Edit tour

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.m68k.elf

Overview

General Information

Sample name:	ub8ehJSePAfc9FYqZIT6.m68k.elf
Analysis ID:	1583847
MD5:	e1adc5b708ea95cf726be8b5ca79ad85
SHA1:	2173ce03fc89c5b47c3376abf58193bd441198cf
SHA256:	dca32783ebbbc476651fea7d7ea8ce5bff3c2f03e5723c49a5d80cb6505f86b6
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Yara detected Mirai

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583847
Start date and time:	2025-01-03 18:32:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ub8ehJSePAfc9FYqZIT6.m68k.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/0@0/0

Warnings

VT rate limit hit for: ub8ehJSePAfc9FYqZIT6.m68k.elf

Runtime Messages

Command:	/tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf
PID:	5506
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506, Parent: 5429, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf

ub8ehJSePAfc9FYqZIT6.m68k.elf New Fork (PID: 5508, Parent: 5506)

ub8ehJSePAfc9FYqZIT6.m68k.elf New Fork (PID: 5510, Parent: 5508)

ub8ehJSePAfc9FYqZIT6.m68k.elf New Fork (PID: 5511, Parent: 5508)

ub8ehJSePAfc9FYqZIT6.m68k.elf New Fork (PID: 5520, Parent: 5506)

ub8ehJSePAfc9FYqZIT6.m68k.elf New Fork (PID: 5522, Parent: 5506)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ub8ehJSePAfc9FYqZIT6.m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
ub8ehJSePAfc9FYqZIT6.m68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x151af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15213:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15227:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1523b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1524f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15263:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15277:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1528b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1529f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15303:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15317:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1532b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1533f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5510.1.00007f7d68001000.00007f7d68019000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5510.1.00007f7d68001000.00007f7d68019000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x151af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15213:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15227:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1523b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1524f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15263:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15277:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1528b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1529f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15303:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15317:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1532b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1533f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5508.1.00007f7d68001000.00007f7d68019000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5508.1.00007f7d68001000.00007f7d68019000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x151af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15213:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15227:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1523b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1524f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15263:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15277:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1528b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1529f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15303:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15317:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1532b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1533f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5506.1.00007f7d68001000.00007f7d68019000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5506.1.00007f7d68001000.00007f7d68019000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x151af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15213:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15227:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1523b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1524f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15263:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15277:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1528b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1529f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15303:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15317:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1532b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1533f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5520.1.00007f7d68001000.00007f7d68019000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5520.1.00007f7d68001000.00007f7d68019000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x151af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x151ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15213:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15227:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1523b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1524f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15263:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15277:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1528b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1529f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x152ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15303:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15317:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1532b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1533f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5506	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5506	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xcc67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcc7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcc8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcca3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xccb7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcccb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xccdf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xccf3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcda7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcdbb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcdcf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcde3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcdf7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5508	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5508	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x5001:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5015:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5029:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x503d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5051:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5065:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5079:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x508d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x50a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x50b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x50c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x50dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x50f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5105:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5119:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x512d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5141:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5155:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5169:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x517d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5191:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5510	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5510	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x49b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a7a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4a8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4aa2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ab6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4aca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ade:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4af2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4b42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5520	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5520	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xcc57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcc6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcc7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcc93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcca7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xccbb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcccf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcce3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xccf7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcdab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcdbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcdd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcde7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ub8ehJSePAfc9FYqZIT6.m68k.elf

Avira: detected

Source: global traffic

TCP traffic: 192.168.2.14:47620 -> 141.11.33.73:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73

System Summary

Malicious sample detected (through community Yara rule)

Source: ub8ehJSePAfc9FYqZIT6.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5510.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5508.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5506.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5520.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5506, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5508, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5510, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5520, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /proc/net/tcp.x86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppc/proc/proc/%d/exe/proc/%s/statusName:%s/bin/busybox/bin/systemd/usr/bintest/tmp/condi/tmp/zxcr9999/tmp/condinetwork/var/condibot/var/zxcr9999/var/CondiBot/var/condinet/bin/watchdog141.11.33.73

Source: ELF static info symbol of initial sample

.symtab present: no

Source: ub8ehJSePAfc9FYqZIT6.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5510.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5508.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5506.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5520.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5506, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5508, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5510, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5520, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.troj.linELF@0/0@0/0

Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/1583/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/2672/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/1577/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/1593/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/3094/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/3406/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/1589/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/3402/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/801/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/806/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/807/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/928/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/135/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/1599/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/3412/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/35/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/1371/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/260/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/261/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/262/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/142/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/263/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/264/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)	File opened: /proc/265/status	Jump to behavior

Source: /tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf (PID: 5506)

Queries kernel information via 'uname':

Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.m68k.elf, 5506.1.0000564fc4644000.0000564fc46cc000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.m68k.elf, 5508.1.0000564fc4644000.0000564fc46a8000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.m68k.elf, 5510.1.0000564fc4644000.0000564fc46a8000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.m68k.elf, 5520.1.0000564fc4644000.0000564fc46cc000.rw-.sdmp	Binary or memory string: OV!/etc/qemu-binfmt/m68k
Source: ub8ehJSePAfc9FYqZIT6.m68k.elf, 5506.1.00007ffe11343000.00007ffe11364000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.m68k.elf, 5508.1.00007ffe11343000.00007ffe11364000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.m68k.elf, 5510.1.00007ffe11343000.00007ffe11364000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.m68k.elf, 5520.1.00007ffe11343000.00007ffe11364000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: ub8ehJSePAfc9FYqZIT6.m68k.elf, 5506.1.0000564fc4644000.0000564fc46cc000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.m68k.elf, 5508.1.0000564fc4644000.0000564fc46a8000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.m68k.elf, 5510.1.0000564fc4644000.0000564fc46a8000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.m68k.elf, 5520.1.0000564fc4644000.0000564fc46cc000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: ub8ehJSePAfc9FYqZIT6.m68k.elf, 5506.1.00007ffe11343000.00007ffe11364000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.m68k.elf, 5508.1.00007ffe11343000.00007ffe11364000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.m68k.elf, 5510.1.00007ffe11343000.00007ffe11364000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.m68k.elf, 5520.1.00007ffe11343000.00007ffe11364000.rw-.sdmp	Binary or memory string: =x86_64/usr/bin/qemu-m68k/tmp/ub8ehJSePAfc9FYqZIT6.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: ub8ehJSePAfc9FYqZIT6.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5510.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5508.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5506.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5520.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5506, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5510, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5520, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: ub8ehJSePAfc9FYqZIT6.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5510.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5508.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5506.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5520.1.00007f7d68001000.00007f7d68019000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5506, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5510, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5520, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ub8ehJSePAfc9FYqZIT6.m68k.elf	100%	Avira	LINUX/Mirai.bonb

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.11.33.73	unknown	United Kingdom		553	BELWUEBelWue-KoordinationEU	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
141.11.33.73	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BELWUEBelWue-KoordinationEU	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	141.11.33.73
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	Hilix.mips.elf	Get hash	malicious	Mirai	Browse	134.155.120.154
	armv5l.elf	Get hash	malicious	Unknown	Browse	141.79.218.248
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	134.34.202.108
	kwari.arm7.elf	Get hash	malicious	Mirai	Browse	134.155.120.139
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	141.79.120.12
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	141.59.77.71

