Edit tour

Linux Analysis Report
wev86.elf

Overview

General Information

Sample name:	wev86.elf
Analysis ID:	1588024
MD5:	31d6db8bba6407d7f4826efecf6a75e1
SHA1:	3f9313fbdf0a77e62eea1da88dc7444f6eda0305
SHA256:	73b224ca0b265b966bab0a5e12a56c5ad724d8be7e45375937829dc40b763f9f
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588024
Start date and time:	2025-01-10 20:39:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wev86.elf
Detection:	MAL
Classification:	mal72.spre.troj.evad.linELF@0/78@31/0

Warnings

VT rate limit hit for: ofewu.eye-network.ru

Runtime Messages

Command:	/tmp/wev86.elf
PID:	6236
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6205, Parent: 4331)

rm (PID: 6205, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.7OzeGxu9uG /tmp/tmp.rTiqnPwGif /tmp/tmp.QsXQTQZKfD

dash New Fork (PID: 6206, Parent: 4331)

rm (PID: 6206, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.7OzeGxu9uG /tmp/tmp.rTiqnPwGif /tmp/tmp.QsXQTQZKfD

wev86.elf (PID: 6236, Parent: 6129, MD5: 31d6db8bba6407d7f4826efecf6a75e1) Arguments: /tmp/wev86.elf

wev86.elf New Fork (PID: 6237, Parent: 6236)

wev86.elf New Fork (PID: 6238, Parent: 6237)

wev86.elf New Fork (PID: 6239, Parent: 6237)

wev86.elf New Fork (PID: 6240, Parent: 6237)

systemd New Fork (PID: 6262, Parent: 1)

rsyslogd (PID: 6262, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 6263, Parent: 2063)

wrapper-2.0 (PID: 6263, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6264, Parent: 2063)

wrapper-2.0 (PID: 6264, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6265, Parent: 2063)

wrapper-2.0 (PID: 6265, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6266, Parent: 2063)

wrapper-2.0 (PID: 6266, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 6291, Parent: 6266)

xfpm-power-backlight-helper (PID: 6291, Parent: 6266, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6267, Parent: 2063)

wrapper-2.0 (PID: 6267, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

systemd New Fork (PID: 6268, Parent: 1)

rsyslogd (PID: 6268, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 6269, Parent: 2063)

wrapper-2.0 (PID: 6269, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 6290, Parent: 6289)

xfconfd (PID: 6290, Parent: 6289, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 6314, Parent: 1)

rsyslogd (PID: 6314, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6320, Parent: 1)

rsyslogd (PID: 6320, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6325, Parent: 1)

rsyslogd (PID: 6325, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6334, Parent: 1)

rsyslogd (PID: 6334, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6338, Parent: 1)

rsyslogd (PID: 6338, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6344, Parent: 1)

rsyslogd (PID: 6344, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6348, Parent: 1)

rsyslogd (PID: 6348, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6354, Parent: 1)

rsyslogd (PID: 6354, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6360, Parent: 1)

rsyslogd (PID: 6360, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6364, Parent: 1)

rsyslogd (PID: 6364, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6370, Parent: 1)

rsyslogd (PID: 6370, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6376, Parent: 1)

rsyslogd (PID: 6376, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6381, Parent: 1)

rsyslogd (PID: 6381, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6389, Parent: 1)

rsyslogd (PID: 6389, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6393, Parent: 1)

rsyslogd (PID: 6393, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6399, Parent: 1)

rsyslogd (PID: 6399, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6405, Parent: 1)

rsyslogd (PID: 6405, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6409, Parent: 1)

rsyslogd (PID: 6409, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6415, Parent: 1)

rsyslogd (PID: 6415, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6421, Parent: 1)

rsyslogd (PID: 6421, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6425, Parent: 1)

rsyslogd (PID: 6425, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6431, Parent: 1)

rsyslogd (PID: 6431, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6436, Parent: 1)

rsyslogd (PID: 6436, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6442, Parent: 1)

rsyslogd (PID: 6442, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6448, Parent: 1)

rsyslogd (PID: 6448, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6452, Parent: 1)

rsyslogd (PID: 6452, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6458, Parent: 1)

rsyslogd (PID: 6458, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6464, Parent: 1)

