Edit tour

Linux Analysis Report
ngwa5.elf

Overview

General Information

Sample name:	ngwa5.elf
Analysis ID:	1588028
MD5:	de35399ca5e5a0279e81f8684f881ef5
SHA1:	e650270eb095c3bcd46b584a7362ebed2072a976
SHA256:	2af4488381adf88522c2b490c0ee889dda0f581bc5626b0eb8117e6e451138a1
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588028
Start date and time:	2025-01-10 20:45:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ngwa5.elf
Detection:	MAL
Classification:	mal60.spre.troj.evad.linELF@0/83@31/0

Warnings

VT rate limit hit for: ofewu.eye-network.ru. [malformed]

Runtime Messages

Command:	/tmp/ngwa5.elf
PID:	6245
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

ngwa5.elf (PID: 6245, Parent: 6168, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/ngwa5.elf

ngwa5.elf New Fork (PID: 6247, Parent: 6245)

ngwa5.elf New Fork (PID: 6249, Parent: 6247)

ngwa5.elf New Fork (PID: 6250, Parent: 6247)

ngwa5.elf New Fork (PID: 6252, Parent: 6247)

systemd New Fork (PID: 6274, Parent: 1)

rsyslogd (PID: 6274, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 6275, Parent: 2063)

wrapper-2.0 (PID: 6275, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6278, Parent: 2063)

wrapper-2.0 (PID: 6278, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6281, Parent: 2063)

wrapper-2.0 (PID: 6281, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6282, Parent: 2063)

wrapper-2.0 (PID: 6282, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-panel New Fork (PID: 6283, Parent: 2063)

wrapper-2.0 (PID: 6283, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

systemd New Fork (PID: 6284, Parent: 1)

rsyslogd (PID: 6284, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 6285, Parent: 2063)

wrapper-2.0 (PID: 6285, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 6298, Parent: 6297)

xfconfd (PID: 6298, Parent: 6297, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 6319, Parent: 1)

rsyslogd (PID: 6319, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6325, Parent: 1)

rsyslogd (PID: 6325, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6331, Parent: 1)

rsyslogd (PID: 6331, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6336, Parent: 1)

rsyslogd (PID: 6336, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6342, Parent: 1)

rsyslogd (PID: 6342, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6348, Parent: 1)

rsyslogd (PID: 6348, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6353, Parent: 1)

rsyslogd (PID: 6353, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6359, Parent: 1)

rsyslogd (PID: 6359, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6360, Parent: 1)

rsyslogd (PID: 6360, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6366, Parent: 1)

rsyslogd (PID: 6366, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6370, Parent: 1)

rsyslogd (PID: 6370, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6376, Parent: 1)

rsyslogd (PID: 6376, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6382, Parent: 1)

rsyslogd (PID: 6382, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6387, Parent: 1)

rsyslogd (PID: 6387, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6393, Parent: 1)

rsyslogd (PID: 6393, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6399, Parent: 1)

rsyslogd (PID: 6399, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6405, Parent: 1)

rsyslogd (PID: 6405, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6411, Parent: 1)

rsyslogd (PID: 6411, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6415, Parent: 1)

rsyslogd (PID: 6415, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6421, Parent: 1)

rsyslogd (PID: 6421, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6427, Parent: 1)

rsyslogd (PID: 6427, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6431, Parent: 1)

rsyslogd (PID: 6431, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6437, Parent: 1)

rsyslogd (PID: 6437, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6444, Parent: 1)

rsyslogd (PID: 6444, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6448, Parent: 1)

rsyslogd (PID: 6448, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6454, Parent: 1)

rsyslogd (PID: 6454, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6458, Parent: 1)

rsyslogd (PID: 6458, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6461, Parent: 1)

rsyslogd (PID: 6461, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6465, Parent: 1)

rsyslogd (PID: 6465, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6471, Parent: 1)

rsyslogd (PID: 6471, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6475, Parent: 1)

rsyslogd (PID: 6475, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6481, Parent: 1)

rsyslogd (PID: 6481, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6487, Parent: 1)

