Edit tour

Linux Analysis Report
fqkjei686.elf

Overview

General Information

Sample name:	fqkjei686.elf
Analysis ID:	1588039
MD5:	8e257e9bdd58ca21dab862e30b704e80
SHA1:	37b84b465ac45f72e6a5b885f64a0d44556ba7f7
SHA256:	66778b88710ef39bf7adc25fc48b0ca0888132b9f98f73733db118b4c176a1ed
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588039
Start date and time:	2025-01-10 20:49:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	fqkjei686.elf
Detection:	MAL
Classification:	mal72.spre.troj.evad.linELF@0/68@31/0

Warnings

VT rate limit hit for: ofewu.eye-network.ru. [malformed]

Runtime Messages

Command:	/tmp/fqkjei686.elf
PID:	6251
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6238, Parent: 4332)

rm (PID: 6238, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.f3lvkfqLlY /tmp/tmp.2lONHCg0hb /tmp/tmp.cgRs2AkynA

dash New Fork (PID: 6239, Parent: 4332)

rm (PID: 6239, Parent: 4332, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.f3lvkfqLlY /tmp/tmp.2lONHCg0hb /tmp/tmp.cgRs2AkynA

fqkjei686.elf (PID: 6251, Parent: 6169, MD5: 8e257e9bdd58ca21dab862e30b704e80) Arguments: /tmp/fqkjei686.elf

fqkjei686.elf New Fork (PID: 6252, Parent: 6251)

fqkjei686.elf New Fork (PID: 6253, Parent: 6252)

fqkjei686.elf New Fork (PID: 6254, Parent: 6252)

fqkjei686.elf New Fork (PID: 6255, Parent: 6252)

systemd New Fork (PID: 6278, Parent: 1)

rsyslogd (PID: 6278, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 6279, Parent: 2063)

wrapper-2.0 (PID: 6279, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6280, Parent: 2063)

wrapper-2.0 (PID: 6280, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6281, Parent: 2063)

wrapper-2.0 (PID: 6281, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6282, Parent: 2063)

wrapper-2.0 (PID: 6282, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 6304, Parent: 6282)

xfpm-power-backlight-helper (PID: 6304, Parent: 6282, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6283, Parent: 2063)

wrapper-2.0 (PID: 6283, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6284, Parent: 2063)

wrapper-2.0 (PID: 6284, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

systemd New Fork (PID: 6285, Parent: 1)

rsyslogd (PID: 6285, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

dbus-daemon New Fork (PID: 6306, Parent: 6305)

xfconfd (PID: 6306, Parent: 6305, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 6327, Parent: 1)

rsyslogd (PID: 6327, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6334, Parent: 1)

rsyslogd (PID: 6334, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6341, Parent: 1)

rsyslogd (PID: 6341, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6345, Parent: 1)

rsyslogd (PID: 6345, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6354, Parent: 1)

rsyslogd (PID: 6354, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6358, Parent: 1)

rsyslogd (PID: 6358, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6362, Parent: 1)

rsyslogd (PID: 6362, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6368, Parent: 1)

rsyslogd (PID: 6368, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6374, Parent: 1)

rsyslogd (PID: 6374, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6378, Parent: 1)

rsyslogd (PID: 6378, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6384, Parent: 1)

rsyslogd (PID: 6384, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6391, Parent: 1)

rsyslogd (PID: 6391, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6395, Parent: 1)

rsyslogd (PID: 6395, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6401, Parent: 1)

rsyslogd (PID: 6401, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6405, Parent: 1)

rsyslogd (PID: 6405, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6413, Parent: 1)

rsyslogd (PID: 6413, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6419, Parent: 1)

rsyslogd (PID: 6419, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6423, Parent: 1)

rsyslogd (PID: 6423, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6429, Parent: 1)

rsyslogd (PID: 6429, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6435, Parent: 1)

rsyslogd (PID: 6435, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6440, Parent: 1)

rsyslogd (PID: 6440, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6446, Parent: 1)

rsyslogd (PID: 6446, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6450, Parent: 1)

rsyslogd (PID: 6450, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6456, Parent: 1)

rsyslogd (PID: 6456, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6462, Parent: 1)

rsyslogd (PID: 6462, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6466, Parent: 1)