rsyslogd (PID: 6464, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6468, Parent: 1)

rsyslogd (PID: 6468, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6474, Parent: 1)

rsyslogd (PID: 6474, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6480, Parent: 1)

rsyslogd (PID: 6480, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6484, Parent: 1)

rsyslogd (PID: 6484, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6493, Parent: 1)

rsyslogd (PID: 6493, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6497, Parent: 1)

rsyslogd (PID: 6497, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6503, Parent: 1)

rsyslogd (PID: 6503, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6509, Parent: 1)

rsyslogd (PID: 6509, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6513, Parent: 1)

rsyslogd (PID: 6513, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6519, Parent: 1)

rsyslogd (PID: 6519, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6520, Parent: 1)

rsyslogd (PID: 6520, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wev86.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x3fd0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
wev86.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x8915:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
wev86.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x6462:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
wev86.elf	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
wev86.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xbb49:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
wev86.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa10b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
wev86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x6432:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6240.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x3fd0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6240.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x8915:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
6240.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x6462:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6240.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6240.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xbb49:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6240.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa10b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6240.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x6432:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6239.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x3fd0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6239.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x8915:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
6239.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x6462:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6239.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6239.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xbb49:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6239.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa10b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6239.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x6432:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6236.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x3fd0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6236.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x8915:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
6236.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x6462:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6236.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6236.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xbb49:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6236.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xa10b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6236.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x6432:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 16 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: wev86.elf	Virustotal: Detection: 28%			Perma Link
Source: wev86.elf	ReversingLabs: Detection: 34%

Machine Learning detection for sample

Source: wev86.elf

Joe Sandbox ML: detected

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: ofewu.eye-network.ru. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:50012 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:41284 -> 141.98.10.40:33966

Source: /usr/sbin/rsyslogd (PID: 6268)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6314)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6320)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6325)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6334)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6338)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6344)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6348)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6354)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6360)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6364)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6370)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6376)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6381)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6389)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6393)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6399)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6405)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6409)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6415)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6421)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6425)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6431)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6436)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6442)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6448)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6452)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6458)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6464)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6468)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6474)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6480)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6484)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6493)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6497)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6503)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6509)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6513)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6520)	Reads hosts file: /etc/hosts	Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: ofewu.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: ofewu.eye-network.ru. [malformed]

Source: syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.118.dr, syslog.44.dr, syslog.102.dr, syslog.86.dr, syslog.110.dr, syslog.82.dr, syslog.76.dr, syslog.100.dr, syslog.52.dr, syslog.98.dr, syslog.92.dr, syslog.62.dr, syslog.74.dr, syslog.114.dr, syslog.68.dr, syslog.104.dr, syslog.78.dr, syslog.50.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/wev86.elf (PID: 6237)	SIGKILL sent: pid: 6239, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6240, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6262, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6263, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6264, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6265, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6266, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6267, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6268, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6269, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6314, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6320, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6325, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6334, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6338, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6344, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6348, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6354, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6360, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6364, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6370, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6376, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6381, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6389, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6393, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6399, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6405, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6409, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6415, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6421, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6425, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6431, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6436, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6442, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6448, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6452, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6464, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6468, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6474, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6480, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6484, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6493, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6497, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6503, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6509, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6513, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6519, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /proc/EOF/proc/%d/exe/proc/%d/stat/proc/%d/mapssys_monitor_cnrbusyboxadbddockerdBlink_Cloudsystemdhttpsshdbashmsg_centerlte_mgrmain_mgrpkarm7pkarm5pkarmpkarm6pkmipspkmpslpkx86/var/mnt/root/boot/sbin/home/dev/media/opt/../(deleted)sh4[0clKillerKillerEXE] Killed process: %s, PID: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/wev86.elf (PID: 6237)	SIGKILL sent: pid: 6239, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6240, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6262, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6263, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6264, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6265, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6266, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6267, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6268, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6269, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6314, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6320, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6325, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6334, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6338, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6344, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6348, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6354, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6360, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6364, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6370, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6376, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6381, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6389, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6393, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6399, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6405, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6409, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6415, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6421, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6425, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6431, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6436, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6442, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6448, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6452, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6464, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6468, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6474, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6480, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6484, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6493, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6497, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6503, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6509, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6513, result: successful	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	SIGKILL sent: pid: 6519, result: successful	Jump to behavior

Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: wev86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6240.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6239.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6236.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal72.spre.troj.evad.linELF@0/78@31/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6263)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6264)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6265)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6266)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6267)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6267)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6267)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6267)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6269)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6290)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6290)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6290)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6290)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/wev86.elf (PID: 6238)	File opened: /proc/15/stat	Jump to behavior

Source: /usr/bin/dash (PID: 6205)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.7OzeGxu9uG /tmp/tmp.rTiqnPwGif /tmp/tmp.QsXQTQZKfD			Jump to behavior
Source: /usr/bin/dash (PID: 6206)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.7OzeGxu9uG /tmp/tmp.rTiqnPwGif /tmp/tmp.QsXQTQZKfD			Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6268)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6314)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6320)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6325)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6334)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6338)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6344)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6348)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6354)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6360)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6364)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6370)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6376)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6381)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6389)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6393)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6399)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6405)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6409)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6415)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6421)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6425)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6431)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6436)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6442)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6448)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6452)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6458)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6464)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6468)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6474)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6480)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6484)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6493)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6497)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6503)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6509)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6513)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6520)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/wev86.elf (PID: 6237)

File: /tmp/wev86.elf

Jump to behavior

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6263)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6264)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6265)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6266)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6267)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6268)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6269)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6314)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6320)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6325)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6334)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6338)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6344)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6348)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6354)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6360)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6364)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6370)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6376)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6381)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6389)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6393)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6399)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6405)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6409)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6415)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6421)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6425)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6431)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6436)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6442)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6448)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6452)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6458)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6464)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6468)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6474)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6480)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6484)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6493)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6497)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6503)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6509)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6513)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6520)	Queries kernel information via 'uname':	Jump to behavior

Source: wev86.elf, 6240.1.00000000096c5000.00000000096ca000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.3.logog
Source: wev86.elf, 6240.1.00000000fff80000.00000000fffa1000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.3.log
Source: wev86.elf, 6240.1.00000000096c5000.00000000096ca000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.log1298b2b1298b2b
Source: wev86.elf, 6240.1.00000000096c5000.00000000096ca000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_721-4290559889
Source: wev86.elf, 6240.1.00000000fff80000.00000000fffa1000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.1.log
Source: wev86.elf, 6240.1.00000000096c5000.00000000096ca000.rw-.sdmp	Binary or memory string: vmware-vmtoolsd-root.log
Source: wev86.elf, 6240.1.00000000fff80000.00000000fffa1000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.log1298b2b
Source: wev86.elf, 6240.1.00000000096c5000.00000000096ca000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.2.logog
Source: wev86.elf, 6240.1.00000000096c5000.00000000096ca000.rw-.sdmp	Binary or memory string: vmware-vmtoolsd-root.logrivalogriva
Source: wev86.elf, 6240.1.00000000fff80000.00000000fffa1000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.log
Source: wev86.elf, 6240.1.00000000fff80000.00000000fffa1000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.2.log
Source: wev86.elf, 6240.1.00000000096c5000.00000000096ca000.rw-.sdmp	Binary or memory string: !/var/log/gdm3 a/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-resolved.service-AfPZzgQ/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f.)/tmp/vmware-root_721-4290559889

