab	0x409640	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ntohl@GLIBC_2.0			.symtab	0x4095b0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
numpids			.symtab	0x41b170	8	OBJECT	<unknown>	DEFAULT	24
open@GLIBC_2.0			.symtab	0x4095e0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ourIP			.symtab	0x41b178	4	OBJECT	<unknown>	DEFAULT	24
pids			.symtab	0x41b168	4	OBJECT	<unknown>	DEFAULT	24
print	GLIBC_2.0	libc.so.6	.symtab	0x401ac4	1092	FUNC	<unknown>	DEFAULT	13
printchar	GLIBC_2.0	libc.so.6	.symtab	0x401690	160	FUNC	<unknown>	DEFAULT	13
printi	GLIBC_2.4	ld.so.1	.symtab	0x4018b8	524	FUNC	<unknown>	DEFAULT	13
prints	GLIBC_2.0	libc.so.6	.symtab	0x401730	392	FUNC	<unknown>	DEFAULT	13
processCmd			.symtab	0x4067b4	8332	FUNC	<unknown>	DEFAULT	13
rand@GLIBC_2.0			.symtab	0x409670	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rand_cmwc			.symtab	0x400ec4	364	FUNC	<unknown>	DEFAULT	13
read@GLIBC_2.0			.symtab	0x409460	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recv@GLIBC_2.0			.symtab	0x409740	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recvLine			.symtab	0x4021b0	944	FUNC	<unknown>	DEFAULT	13
register_tm_clones	GLIBC_2.0	libc.so.6	.symtab	0x400cb8	0	FUNC	<unknown>	DEFAULT	13
rtcp			.symtab	0x404f00	1520	FUNC	<unknown>	DEFAULT	13
select@GLIBC_2.0			.symtab	0x409500	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
send@GLIBC_2.0			.symtab	0x409760	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sendto@GLIBC_2.0			.symtab	0x409690	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setsid@GLIBC_2.0			.symtab	0x4095f0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setsockopt@GLIBC_2.0	GLIBC_2.0	libc.so.6	.symtab	0x409420	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
signal@GLIBC_2.0			.symtab	0x4094e0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sleep@GLIBC_2.0			.symtab	0x4094f0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
socket@GLIBC_2.0			.symtab	0x409700	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
socket_connect			.symtab	0x403dd4	464	FUNC	<unknown>	DEFAULT	13
sockprintf			.symtab	0x401f08	372	FUNC	<unknown>	DEFAULT	13
srand@GLIBC_2.0			.symtab	0x409600	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
stdhexflood			.symtab	0x404afc	484	FUNC	<unknown>	DEFAULT	13
strchr@GLIBC_2.0			.symtab	0x409610	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcmp@GLIBC_2.0	GLIBC_2.0	libc.so.6	.symtab	0x409440	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcpy@GLIBC_2.0			.symtab	0x409580	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen@GLIBC_2.0			.symtab	0x409620	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strstr@GLIBC_2.0	GLIBC_2.34	libc.so.6	.symtab	0x409430	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtok@GLIBC_2.0			.symtab	0x4096a0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
tcpcsum			.symtab	0x402be8	360	FUNC	<unknown>	DEFAULT	13
time@GLIBC_2.0			.symtab	0x4094c0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
toupper@GLIBC_2.0			.symtab	0x4096d0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
trim			.symtab	0x40151c	372	FUNC	<unknown>	DEFAULT	13
useragents			.symtab	0x41b024	28	OBJECT	<unknown>	DEFAULT	20
usleep@GLIBC_2.0			.symtab	0x409570	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
vseattack			.symtab	0x4040dc	2120	FUNC	<unknown>	DEFAULT	13
waitpid@GLIBC_2.0			.symtab	0x409560	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
write@GLIBC_2.0			.symtab	0x409630	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 03:15:39.314950943 CET	48023	53	192.168.2.13	8.8.8.8
Jan 1, 2025 03:15:39.315016985 CET	43950	53	192.168.2.13	8.8.8.8
Jan 1, 2025 03:15:39.321417093 CET	53	43950	8.8.8.8	192.168.2.13
Jan 1, 2025 03:15:39.321681023 CET	53	48023	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 03:15:39.314950943 CET	192.168.2.13	8.8.8.8	0x137d	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 03:15:39.315016985 CET	192.168.2.13	8.8.8.8	0x4480	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 03:15:39.321681023 CET	8.8.8.8	192.168.2.13	0x137d	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 1, 2025 03:15:39.321681023 CET	8.8.8.8	192.168.2.13	0x137d	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: 89.250.72.36-mips-2024-12-31T13_33_10.elf PID: 5411, Parent PID: 5335

General

Start time (UTC):	02:12:53
Start date (UTC):	01/01/2025
Path:	/tmp/89.250.72.36-mips-2024-12-31T13_33_10.elf
Arguments:	/tmp/89.250.72.36-mips-2024-12-31T13_33_10.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 89.250.72.36-mips-2024-12-31T13_33_10.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Threatname: Gafgyt

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Dynamic Tags

Symbols

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: 89.250.72.36-mips-2024-12-31T13_33_10.elf PID: 5411, Parent PID: 5335

General

Chronological Activities

Linux Analysis Report
89.250.72.36-mips-2024-12-31T13_33_10.elf