rsyslogd (PID: 6466, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6472, Parent: 1)

rsyslogd (PID: 6472, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6478, Parent: 1)

rsyslogd (PID: 6478, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6482, Parent: 1)

rsyslogd (PID: 6482, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6488, Parent: 1)

rsyslogd (PID: 6488, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6493, Parent: 1)

rsyslogd (PID: 6493, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6497, Parent: 1)

rsyslogd (PID: 6497, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6503, Parent: 1)

rsyslogd (PID: 6503, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6509, Parent: 1)

rsyslogd (PID: 6509, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
fqkjei686.elf	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x4c9f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
fqkjei686.elf	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x4c52:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
fqkjei686.elf	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x6efd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x6f9d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
fqkjei686.elf	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
fqkjei686.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7432:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
fqkjei686.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xb15b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6255.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x4c9f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6255.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x4c52:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6255.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x6efd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x6f9d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6255.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6255.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7432:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6255.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xb15b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6251.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x4c9f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6251.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x4c52:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6251.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x6efd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x6f9d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6251.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6251.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7432:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6251.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xb15b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6254.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x4c9f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6254.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x4c52:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6254.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x6efd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x6f9d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6254.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6254.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7432:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6254.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xb15b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 13 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: fqkjei686.elf	Virustotal: Detection: 26%			Perma Link
Source: fqkjei686.elf	ReversingLabs: Detection: 34%

Machine Learning detection for sample

Source: fqkjei686.elf

Joe Sandbox ML: detected

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: ofewu.eye-network.ru. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:50018 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:41292 -> 141.98.10.40:33966

Source: /usr/sbin/rsyslogd (PID: 6285)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6327)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6334)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6341)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6345)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6354)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6358)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6362)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6368)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6374)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6378)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6384)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6391)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6395)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6401)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6405)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6413)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6419)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6423)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6429)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6435)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6440)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6446)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6450)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6456)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6462)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6466)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6472)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6478)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6482)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6488)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6493)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6497)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6503)	Reads hosts file: /etc/hosts	Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: ofewu.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: ofewu.eye-network.ru. [malformed]

Source: syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.102.dr, syslog.86.dr, syslog.82.dr, syslog.76.dr, syslog.100.dr, syslog.52.dr, syslog.98.dr, syslog.92.dr, syslog.36.dr, syslog.62.dr, syslog.74.dr, syslog.68.dr, syslog.104.dr, syslog.78.dr, syslog.50.dr, syslog.60.dr, syslog.106.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6255.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6255.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6255.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6255.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6255.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6255.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6251.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6251.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6251.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6251.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6251.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6251.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6254.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6254.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6254.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6254.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6254.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6254.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/fqkjei686.elf (PID: 6252)	SIGKILL sent: pid: 6254, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6255, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6279, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6280, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6281, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6282, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6283, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6284, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6285, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6306, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6327, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6334, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6341, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6345, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6354, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6358, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6362, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6368, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6374, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6378, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6384, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6391, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6395, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6401, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6405, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6413, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6419, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6423, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6429, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6435, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6440, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6446, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6450, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6456, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6462, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6466, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6472, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6478, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6488, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6493, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6497, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6503, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6509, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /proc/EOF/proc/%d/exe/proc/%d/stat/proc/%d/mapssys_monitor_cnrbusyboxadbddockerdBlink_Cloudsystemdhttpsshdbashmsg_centerlte_mgrmain_mgrpkarm7pkarm5pkarmpkarm6pkmipspkmpslpkx86/var/mnt/root/boot/sbin/home/dev/media/opt/../(deleted)sh4[0clKillerKillerEXE] Killed process: %s, PID: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/fqkjei686.elf (PID: 6252)	SIGKILL sent: pid: 6254, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6255, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6279, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6280, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6281, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6282, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6283, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6284, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6285, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6306, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6327, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6334, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6341, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6345, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6354, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6358, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6362, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6368, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6374, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6378, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6384, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6391, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6395, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6401, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6405, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6413, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6419, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6423, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6429, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6435, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6440, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6446, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6450, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6456, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6462, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6466, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6472, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6478, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6488, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6493, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6497, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6503, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 6509, result: successful	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	SIGKILL sent: pid: 2, result: successful	Jump to behavior

Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: fqkjei686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6255.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6255.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6255.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6255.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6255.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6255.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6251.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6251.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6251.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6251.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6251.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6251.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6254.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6254.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6254.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6254.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6254.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6254.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26

Source: classification engine

Classification label: mal72.spre.troj.evad.linELF@0/68@31/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6279)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6280)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6283)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6283)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6283)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6283)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6284)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6306)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6306)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6306)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6306)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/6234/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/6234/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/6234/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/6233/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/6233/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/6233/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/fqkjei686.elf (PID: 6253)	File opened: /proc/13/stat	Jump to behavior

Source: /usr/bin/dash (PID: 6238)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.f3lvkfqLlY /tmp/tmp.2lONHCg0hb /tmp/tmp.cgRs2AkynA			Jump to behavior
Source: /usr/bin/dash (PID: 6239)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.f3lvkfqLlY /tmp/tmp.2lONHCg0hb /tmp/tmp.cgRs2AkynA			Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6285)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6327)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6334)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6341)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6345)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6354)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6358)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6362)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6368)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6374)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6378)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6384)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6391)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6395)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6401)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6405)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6413)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6419)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6423)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6429)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6435)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6440)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6446)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6450)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6456)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6462)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6466)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6472)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6478)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6482)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6488)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6493)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6497)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6503)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/fqkjei686.elf (PID: 6252)

File: /tmp/fqkjei686.elf

Jump to behavior

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6279)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6280)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6281)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6282)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6283)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6284)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6285)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6327)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6334)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6341)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6345)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6354)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6358)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6362)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6368)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6374)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6378)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6384)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6391)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6395)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6401)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6405)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6413)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6419)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6423)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6429)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6435)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6440)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6446)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6450)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6456)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6462)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6466)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6472)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6478)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6482)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6488)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6493)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6497)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6503)	Queries kernel information via 'uname':	Jump to behavior

Source: fqkjei686.elf, 6255.1.0000000009672000.0000000009679000.rw-.sdmp	Binary or memory string: vmware
Source: fqkjei686.elf, 6255.1.0000000009672000.0000000009679000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_721-4290559889
Source: fqkjei686.elf, 6255.1.0000000009672000.0000000009679000.rw-.sdmp	Binary or memory string: !/var/log/gdm3 a/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-resolved.service-AfPZzgQ/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f.)/tmp/vmware-root_721-4290559889