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 File Deletion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wev86.elf	28%	Virustotal		Browse
wev86.elf	34%	ReversingLabs	Linux.Backdoor.Mirai
wev86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ofewu.eye-network.ru	141.98.10.40	true	true		unknown
ofewu.eye-network.ru. [malformed]	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.118.dr, syslog.44.dr, syslog.102.dr, syslog.86.dr, syslog.110.dr, syslog.82.dr, syslog.76.dr, syslog.100.dr, syslog.52.dr, syslog.98.dr, syslog.92.dr, syslog.62.dr, syslog.74.dr, syslog.114.dr, syslog.68.dr, syslog.104.dr, syslog.78.dr, syslog.50.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
141.98.10.40	ofewu.eye-network.ru	Lithuania	209605	HOSTBALTICLT	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
89.190.156.145	vevhea4.elf	Get hash	malicious	Unknown	Browse
	fqkjei686.elf	Get hash	malicious	Unknown	Browse
	wrjkngh4.elf	Get hash	malicious	Unknown	Browse
	vevhea4.elf	Get hash	malicious	Unknown	Browse
	qbfwdbg.elf	Get hash	malicious	Unknown	Browse
	wlw68k.elf	Get hash	malicious	Unknown	Browse
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse
	ngwa5.elf	Get hash	malicious	Unknown	Browse
	debvps.elf	Get hash	malicious	Unknown	Browse
141.98.10.40	DOC11042024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	vyebetsh.sa.com/nMcrGmhC252.bin
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	main_arm5.elf	Get hash	malicious	Mirai	Browse
	Space.i686.elf	Get hash	malicious	Unknown	Browse
	frosty.arm7.elf	Get hash	malicious	Mirai	Browse
	frosty.mips.elf	Get hash	malicious	Mirai	Browse
	frosty.m68k.elf	Get hash	malicious	Mirai	Browse
	Space.arc.elf	Get hash	malicious	Mirai	Browse
	main_arm7.elf	Get hash	malicious	Mirai	Browse
	main_sh4.elf	Get hash	malicious	Mirai	Browse
	Space.spc.elf	Get hash	malicious	Mirai	Browse
	Space.ppc.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	vevhea4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	fqkjei686.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wrjkngh4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	vevhea4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	qbfwdbg.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	ngwa5.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	debvps.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
CANONICAL-ASGB	main_arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.i686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	frosty.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	frosty.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	frosty.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.arm6.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	main_arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.i686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	frosty.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	frosty.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	frosty.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.arm6.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
HOSTBALTICLT	vevhea4.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse	141.98.10.40
	uYtea.sh4.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.ppc.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.x86.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.arm.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.mips.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.mpsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.arm7.elf	Get hash	malicious	Mirai	Browse	141.98.10.115
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	141.98.10.88
INIT7CH	main_arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.i686.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	frosty.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	frosty.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	frosty.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.spc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.ppc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	799
Entropy (8bit):	4.714616224856724
Encrypted:	false
SSDEEP:	12:xtFUTZGMtFUINtFUkFStFUOB+yZtFUVLtFUkkV8ptFUeMtFUrjAI1qqu+MtFU7Aa:xg4dIC8f5yuVU9VpedrjAIUt+d7AIUtk
MD5:	1D5D59C71FAF08566CF8BC36DC23B47A
SHA1:	4B6A189DD466B66FF8E2B02C286271A862836C7F
SHA-256:	367F1A398DC8E9BFE44FCB011AC5C8C47CDB61348F66DB9FEAF25FBA07D8E276
SHA-512:	A4B1386AB3B03F38A7E136B7A57FABD899C3262B5CDDE88182BF2F576FE76F74B659EC56AE10E221022B9BB780E1A01B4278FF8EBB5BD20DC0E26C51BE3E5AD8
Malicious:	false
Reputation:	low
Preview:	Jan 10 13:42:38 galassia kernel: [ 535.236613] blocking signal 9: 6238 -> 1320.Jan 10 13:42:38 galassia kernel: [ 535.325962] blocking signal 9: 6238 -> 658.Jan 10 13:42:38 galassia kernel: [ 535.335268] blocking signal 9: 6238 -> 772.Jan 10 13:42:38 galassia kernel: [ 535.349677] blocking signal 9: 6238 -> 800.Jan 10 13:42:38 galassia kernel: [ 535.360294] blocking signal 9: 6238 -> 847.Jan 10 13:42:38 galassia kernel: [ 535.378828] blocking signal 9: 6238 -> 936.Jan 10 13:42:38 galassia kernel: [ 535.402034] blocking signal 9: 6238 -> 1320.Jan 10 13:42:38 galassia kernel: [ 535.918625] New task spawned: old: (tgid 6520, tid 6520), new (tgid: 6520, tid: 6521).Jan 10 13:42:38 galassia kernel: [ 535.918782] New task spawned: old: (tgid 6520, tid 6520), new (tgid: 6520, tid: 6522).