rsyslogd (PID: 6487, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6492, Parent: 1)

rsyslogd (PID: 6492, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6498, Parent: 1)

rsyslogd (PID: 6498, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6504, Parent: 1)

rsyslogd (PID: 6504, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6510, Parent: 1)

rsyslogd (PID: 6510, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6516, Parent: 1)

rsyslogd (PID: 6516, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6520, Parent: 1)

rsyslogd (PID: 6520, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6526, Parent: 1)

rsyslogd (PID: 6526, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6532, Parent: 1)

rsyslogd (PID: 6532, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6536, Parent: 1)

rsyslogd (PID: 6536, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ngwa5.elf	Virustotal: Detection: 26%			Perma Link
Source: ngwa5.elf	ReversingLabs: Detection: 31%

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: ofewu.eye-network.ru. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:50022 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:41292 -> 141.98.10.40:33966

Source: /usr/sbin/rsyslogd (PID: 6284)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6319)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6325)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6331)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6336)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6342)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6348)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6353)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6359)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6360)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6366)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6370)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6376)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6382)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6387)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6393)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6399)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6405)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6411)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6415)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6421)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6427)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6431)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6437)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6444)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6448)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6454)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6461)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6465)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6471)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6475)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6481)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6487)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6492)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6498)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6504)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6510)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6516)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6520)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6526)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6532)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6536)	Reads hosts file: /etc/hosts	Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: ofewu.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: ofewu.eye-network.ru. [malformed]

Source: syslog.48.dr, syslog.84.dr, syslog.118.dr, syslog.44.dr, syslog.102.dr, syslog.86.dr, syslog.110.dr, syslog.82.dr, syslog.76.dr, syslog.30.dr, syslog.100.dr, syslog.52.dr, syslog.98.dr, syslog.92.dr, syslog.36.dr, syslog.62.dr, syslog.74.dr, syslog.114.dr, syslog.68.dr, syslog.104.dr, syslog.78.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/ngwa5.elf (PID: 6247)	SIGKILL sent: pid: 6250, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6252, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6275, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6281, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6282, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6283, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6284, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6285, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6298, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6319, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6325, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6331, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6336, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6342, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6348, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6353, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6359, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6360, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6366, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6370, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6376, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6382, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6387, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6393, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6399, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6405, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6411, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6415, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6421, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6427, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6431, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6437, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6444, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6448, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6454, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6461, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6465, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6471, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6475, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6481, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6487, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6492, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6498, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6504, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6510, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6516, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6520, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6526, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6532, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: sys_monitor_cnrbusyboxadbddockerdBlink_Cloudsystemdhttpshsshdbashmsg_centerlte_mgrmain_mgrpkarm7pkarm5pkarmpkarm6pkmipspkmpslpkx86/tmp/var/mnt/root/boot/sbin/home/dev/media/opt/../(deleted)x86armmipsmpslsh4arm5arm6%s/%s/data/local/tmp/bin/dev/null/dev/console/var/lib/dockerofewu.eye-network.ruabcdefghijklmnopqrstuvwxyz/proc/%d/cmdline/proc/%d/proc/selfhttpd/proc/self/exe

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/ngwa5.elf (PID: 6247)	SIGKILL sent: pid: 6250, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6252, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6275, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6281, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6282, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6283, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6284, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6285, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6298, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6319, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6325, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6331, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6336, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6342, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6348, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6353, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6359, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6360, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6366, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6370, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6376, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6382, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6387, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6393, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6399, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6405, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6411, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6415, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6421, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6427, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6431, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6437, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6444, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6448, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6454, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6461, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6465, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6471, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6475, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6481, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6487, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6492, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6498, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6504, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6510, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6516, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6520, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6526, result: successful	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	SIGKILL sent: pid: 6532, result: successful	Jump to behavior