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 File Deletion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
fqkjei686.elf	27%	Virustotal		Browse
fqkjei686.elf	34%	ReversingLabs	Linux.Backdoor.Mirai
fqkjei686.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ofewu.eye-network.ru	141.98.10.40	true	false		high
ofewu.eye-network.ru. [malformed]	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.102.dr, syslog.86.dr, syslog.82.dr, syslog.76.dr, syslog.100.dr, syslog.52.dr, syslog.98.dr, syslog.92.dr, syslog.36.dr, syslog.62.dr, syslog.74.dr, syslog.68.dr, syslog.104.dr, syslog.78.dr, syslog.50.dr, syslog.60.dr, syslog.106.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
141.98.10.40	ofewu.eye-network.ru	Lithuania	209605	HOSTBALTICLT	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
89.190.156.145	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse
	ngwa5.elf	Get hash	malicious	Unknown	Browse
	debvps.elf	Get hash	malicious	Unknown	Browse
	wev86.elf	Get hash	malicious	Unknown	Browse
	vevhea4.elf	Get hash	malicious	Unknown	Browse
	fqkjei686.elf	Get hash	malicious	Unknown	Browse
	wrjkngh4.elf	Get hash	malicious	Unknown	Browse
	vevhea4.elf	Get hash	malicious	Unknown	Browse
	qbfwdbg.elf	Get hash	malicious	Unknown	Browse
	wlw68k.elf	Get hash	malicious	Unknown	Browse
141.98.10.40	DOC11042024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	vyebetsh.sa.com/nMcrGmhC252.bin
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	ngwa5.elf	Get hash	malicious	Unknown	Browse
	wev86.elf	Get hash	malicious	Unknown	Browse
	main_arm5.elf	Get hash	malicious	Mirai	Browse
	Space.i686.elf	Get hash	malicious	Unknown	Browse
	frosty.arm7.elf	Get hash	malicious	Mirai	Browse
	frosty.mips.elf	Get hash	malicious	Mirai	Browse
	frosty.m68k.elf	Get hash	malicious	Mirai	Browse
	Space.arc.elf	Get hash	malicious	Mirai	Browse
	main_arm7.elf	Get hash	malicious	Mirai	Browse
	main_sh4.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ofewu.eye-network.ru	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
ofewu.eye-network.ru	debvps.elf	Get hash	malicious	Unknown	Browse	141.98.10.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	ngwa5.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	debvps.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wev86.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	vevhea4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	fqkjei686.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wrjkngh4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	vevhea4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	qbfwdbg.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
CANONICAL-ASGB	ngwa5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	wev86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.i686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	frosty.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	frosty.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	frosty.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.arm6.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
HOSTBALTICLT	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	ngwa5.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	debvps.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	wev86.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	vevhea4.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse	141.98.10.40
	uYtea.sh4.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.ppc.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.x86.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.arm.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
INIT7CH	ngwa5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	wev86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	main_arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.i686.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	frosty.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	frosty.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	frosty.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1237
Entropy (8bit):	4.706559859962934
Encrypted:	false
SSDEEP:	24:xwfLwYfLXb9fL3MfLrtmfL/+bfLbafLLYfLzAI4dYfLxAI4dV4fLvAI46LjogTRy:xwfjfD5fgfVmfIfafAfJ4dYfT4dV4fV4
MD5:	62D9BD2B61ECDC2C30F6A1370316404E
SHA1:	EC0E900CD78BC210DBA7C586EEB912391A338A77
SHA-256:	EBD1F1CEB1EF767CCE892A025CC9154AB3B3495F03C6322C12118B10B508AE40
SHA-512:	32544B5B436D877B394C229D380D5348CC746920912FDEDEA352AED933194586EE46321C65655E940033F78A2A535D430C05495CA38BCFBC7AD2503AAC8F1864
Malicious:	false
Reputation:	low
Preview:	Jan 10 13:51:45 galassia kernel: [ 522.072480] blocking signal 9: 6253 -> 1320.Jan 10 13:51:45 galassia kernel: [ 522.103279] blocking signal 9: 6253 -> 658.Jan 10 13:51:45 galassia kernel: [ 522.112299] blocking signal 9: 6253 -> 772.Jan 10 13:51:45 galassia kernel: [ 522.123703] blocking signal 9: 6253 -> 800.Jan 10 13:51:45 galassia kernel: [ 522.129889] blocking signal 9: 6253 -> 847.Jan 10 13:51:45 galassia kernel: [ 522.136150] blocking signal 9: 6253 -> 936.Jan 10 13:51:45 galassia kernel: [ 522.142441] blocking signal 9: 6253 -> 1320.Jan 10 13:51:45 galassia kernel: [ 522.493641] New task spawned: old: (tgid 6503, tid 6503), new (tgid: 6503, tid: 6504).Jan 10 13:51:45 galassia kernel: [ 522.493944] New task spawned: old: (tgid 6503, tid 6503), new (tgid: 6503, tid: 6505).Jan 10 13:51:48 galassia kernel: [ 522.495203] New task spawned: old: (tgid 6503, tid 6504), new (tgid: 6503, tid: 6506).Jan 10 13:51:48 galassia kernel: [ 525.157722] blocking signal 9: 6253 -> 658.