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.276122833341005
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ub8ehJSePAfc9FYqZIT6.m68k.elf
File size:	97'552 bytes
MD5:	e1adc5b708ea95cf726be8b5ca79ad85
SHA1:	2173ce03fc89c5b47c3376abf58193bd441198cf
SHA256:	dca32783ebbbc476651fea7d7ea8ce5bff3c2f03e5723c49a5d80cb6505f86b6
SHA512:	1bb84eabb75eaed197f4137e15da192ce6be31bcfe6b72c97b3d10ab5ad4f4c4bd7cd975ab5768fd60dd897976765b71222c63c79372e9d107abedc690687bea
SSDEEP:	1536:ry9srCNMjSKtNpGXnwzX8/EqXabQeuacWjcW0JcWcBl4rZpipI4WlV/N4zfVZol+:ryqrzjSKkOXqqbQeuacWjcW0JcWcBSru
TLSH:	729329C7F811ED7EF80BD67748A34D0E7571F2A00A930A227767BA67EC760A5141BD82
File Content Preview:	.ELF.......................D...4..{......4. ...(......................x...x....... .......x............x..*....... .dt.Q............................NV..a....da...P N^NuNV..J9...@f>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy....N.X........@N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	97152
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x1504a	0x0	0x6	AX	4
.fini	PROGBITS	0x800150f2	0x150f2	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x80015100	0x15100	0x27c1	0x0	0x2	A	2
.ctors	PROGBITS	0x800198c8	0x178c8	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x800198d0	0x178d0	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x800198dc	0x178dc	0x264	0x0	0x3	WA	4
.bss	NOBITS	0x80019b40	0x17b40	0x2818	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x17b40	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x178c1	0x178c1	6.2917	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x178c8	0x800198c8	0x800198c8	0x278	0x2a90	3.6517	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 18:32:56.494976997 CET	47620	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:32:56.499895096 CET	3778	47620	141.11.33.73	192.168.2.14
Jan 3, 2025 18:32:56.499948025 CET	47620	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:32:56.529397011 CET	47620	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:32:56.534194946 CET	3778	47620	141.11.33.73	192.168.2.14
Jan 3, 2025 18:32:56.534240961 CET	47620	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:32:56.538985968 CET	3778	47620	141.11.33.73	192.168.2.14
Jan 3, 2025 18:32:57.532974958 CET	3778	47620	141.11.33.73	192.168.2.14
Jan 3, 2025 18:32:57.533365965 CET	47620	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:32:57.533582926 CET	47620	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:32:57.535684109 CET	47622	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:32:57.540405035 CET	3778	47622	141.11.33.73	192.168.2.14
Jan 3, 2025 18:32:57.540477037 CET	47622	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:32:57.548374891 CET	47622	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:32:57.553162098 CET	3778	47622	141.11.33.73	192.168.2.14
Jan 3, 2025 18:32:57.553215027 CET	47622	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:32:57.557950020 CET	3778	47622	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:00.072135925 CET	3778	47622	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:00.072330952 CET	47622	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:00.072431087 CET	47622	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:00.072983027 CET	47624	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:00.077816963 CET	3778	47624	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:00.077877998 CET	47624	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:00.078634024 CET	47624	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:00.083404064 CET	3778	47624	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:00.083477974 CET	47624	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:00.088221073 CET	3778	47624	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:01.095663071 CET	3778	47624	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:01.095818043 CET	47624	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:01.095845938 CET	47624	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:01.096381903 CET	47626	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:01.101116896 CET	3778	47626	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:01.101183891 CET	47626	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:01.101871967 CET	47626	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:01.106592894 CET	3778	47626	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:01.106646061 CET	47626	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:01.111394882 CET	3778	47626	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:02.101871014 CET	47628	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:02.106628895 CET	3778	47628	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:02.106682062 CET	47628	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:02.149086952 CET	47628	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:02.153944969 CET	3778	47628	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:02.153994083 CET	47628	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:02.158751011 CET	3778	47628	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:03.127656937 CET	3778	47628	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:03.127994061 CET	47628	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:03.127994061 CET	47628	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:03.128609896 CET	47630	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:03.133409977 CET	3778	47630	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:03.133471012 CET	47630	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:03.134423018 CET	47630	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:03.139209032 CET	3778	47630	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:03.139260054 CET	47630	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:03.144089937 CET	3778	47630	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:05.468892097 CET	3778	47626	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:05.469069958 CET	47626	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:05.469101906 CET	47626	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:05.469757080 CET	47632	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:05.474517107 CET	3778	47632	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:05.474586010 CET	47632	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:05.475333929 CET	47632	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:05.480113983 CET	3778	47632	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:05.480163097 CET	47632	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:05.484913111 CET	3778	47632	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:09.533196926 CET	3778	47632	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:09.533318043 CET	47632	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:09.533365965 CET	47632	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:09.534081936 CET	47634	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:09.542098999 CET	3778	47634	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:09.542176962 CET	47634	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:09.543247938 CET	47634	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:09.548726082 CET	3778	47634	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:09.548782110 CET	47634	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:09.554476023 CET	3778	47634	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:10.566484928 CET	3778	47634	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:10.566734076 CET	47634	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:10.566847086 CET	47634	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:10.567502022 CET	47636	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:10.572338104 CET	3778	47636	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:10.572433949 CET	47636	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:10.573497057 CET	47636	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:10.578248978 CET	3778	47636	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:10.578353882 CET	47636	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:10.583172083 CET	3778	47636	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:11.620042086 CET	3778	47636	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:11.620318890 CET	47636	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:11.620318890 