Source: classification engine

Classification label: mal60.spre.troj.evad.linELF@0/83@31/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6283)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6285)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6298)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6298)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6298)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6298)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/6227/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/6227/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/6227/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/6228/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/6228/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/6228/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/ngwa5.elf (PID: 6249)	File opened: /proc/13/stat	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6284)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6319)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6325)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6331)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6336)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6342)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6348)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6353)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6360)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6366)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6370)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6376)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6382)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6387)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6393)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6399)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6405)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6411)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6415)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6421)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6427)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6431)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6437)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6444)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6448)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6454)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6461)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6465)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6471)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6475)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6481)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6487)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6492)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6498)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6504)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6510)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6516)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6520)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6526)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6532)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6536)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/ngwa5.elf (PID: 6247)

File: /tmp/ngwa5.elf

Jump to behavior

Source: /tmp/ngwa5.elf (PID: 6245)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6274)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6283)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6284)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6285)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6319)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6325)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6331)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6336)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6342)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6348)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6353)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6359)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6360)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6366)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6370)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6376)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6382)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6387)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6393)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6399)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6405)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6411)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6415)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6421)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6427)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6431)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6437)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6444)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6448)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6454)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6461)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6465)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6471)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6475)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6481)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6487)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6492)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6498)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6504)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6510)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6516)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6520)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6526)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6532)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6536)	Queries kernel information via 'uname':	Jump to behavior

Source: ngwa5.elf, 6252.1.00005614893a4000.00005614893c9000.rw-.sdmp	Binary or memory string: /arm/tmp/vmware-root_721-4290559889
Source: ngwa5.elf, 6252.1.00007fef7004f000.00007fef70055000.rw-.sdmp	Binary or memory string: vmware-vmtoolsd-root.logc795logc795
Source: ngwa5.elf, 6252.1.0000561489276000.00005614893a4000.rw-.sdmp	Binary or memory string: !/data/local/tmp1/tmp/vmware-root_721-4290559889
Source: ngwa5.elf, 6252.1.00005614893a4000.00005614893c9000.rw-.sdmp	Binary or memory string: V/arm/tmp/vmware-root_721-4290559889a/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-c4RYFiervicea/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-c4RYFi/tmp.sa/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-timedated.service-NziX6fs
Source: ngwa5.elf, 6252.1.00007fef7004f000.00007fef70055000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.1.logog{
Source: ngwa5.elf, 6252.1.00007fef7004f000.00007fef70055000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.3.log
Source: ngwa5.elf, 6245.1.00007fffdc5cb000.00007fffdc5ec000.rw-.sdmp, ngwa5.elf, 6250.1.00007fffdc5cb000.00007fffdc5ec000.rw-.sdmp, ngwa5.elf, 6252.1.00007fffdc5cb000.00007fffdc5ec000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/ngwa5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ngwa5.elf
Source: ngwa5.elf, 6252.1.00007fef7004f000.00007fef70055000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.3.loguy
Source: ngwa5.elf, 6252.1.0000561489276000.00005614893a4000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_721-4290559889
Source: ngwa5.elf, 6252.1.00007fef7004f000.00007fef70055000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.1.log
Source: ngwa5.elf, 6245.1.00007fffdc5cb000.00007fffdc5ec000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.X8eO2n
Source: syslog.30.dr	Binary or memory string: Jan 10 13:45:54 galassia kernel: [ 419.517462] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: ngwa5.elf, 6245.1.0000561489276000.00005614893a4000.rw-.sdmp, ngwa5.elf, 6250.1.0000561489276000.00005614893a4000.rw-.sdmp, ngwa5.elf, 6252.1.0000561489276000.00005614893a4000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: ngwa5.elf, 6245.1.0000561489276000.00005614893a4000.rw-.sdmp, ngwa5.elf, 6250.1.0000561489276000.00005614893a4000.rw-.sdmp, ngwa5.elf, 6252.1.0000561489276000.00005614893a4000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: ngwa5.elf, 6245.1.00007fffdc5cb000.00007fffdc5ec000.rw-.sdmp, ngwa5.elf, 6250.1.00007fffdc5cb000.00007fffdc5ec000.rw-.sdmp, ngwa5.elf, 6252.1.00007fffdc5cb000.00007fffdc5ec000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: ngwa5.elf, 6252.1.00007fef7004f000.00007fef70055000.rw-.sdmp	Binary or memory string: vmware-vmtoolsd-root.log
Source: ngwa5.elf, 6252.1.00007fef7004f000.00007fef70055000.rw-.sdmp	Binary or memory string: \/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj/tmp$/tmp/vmware-root_721-4290559889P/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-x0xO0i4/tmp/ssh-hOQ5FjG2iVgO4
Source: ngwa5.elf, 6252.1.00007fef7004f000.00007fef70055000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.log519e4c5519e4c5
Source: ngwa5.elf, 6252.1.00007fef7004f000.00007fef70055000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.log
Source: syslog.30.dr	Binary or memory string: Jan 10 13:45:54 galassia kernel: [ 419.517486] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: ngwa5.elf, 6252.1.00007fef7004f000.00007fef70055000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.2.log
Source: ngwa5.elf, 6245.1.00007fffdc5cb000.00007fffdc5ec000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.X8eO2n:

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ngwa5.elf	27%	Virustotal		Browse
ngwa5.elf	32%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ofewu.eye-network.ru	141.98.10.40	true	false		high
ofewu.eye-network.ru. [malformed]	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.48.dr, syslog.84.dr, syslog.118.dr, syslog.44.dr, syslog.102.dr, syslog.86.dr, syslog.110.dr, syslog.82.dr, syslog.76.dr, syslog.30.dr, syslog.100.dr, syslog.52.dr, syslog.98.dr, syslog.92.dr, syslog.36.dr, syslog.62.dr, syslog.74.dr, syslog.114.dr, syslog.68.dr, syslog.104.dr, syslog.78.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
141.98.10.40	ofewu.eye-network.ru	Lithuania	209605	HOSTBALTICLT	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
89.190.156.145	debvps.elf	Get hash	malicious	Unknown	Browse
	wev86.elf	Get hash	malicious	Unknown	Browse
	vevhea4.elf	Get hash	malicious	Unknown	Browse
	fqkjei686.elf	Get hash	malicious	Unknown	Browse
	wrjkngh4.elf	Get hash	malicious	Unknown	Browse
	vevhea4.elf	Get hash	malicious	Unknown	Browse
	qbfwdbg.elf	Get hash	malicious	Unknown	Browse
	wlw68k.elf	Get hash	malicious	Unknown	Browse
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse
141.98.10.40	DOC11042024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	vyebetsh.sa.com/nMcrGmhC252.bin
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	wev86.elf	Get hash	malicious	Unknown	Browse
	main_arm5.elf	Get hash	malicious	Mirai	Browse
	Space.i686.elf	Get hash	malicious	Unknown	Browse
	frosty.arm7.elf	Get hash	malicious	Mirai	Browse
	frosty.mips.elf	Get hash	malicious	Mirai	Browse
	frosty.m68k.elf	Get hash	malicious	Mirai	Browse
	Space.arc.elf	Get hash	malicious	Mirai	Browse
	main_arm7.elf	Get hash	malicious	Mirai	Browse
	main_sh4.elf	Get hash	malicious	Mirai	Browse
	Space.spc.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ofewu.eye-network.ru	debvps.elf	Get hash	malicious	Unknown	Browse	141.98.10.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	debvps.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wev86.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	vevhea4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	fqkjei686.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wrjkngh4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	vevhea4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	qbfwdbg.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
CANONICAL-ASGB	wev86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.i686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	frosty.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	frosty.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	frosty.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.arm6.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
HOSTBALTICLT	debvps.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	wev86.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	vevhea4.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse	141.98.10.40
	uYtea.sh4.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.ppc.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.x86.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.arm.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.mips.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.mpsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
INIT7CH	wev86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	main_arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.i686.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	frosty.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	frosty.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	frosty.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.spc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.X8eO2n (deleted)