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2477
Entropy (8bit):	4.988016730855744
Encrypted:	false
SSDEEP:	48:x43yfjfDpvfgfVmfIfafAfJ4dQPEfT4dVFRDBH+QUVuVAVpfV46Ljh9Tzy:VdgTd/RVvUgiW66
MD5:	135A3E44780F73CA81F2B625A18AAC46
SHA1:	F9EB555E3221D466E6D7E3D87D8CCBB75CF95C20
SHA-256:	142E18A4A608E46E05A280CDF401504A778774D89D98B1A928A7BD4D1F3BF716
SHA-512:	32BEAB1B56FCBF3E6D17E084BA93CF3EF3ABD9761F2A5D870F9793A498E454A20A4F82D7A9B97CBDD5DD012401D6F9E7F6BEB406C332221DF550201431AEDB83
Malicious:	false
Reputation:	low
Preview:	Jan 10 13:51:45 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 10 13:51:45 galassia kernel: [ 522.072480] blocking signal 9: 6253 -> 1320.Jan 10 13:51:45 galassia kernel: [ 522.103279] blocking signal 9: 6253 -> 658.Jan 10 13:51:45 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 10 13:51:45 galassia kernel: [ 522.112299] blocking signal 9: 6253 -> 772.Jan 10 13:51:45 galassia kernel: [ 522.123703] blocking signal 9: 6253 -> 800.Jan 10 13:51:45 galassia kernel: [ 522.129889] blocking signal 9: 6253 -> 847.Jan 10 13:51:45 galassia kernel: [ 522.136150] blocking signal 9: 6253 -> 936.Jan 10 13:51:45 galassia kernel: [ 522.142441] blocking signal 9: 6253 -> 1320.Jan 10 13:51:45 galassia kernel: [ 522.493641] New task spawned: old: (tgid 6503, tid 6503), new (tgid: 6503, tid: 6504).Jan 10 13:51:45 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 35..Jan 10 13:51:45 galassia kernel: [

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.600892090029974
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	fqkjei686.elf
File size:	105'448 bytes
MD5:	8e257e9bdd58ca21dab862e30b704e80
SHA1:	37b84b465ac45f72e6a5b885f64a0d44556ba7f7
SHA256:	66778b88710ef39bf7adc25fc48b0ca0888132b9f98f73733db118b4c176a1ed
SHA512:	3abaebc310681bfaf3cbfca135c10299c0551a78b1c6cc92933f476365862cd62bda6218cd13ddd06c463b6c852648916ff03b3615d7cdfd9ca80ae267e15a23
SSDEEP:	1536:4OksIQgcI/XpZkb/C2x0eE7ycaVNm6LBbWoiQDEOOeQmDpX3kIbu7K5:hgQgn/Mb3x0eE7yXVrsjQD/Oe3m7K
TLSH:	44A349C0FA87C0F1D41744708027B33FCB32D5296036DA5EEF9AAE26DAA7542961735D
File Content Preview:	.ELF....................h...4...X.......4. ...(.....................3R..3R..............8R..8...8....G..............Q.td............................U..S........a...h....c...[]...$.............U......= ...t..1....d......d.......u........t...$4..........