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	5.043091519923136
Encrypted:	false
SSDEEP:	48:xL31DwPIRB31+PVRyOD+kuyBsr9Ut+dVUtKZ3Xh:8IROVRTt+gtSx
MD5:	0F2C31BF957A5C7628B1F03450E10EDD
SHA1:	73D4E97BEA3928647C161AAEBB7E125C4B808A70
SHA-256:	A807585C74A018F1DD097DD3B2C0198ED5B8DFA73D75E953752C05AF77AE3C3C
SHA-512:	940C8EBE653B5528F9BA182301C75C0136F09277A7D18A1B9E08E386576C6D175AF9F95D286321474B9C6F51263A13BEBE2D69B6E4A923AD25F3E2210D654E48
Malicious:	false
Reputation:	low
Preview:	Jan 10 13:42:37 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 10 13:42:37 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 10 13:42:37 galassia systemd[1]: systemd-udevd.service: Got notification message from PID 6041, but reception is disabled..Jan 10 13:42:37 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 40..Jan 10 13:42:37 galassia systemd[1]: Stopped System Logging Service..Jan 10 13:42:37 galassia systemd[1]: Starting System Logging Service....Jan 10 13:42:37 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 10 13:42:37 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 10 13:42:37 galassia systemd[1]: Failed to start System Logging Service..Jan 10 13:42:37 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 41..Jan 10 13:42:37 galassia systemd[1]: Stopped System Logging Service..Jan 10 13:

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.621525677730349
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	wev86.elf
File size:	101'128 bytes
MD5:	31d6db8bba6407d7f4826efecf6a75e1
SHA1:	3f9313fbdf0a77e62eea1da88dc7444f6eda0305
SHA256:	73b224ca0b265b966bab0a5e12a56c5ad724d8be7e45375937829dc40b763f9f
SHA512:	a6876a11487709ddbe475f8cb707ab872f7619585dbceebbe143774560de2a2890620c54a63b7ee2ca1430af07f6553752b90fe710c11c6d12f8a5bf3ced95c7
SSDEEP:	1536:3n/WmvInTVfDam4v4ukAYLia7l00G4otXNKeV+TnvBNfAAlySyS5cNby:3/WmvO4wFRG4ozKbnJNzbS+
TLSH:	D6A36DC4E783D8F9E89700B11177E7738733E4395029DE86C769D932ACA2911DA3A76C
File Content Preview:	.ELF....................d...4...x.......4. ...(.....................SA..SA..............XA..X...X....G..............Q.td............................U..S........P...h........[]...$.............U......=@....t..5...................u........t....hT...........