Download File

Process:	/tmp/ngwa5.elf
File Type:	data
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.0536606896881855
Encrypted:	false
SSDEEP:	3:TgOQLc8HJN:TgZJN
MD5:	AC250E3F00CC16907E0D589F2DC53826
SHA1:	C3458BAC504BEC0C4984AC81CB405E3FA8A96257
SHA-256:	9A16E706CBABA4731AF89B10A86B099D0F4FDD20140FBEEBFB27AFF963B03953
SHA-512:	CE0732E2BD36BEAE0158C7BEB599F222C0ACB3618BE2EC3EA7C32E17AE258CCD0E1626CA5DACA727C64EC060FFB3F20274F94929AE0D2D239981F7C168BE2797
Malicious:	false
Reputation:	low
Preview:	/tmp/ngwa5.elf.nwlrbbmqbh

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	799
Entropy (8bit):	4.721509399420724
Encrypted:	false
SSDEEP:	24:xTy5vqy52Ry5N0y5AVeBy5xKVDy55Gy5Bqy5AjAIOusy5UAIOy:xmNxhTkXbrOtIj
MD5:	95C7933486CAFE94148344B7861A7ED0
SHA1:	0E82C5A01E689554B8E619089925CF9EFEFD2A63
SHA-256:	A3DA541C549DBCE4E06261FE083A3ADF939189916B1D75F2DE58DA425C0EC7CF
SHA-512:	F173F1EA09DC0BC09386CA7B0D584AF09160FFC0156E64BBFAE6505EB6650E1847CE83438875788DB4A35485B774AA12911BEC64BE48D094F6C95FAAED5375F1
Malicious:	false
Reputation:	low
Preview:	Jan 10 13:47:57 galassia kernel: [ 543.430996] blocking signal 9: 6249 -> 1320.Jan 10 13:47:57 galassia kernel: [ 543.495778] blocking signal 9: 6249 -> 658.Jan 10 13:47:57 galassia kernel: [ 543.503627] blocking signal 9: 6249 -> 772.Jan 10 13:47:57 galassia kernel: [ 543.512628] blocking signal 9: 6249 -> 800.Jan 10 13:47:57 galassia kernel: [ 543.521756] blocking signal 9: 6249 -> 847.Jan 10 13:47:57 galassia kernel: [ 543.530104] blocking signal 9: 6249 -> 936.Jan 10 13:47:57 galassia kernel: [ 543.537567] blocking signal 9: 6249 -> 1320.Jan 10 13:47:57 galassia kernel: [ 543.733653] New task spawned: old: (tgid 6536, tid 6536), new (tgid: 6536, tid: 6537).Jan 10 13:47:57 galassia kernel: [ 543.734117] New task spawned: old: (tgid 6536, tid 6536), new (tgid: 6536, tid: 6538).

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1828
Entropy (8bit):	5.055306338139883
Encrypted:	false
SSDEEP:	24:xTO3PDZy5vqy52Ry5N0y5AVeBy5xKVDy55Gy5Bqy5AjAIOusy5UAIOiO0hubeBRY:xS3INxhTkXbrOtIwwsVPsHRX/b5Ah
MD5:	3DF1C480B6F301A2D4CA623A5885585F
SHA1:	F1557665E5CE1DB9B9C02300F5AA957B7070C096
SHA-256:	92E31B34CC5BAA17FB4637144A7C36FB29BFDCDE65B1E5C0162A490B2DA7F12E
SHA-512:	868B20CC2AC3043A1E15E2AFFE96AC80C98B598C84F2B5207753F222524F7B9B912B0546A0BF939FC31B2D5640D1BC23FEEBE4574AA113E7A31893E44B56D231
Malicious:	false
Reputation:	low
Preview:	Jan 10 13:47:57 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 10 13:47:57 galassia kernel: [ 543.430996] blocking signal 9: 6249 -> 1320.Jan 10 13:47:57 galassia kernel: [ 543.495778] blocking signal 9: 6249 -> 658.Jan 10 13:47:57 galassia kernel: [ 543.503627] blocking signal 9: 6249 -> 772.Jan 10 13:47:57 galassia kernel: [ 543.512628] blocking signal 9: 6249 -> 800.Jan 10 13:47:57 galassia kernel: [ 543.521756] blocking signal 9: 6249 -> 847.Jan 10 13:47:57 galassia kernel: [ 543.530104] blocking signal 9: 6249 -> 936.Jan 10 13:47:57 galassia kernel: [ 543.537567] blocking signal 9: 6249 -> 1320.Jan 10 13:47:57 galassia kernel: [ 543.733653] New task spawned: old: (tgid 6536, tid 6536), new (tgid: 6536, tid: 6537).Jan 10 13:47:57 galassia kernel: [ 543.734117] New task spawned: old: (tgid 6536, tid 6536), new (tgid: 6536, tid: 6538).Jan 10 13:47:57 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 10 13:47:57