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	105048
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x11b91	0x0	0x6	AX	16
.fini	PROGBITS	0x8059c41	0x11c41	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8059c60	0x11c60	0x35d3	0x0	0x2	A	32
.ctors	PROGBITS	0x805e238	0x15238	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x805e244	0x15244	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805e260	0x15260	0x47b8	0x0	0x3	WA	32
.bss	NOBITS	0x8062a20	0x19a18	0xc90c	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x19a18	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x15233	0x15233	6.3258	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x15238	0x805e238	0x805e238	0x47e0	0x110f4	0.4184	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:50:03.999890089 CET	46584	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:04.010518074 CET	53	46584	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:04.010596991 CET	36361	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:04.017019033 CET	53	36361	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:04.017102957 CET	33065	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:04.023624897 CET	53	33065	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:04.023752928 CET	52196	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:04.029968977 CET	53	52196	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:04.030059099 CET	50980	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:04.036140919 CET	53	50980	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:04.037530899 CET	56910	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:04.044657946 CET	53	56910	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:26.418234110 CET	52059	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:26.425343990 CET	53	52059	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:26.425486088 CET	52173	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:26.432934046 CET	53	52173	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:26.433012009 CET	56391	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:26.440237999 CET	53	56391	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:26.440354109 CET	54567	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:26.451570988 CET	53	54567	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:26.451651096 CET	46261	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:26.458496094 CET	53	46261	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:26.458568096 CET	34900	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:26.465872049 CET	53	34900	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:26.465939999 CET	53133	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:26.473117113 CET	53	53133	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:26.473217010 CET	55374	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:26.479553938 CET	53	55374	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:26.479685068 CET	41904	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:26.485939026 CET	53	41904	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:26.486037970 CET	54530	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:26.492444038 CET	53	54530	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:48.855338097 CET	60007	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:48.861884117 CET	53	60007	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:48.862021923 CET	58398	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:48.868383884 CET	53	58398	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:48.868473053 CET	54909	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:48.874737024 CET	53	54909	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:48.874838114 CET	42754	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:48.881149054 CET	53	42754	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:48.881239891 CET	59495	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:48.887628078 CET	53	59495	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:48.887718916 CET	50068	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:48.894047976 CET	53	50068	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:48.894133091 CET	36261	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:48.900320053 CET	53	36261	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:48.900413990 CET	43087	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:48.906495094 CET	53	43087	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:48.906579018 CET	59416	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:48.912959099 CET	53	59416	8.8.8.8	192.168.2.23
Jan 10, 2025 20:50:48.913043022 CET	41938	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:50:48.919469118 CET	53	41938	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:11.309829950 CET	47273	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:11.316284895 CET	53	47273	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:11.316754103 CET	59349	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:11.322860003 CET	53	59349	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:11.322959900 CET	35159	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:11.329221010 CET	53	35159	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:11.329447031 CET	57530	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:11.335803986 CET	53	57530	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:11.336402893 CET	42040	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:11.342751980 CET	53	42040	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:11.343121052 CET	53435	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:11.349353075 CET	53	53435	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:11.351059914 CET	33369	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:11.357331038 CET	53	33369	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:11.357620001 CET	35125	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:11.363918066 CET	53	35125	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:11.364078999 CET	39759	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:11.370368004 CET	53	39759	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:11.370465994 CET	48544	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:11.376620054 CET	53	48544	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:33.742275953 CET	43989	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:33.748759031 CET	53	43989	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:33.748833895 CET	57893	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:33.755177021 CET	53	57893	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:33.755275965 CET	39421	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:33.762171984 CET	53	39421	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:33.762227058 CET	45338	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:33.768964052 CET	53	45338	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:33.769156933 CET	49089	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:33.775707960 CET	53	49089	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:33.775791883 CET	46813	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:33.782938004 CET	53	46813	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:33.782994986 CET	52690	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:33.789859056 CET	53	52690	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:33.792081118 CET	38740	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:33.798154116 CET	53	38740	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:33.798226118 CET	54491	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:33.804523945 CET	53	54491	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:33.804568052 CET	54011	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:33.811007977 CET	53	54011	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:56.215641975 CET	52824	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:56.221999884 CET	53	52824	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:56.222088099 CET	38476	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:56.228463888 CET	53	38476	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:56.228554010 CET	45818	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:56.234762907 CET	53	45818	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:56.234844923 CET	56756	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:56.241192102 CET	53	56756	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:56.241275072 CET	33671	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:56.247510910 CET	53	33671	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:56.247571945 CET	34308	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:56.253856897 CET	53	34308	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:56.253942966 CET	60409	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:56.260159016 CET	53	60409	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:56.260245085 CET	54889	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:56.266401052 CET	53	54889	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:56.266508102 CET	34404	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:56.272711039 CET	53	34404	8.8.8.8	192.168.2.23
Jan 10, 2025 20:51:56.272793055 CET	43365	53	192.168.2.23	8.8.8.8
Jan 10, 2025 20:51:56.279079914 CET	53	43365	8.8.8.8	192.168.2.23

Start time (UTC):	19:49:56
Start date (UTC):	10/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	19:50:02
Start date (UTC):	10/01/2025
Path:	/tmp/fqkjei686.elf
Arguments:	/tmp/fqkjei686.elf
File size:	105448 bytes
MD5 hash:	8e257e9bdd58ca21dab862e30b704e80

Start time (UTC):	19:50:03
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:11
Start date (UTC):	10/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	19:50:14
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:17
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:18
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:21
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:23
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:26
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:27
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:30
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:33
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:36
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:39
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report fqkjei686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: dash PID: 6238, Parent PID: 4332

General

Chronological Activities

Analysis Process: rm PID: 6238, Parent PID: 4332

General

Chronological Activities

Analysis Process: dash PID: 6239, Parent PID: 4332

General

Chronological Activities

Analysis Process: rm PID: 6239, Parent PID: 4332

General

Chronological Activities

Analysis Process: fqkjei686.elf PID: 6251, Parent PID: 6169

General

Chronological Activities

Linux Analysis Report
fqkjei686.elf

Start time (UTC):	19:50:42
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:45
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:48
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:52
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:55
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:50:58
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:51:01
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:51:04
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:51:07
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:51:10
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75