CET	47636	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:11.621068954 CET	47638	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:11.625853062 CET	3778	47638	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:11.625952005 CET	47638	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:11.626842976 CET	47638	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:11.631620884 CET	3778	47638	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:11.631680965 CET	47638	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:11.636518955 CET	3778	47638	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:12.667926073 CET	3778	47638	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:12.668277025 CET	47638	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:12.668277025 CET	47638	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:12.669013977 CET	47640	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:12.673898935 CET	3778	47640	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:12.673959970 CET	47640	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:12.674643993 CET	47640	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:12.679466009 CET	3778	47640	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:12.679510117 CET	47640	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:12.684250116 CET	3778	47640	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:13.144196987 CET	47630	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.342330933 CET	3778	47630	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:13.342657089 CET	47630	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.342681885 CET	47630	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.343111038 CET	3778	47630	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:13.343257904 CET	47630	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.343447924 CET	47642	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.348227978 CET	3778	47642	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:13.348289967 CET	47642	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.349224091 CET	47642	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.353979111 CET	3778	47642	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:13.354042053 CET	47642	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.359011889 CET	3778	47642	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:13.707696915 CET	3778	47640	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:13.708003998 CET	47640	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.708003998 CET	47640	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.708597898 CET	47644	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.713376999 CET	3778	47644	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:13.713588953 CET	47644	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.714713097 CET	47644	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.719575882 CET	3778	47644	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:13.719683886 CET	47644	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:13.724483967 CET	3778	47644	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:14.371376038 CET	3778	47642	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:14.371630907 CET	47642	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:14.371654987 CET	47642	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:14.372369051 CET	47646	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:14.377186060 CET	3778	47646	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:14.377284050 CET	47646	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:14.378251076 CET	47646	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:14.384313107 CET	3778	47646	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:14.384428024 CET	47646	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:14.390481949 CET	3778	47646	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:23.724536896 CET	47644	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:23.729424000 CET	3778	47644	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:24.496875048 CET	3778	47644	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:24.497026920 CET	47644	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:24.497026920 CET	47644	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:24.497518063 CET	47648	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:24.502296925 CET	3778	47648	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:24.502361059 CET	47648	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:24.503006935 CET	47648	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:24.507746935 CET	3778	47648	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:24.507795095 CET	47648	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:24.512653112 CET	3778	47648	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:28.531527996 CET	3778	47648	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:28.531706095 CET	47648	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:28.531725883 CET	47648	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:28.532327890 CET	47650	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:28.537098885 CET	3778	47650	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:28.537172079 CET	47650	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:28.537975073 CET	47650	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:28.542726040 CET	3778	47650	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:28.542805910 CET	47650	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:28.547568083 CET	3778	47650	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:29.578619003 CET	3778	47650	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:29.578824997 CET	47650	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:29.578851938 CET	47650	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:29.579508066 CET	47652	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:29.584342003 CET	3778	47652	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:29.584402084 CET	47652	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:29.585505009 CET	47652	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:29.590271950 CET	3778	47652	141.11.33.73	192.168.2.14
Jan 3, 2025 18:33:29.590320110 CET	47652	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:33:29.595138073 CET	3778	47652	141.11.33.73	192.168.2.14
Jan 3, 2025 18:34:14.425580025 CET	47646	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:34:14.430450916 CET	3778	47646	141.11.33.73	192.168.2.14
Jan 3, 2025 18:34:15.431977987 CET	3778	47646	141.11.33.73	192.168.2.14
Jan 3, 2025 18:34:15.432313919 CET	47646	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:34:29.643450022 CET	47652	3778	192.168.2.14	141.11.33.73
Jan 3, 2025 18:34:29.648159981 CET	3778	47652	141.11.33.73	192.168.2.14
Jan 3, 2025 18:34:30.029243946 CET	3778	47652	141.11.33.73	192.168.2.14
Jan 3, 2025 18:34:30.029465914 CET	47652	3778	192.168.2.14	141.11.33.73

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5506, Parent PID: 5429

General

Start time (UTC):	17:32:55
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf
Arguments:	/tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5508, Parent PID: 5506

General

Start time (UTC):	17:32:55
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5510, Parent PID: 5508

General

Start time (UTC):	17:32:55
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5511, Parent PID: 5508

General

Start time (UTC):	17:32:55
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5520, Parent PID: 5506

General

Start time (UTC):	17:33:00
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5522, Parent PID: 5506

General

Start time (UTC):	17:33:00
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ub8ehJSePAfc9FYqZIT6.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5506, Parent PID: 5429

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5508, Parent PID: 5506

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5510, Parent PID: 5508

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5511, Parent PID: 5508

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5520, Parent PID: 5506

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.m68k.elf PID: 5522, Parent PID: 5506

General

Chronological Activities

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.m68k.elf