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.397575911661548
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ngwa5.elf
File size:	142'144 bytes
MD5:	de35399ca5e5a0279e81f8684f881ef5
SHA1:	e650270eb095c3bcd46b584a7362ebed2072a976
SHA256:	2af4488381adf88522c2b490c0ee889dda0f581bc5626b0eb8117e6e451138a1
SHA512:	665020b803744dbc197c941374b3c25696026f60ae2e619f70612e87dd706118f936712a8770fcd58e50171757b2d42aae018b49affcb3bdaa57f4c2551660e7
SSDEEP:	1536:xEYRH9HK+hcCwXc5Q2xhr4Vt30TyWXcFnnvxOthrijO4FqAlhmwyw8/uBwhxxvK5:xEYrp75Qu4L0O8cFn0cOw9hrF
TLSH:	23D30945F8419B63C6D612BBFB9E428D772A1768D3EE32039D256F20379785B0E3B142
File Content Preview:	.ELF...a..........(.........4....)......4. ...(..................... ... ...........................pI..............Q.td..................................-...L."....h..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	141744
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x1a338	0x0	0x6	AX	16
.fini	PROGBITS	0x223e8	0x1a3e8	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x223fc	0x1a3fc	0x3a24	0x0	0x2	A	4
.ctors	PROGBITS	0x2e000	0x1e000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x2e00c	0x1e00c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2e020	0x1e020	0x4950	0x0	0x3	WA	32
.bss	NOBITS	0x32970	0x22970	0xc598	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x22970	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1de20	0x1de20	5.8998	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x1e000	0x2e000	0x2e000	0x4970	0x10f08	0.4520	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:45:53.368696928 CET	36856	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:45:53.378448963 CET	53	36856	8.8.8.8	192.168.2.23
Jan 10, 2025 20:45:53.391493082 CET	55200	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:45:53.397907019 CET	53	55200	8.8.8.8	192.168.2.23
Jan 10, 2025 20:45:53.408037901 CET	58116	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:45:53.414300919 CET	53	58116	8.8.8.8	192.168.2.23
Jan 10, 2025 20:45:53.416564941 CET	35918	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:45:53.422844887 CET	53	35918	8.8.8.8	192.168.2.23
Jan 10, 2025 20:45:53.436605930 CET	49512	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:45:53.442771912 CET	53	49512	8.8.8.8	192.168.2.23
Jan 10, 2025 20:45:53.483422041 CET	52043	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:45:53.489681959 CET	53	52043	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:15.976865053 CET	48846	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:15.983284950 CET	53	48846	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:15.984222889 CET	41699	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:15.990905046 CET	53	41699	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:15.991831064 CET	45604	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:15.999356985 CET	53	45604	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:16.000420094 CET	53263	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:16.007424116 CET	53	53263	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:16.008322954 CET	50624	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:16.014719009 CET	53	50624	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:16.015712023 CET	33991	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:16.022620916 CET	53	33991	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:16.023605108 CET	45625	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:16.031173944 CET	53	45625	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:16.032309055 CET	51774	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:16.038875103 CET	53	51774	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:16.039839983 CET	47149	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:16.047230005 CET	53	47149	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:16.048341990 CET	52168	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:16.055032015 CET	53	52168	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:38.427527905 CET	43629	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:38.433898926 CET	53	43629	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:38.435199976 CET	54627	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:38.441550016 CET	53	54627	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:38.442796946 CET	37082	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:38.449189901 CET	53	37082	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:38.450366974 CET	57708	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:38.456763029 CET	53	57708	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:38.458049059 CET	52325	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:38.464390039 CET	53	52325	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:38.465672016 CET	52342	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:38.471787930 CET	53	52342	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:38.473480940 CET	40465	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:38.479793072 CET	53	40465	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:38.480953932 CET	43935	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:38.487265110 CET	53	43935	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:38.488392115 CET	54722	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:38.494801998 CET	53	54722	8.8.8.8	192.168.2.23