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	100728
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x10aa6	0x0	0x6	AX	16
.fini	PROGBITS	0x8058b56	0x10b56	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8058b80	0x10b80	0x35d3	0x0	0x2	A	32
.ctors	PROGBITS	0x805d158	0x14158	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x805d164	0x14164	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805d180	0x14180	0x47b8	0x0	0x3	WA	32
.bss	NOBITS	0x8061940	0x18938	0xc90c	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x18938	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x14153	0x14153	6.3926	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x14158	0x805d158	0x805d158	0x47e0	0x110f4	0.4156	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:40:33.787349939 CET	41284	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:33.796885014 CET	53	41284	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:33.796998024 CET	54210	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:33.803904057 CET	53	54210	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:33.803976059 CET	34857	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:33.810146093 CET	53	34857	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:33.810213089 CET	56409	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:33.816344976 CET	53	56409	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:33.816411018 CET	46356	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:33.822818041 CET	53	46356	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:33.822890043 CET	44778	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:33.830024958 CET	53	44778	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:56.221653938 CET	50174	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:56.228051901 CET	53	50174	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:56.228157997 CET	51673	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:56.234321117 CET	53	51673	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:56.234394073 CET	46501	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:56.240770102 CET	53	46501	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:56.240874052 CET	40600	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:56.247266054 CET	53	40600	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:56.247344017 CET	57849	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:56.253648043 CET	53	57849	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:56.253770113 CET	57556	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:56.259886980 CET	53	57556	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:56.259958029 CET	49409	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:56.266561985 CET	53	49409	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:56.266675949 CET	49094	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:56.272872925 CET	53	49094	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:56.272934914 CET	35396	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:56.279122114 CET	53	35396	8.8.8.8	192.168.2.23
Jan 10, 2025 20:40:56.279189110 CET	39330	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:40:56.285609007 CET	53	39330	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:18.656816006 CET	53799	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:18.662921906 CET	53	53799	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:18.663206100 CET	54081	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:18.670698881 CET	53	54081	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:18.670779943 CET	60412	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:18.677170038 CET	53	60412	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:18.677320957 CET	51859	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:18.683583021 CET	53	51859	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:18.683686018 CET	32895	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:18.690042973 CET	53	32895	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:18.690778017 CET	59086	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:18.696986914 CET	53	59086	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:18.697149038 CET	55246	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:18.703506947 CET	53	55246	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:18.703612089 CET	37813	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:18.710010052 CET	53	37813	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:18.710117102 CET	54278	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:18.716551065 CET	53	54278	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:18.716706991 CET	37471	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:18.723001957 CET	53	37471	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:41.111329079 CET	54025	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:41.117676973 CET	53	54025	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:41.117770910 CET	58939	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:41.124067068 CET	53	58939	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:41.124119997 CET	59881	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:41.130542040 CET	53	59881	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:41.130594969 CET	56796	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:41.136629105 CET	53	56796	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:41.136686087 CET	42655	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:41.143251896 CET	53	42655	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:41.143335104 CET	46977	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:41.149580002 CET	53	46977	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:41.149646997 CET	33744	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:41.155858994 CET	53	33744	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:41.155972958 CET	38582	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:41.162399054 CET	53	38582	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:41.162463903 CET	38760	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:41.168704987 CET	53	38760	8.8.8.8	192.168.2.23
Jan 10, 2025 20:41:41.168773890 CET	41153	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:41:41.175005913 CET	53	41153	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:03.530776024 CET	52204	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:03.537328005 CET	53	52204	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:03.537442923 CET	47042	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:03.545424938 CET	53	47042	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:03.545506954 CET	33651	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:03.552299023 CET	53	33651	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:03.552386999 CET	49246	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:03.558692932 CET	53	49246	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:03.558775902 CET	39448	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:03.565215111 CET	53	39448	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:03.565311909 CET	53444	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:03.571582079 CET	53	53444	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:03.571655989 CET	41158	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:03.577958107 CET	53	41158	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:03.578036070 CET	52283	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:03.584279060 CET	53	52283	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:03.584352970 CET	49085	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:03.591106892 CET	53	49085	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:03.591176987 CET	48643	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:03.598397970 CET	53	48643	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:25.989829063 CET	38373	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:25.996273041 CET	53	38373	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:25.996382952 CET	36239	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:26.002639055 CET	53	36239	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:26.002712011 CET	42180	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:26.009234905 CET	53	42180	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:26.009308100 CET	53671	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:26.015506029 CET	53	53671	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:26.015599966 CET	34523	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:26.022124052 CET	53	34523	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:26.022202015 CET	52783	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:26.028896093 CET	53	52783	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:26.029002905 CET	56919	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:26.035427094 CET	53	56919	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:26.035499096 CET	39709	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:26.042177916 CET	53	39709	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:26.042263031 CET	56070	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:26.049093962 CET	53	56070	8.8.8.8	192.168.2.23
Jan 10, 2025 20:42:26.049170017 CET	39196	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:42:26.056099892 CET	53	39196	8.8.8.8	192.168.2.23

Start time (UTC):	19:40:27
Start date (UTC):	10/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	19:40:33
Start date (UTC):	10/01/2025
Path:	/tmp/wev86.elf
Arguments:	/tmp/wev86.elf
File size:	101128 bytes
MD5 hash:	31d6db8bba6407d7f4826efecf6a75e1

Start time (UTC):	19:40:42
Start date (UTC):	10/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	19:40:41
Start date (UTC):	10/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	19:40:45
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:40:48
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:40:50
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:40:53
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:40:55
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:40:59
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:00
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:03
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:06
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:09
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:12
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wev86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: dash PID: 6205, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6205, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6206, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6206, Parent PID: 4331

General

Chronological Activities

Analysis Process: wev86.elf PID: 6236, Parent PID: 6129

General

Chronological Activities

Linux Analysis Report
wev86.elf

Start time (UTC):	19:41:15
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:19
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:22
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:25
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:28
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:31
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:34
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:37
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:41
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:41:44
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75