Jan 10, 2025 20:46:38.496032953 CET	56611	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:46:38.502360106 CET	53	56611	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:00.916555882 CET	37783	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:00.922688007 CET	53	37783	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:00.923681021 CET	49049	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:00.929896116 CET	53	49049	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:00.930788040 CET	48004	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:00.937187910 CET	53	48004	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:00.938044071 CET	37544	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:00.945477962 CET	53	37544	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:00.946631908 CET	47669	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:00.952929020 CET	53	47669	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:00.954487085 CET	42773	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:00.960988998 CET	53	42773	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:00.962521076 CET	57103	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:00.968745947 CET	53	57103	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:00.969578981 CET	60972	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:00.975734949 CET	53	60972	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:00.977155924 CET	36055	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:00.984381914 CET	53	36055	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:00.986738920 CET	53090	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:00.993714094 CET	53	53090	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:23.398376942 CET	44752	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:23.404902935 CET	53	44752	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:23.405814886 CET	51717	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:23.411984921 CET	53	51717	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:23.412763119 CET	50787	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:23.419320107 CET	53	50787	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:23.420074940 CET	50574	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:23.426506042 CET	53	50574	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:23.427323103 CET	59960	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:23.433882952 CET	53	59960	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:23.434674978 CET	45397	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:23.441030979 CET	53	45397	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:23.441827059 CET	55480	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:23.448113918 CET	53	55480	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:23.448865891 CET	54315	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:23.455246925 CET	53	54315	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:23.456141949 CET	42770	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:23.462388992 CET	53	42770	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:23.463372946 CET	51828	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:23.469410896 CET	53	51828	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:45.839670897 CET	50947	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:45.848061085 CET	53	50947	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:45.849368095 CET	43464	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:45.858093023 CET	53	43464	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:45.859338999 CET	45683	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:45.866182089 CET	53	45683	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:45.867326975 CET	45437	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:45.874876022 CET	53	45437	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:45.876178026 CET	54273	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:45.883335114 CET	53	54273	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:45.884505033 CET	56540	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:45.890702009 CET	53	56540	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:45.891916990 CET	51027	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:45.898092985 CET	53	51027	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:45.899297953 CET	55546	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:45.906887054 CET	53	55546	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:45.908149004 CET	37671	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:45.915457010 CET	53	37671	8.8.8.8	192.168.2.23
Jan 10, 2025 20:47:45.916661024 CET	39395	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:47:45.923957109 CET	53	39395	8.8.8.8	192.168.2.23

Start time (UTC):	19:45:52
Start date (UTC):	10/01/2025
Path:	/tmp/ngwa5.elf
Arguments:	/tmp/ngwa5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	19:45:53
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:45:58
Start date (UTC):	10/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	19:45:59
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:02
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:04
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:07
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:09
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:12
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:15
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:16
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:19
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:22
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:25
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:28
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ngwa5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.X8eO2n (deleted)

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: ngwa5.elf PID: 6245, Parent PID: 6168

General

Chronological Activities

Analysis Process: ngwa5.elf PID: 6247, Parent PID: 6245

General

Chronological Activities

Analysis Process: ngwa5.elf PID: 6249, Parent PID: 6247

General

Chronological Activities

Analysis Process: ngwa5.elf PID: 6250, Parent PID: 6247

General

Analysis Process: ngwa5.elf PID: 6252, Parent PID: 6247

General

Chronological Activities

Analysis Process: systemd PID: 6274, Parent PID: 1

General

Linux Analysis Report
ngwa5.elf

Start time (UTC):	19:46:31
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:35
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:38
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:41
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:44
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:47
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:51
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:54
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:46:57
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:47:00
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75