Edit tour

Linux Analysis Report
bot.mpsl.elf

Overview

General Information

Sample name:	bot.mpsl.elf
Analysis ID:	1591233
MD5:	4abd9f8d315c83d39c0d6fde3b9241ed
SHA1:	93c7f180dc0623f816d4be807402049f608e9a41
SHA256:	2bf3bd6d6d28044e2ddd80c2fc39f71f76f14f1827117aadee1c05c4c12aaf6f
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Sample tries to kill multiple processes (SIGKILL)

Uses dynamic DNS services

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591233
Start date and time:	2025-01-14 20:40:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	bot.mpsl.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1025@25/0

Runtime Messages

Command:	/tmp/bot.mpsl.elf
PID:	6269
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

bot.mpsl.elf (PID: 6269, Parent: 6195, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/bot.mpsl.elf

bot.mpsl.elf New Fork (PID: 6271, Parent: 6269)

bot.mpsl.elf New Fork (PID: 6273, Parent: 6271)

dash New Fork (PID: 6275, Parent: 4331)

rm (PID: 6275, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.TizcFVSH33 /tmp/tmp.uGz95LO1Bd /tmp/tmp.IroRpekwwO

dash New Fork (PID: 6276, Parent: 4331)

rm (PID: 6276, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.TizcFVSH33 /tmp/tmp.uGz95LO1Bd /tmp/tmp.IroRpekwwO

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
bot.mpsl.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
bot.mpsl.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
bot.mpsl.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
bot.mpsl.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
bot.mpsl.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x22e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6269.1.00007fccbc400000.00007fccbc426000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6269.1.00007fccbc400000.00007fccbc426000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6269.1.00007fccbc400000.00007fccbc426000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6269.1.00007fccbc400000.00007fccbc426000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6269.1.00007fccbc400000.00007fccbc426000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x22e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22f90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22fa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22fb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22fcc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: bot.mpsl.elf PID: 6269	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: bot.mpsl.elf PID: 6269	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: bot.mpsl.elf PID: 6269	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: bot.mpsl.elf PID: 6269	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1204:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1218:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x122c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1240:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1254:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1268:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x127c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1290:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1308:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x131c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1330:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1344:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1358:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 4 entries

Suricata Signatures

ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T20:41:50.800853+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33918	45.133.74.89	43957	TCP
2025-01-14T20:41:54.417908+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33920	45.133.74.89	43957	TCP
2025-01-14T20:42:01.982230+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33922	45.133.74.89	43957	TCP
2025-01-14T20:42:05.534178+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33924	45.133.74.89	43957	TCP
2025-01-14T20:42:13.109646+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33926	45.133.74.89	43957	TCP
2025-01-14T20:42:21.646165+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33928	45.133.74.89	43957	TCP
2025-01-14T20:42:28.207267+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33930	45.133.74.89	43957	TCP
2025-01-14T20:42:29.769574+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33932	45.133.74.89	43957	TCP
2025-01-14T20:42:34.323841+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33934	45.133.74.89	43957	TCP
2025-01-14T20:42:35.876440+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33936	45.133.74.89	43957	TCP
2025-01-14T20:42:43.420532+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33938	45.133.74.89	43957	TCP
2025-01-14T20:42:47.058816+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33940	45.133.74.89	43957	TCP
2025-01-14T20:42:52.687978+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33942	45.133.74.89	43957	TCP
2025-01-14T20:43:03.236187+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33944	45.133.74.89	43957	TCP
2025-01-14T20:43:12.878642+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33946	45.133.74.89	43957	TCP
2025-01-14T20:43:19.423794+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33948	45.133.74.89	43957	TCP
2025-01-14T20:43:20.988388+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33950	45.133.74.89	43957	TCP
2025-01-14T20:43:24.541595+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33952	45.133.74.89	43957	TCP
2025-01-14T20:43:34.127574+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33954	45.133.74.89	43957	TCP
2025-01-14T20:43:40.791721+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33956	45.133.74.89	43957	TCP
2025-01-14T20:43:45.346574+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33958	45.133.74.89	43957	TCP
2025-01-14T20:43:46.895102+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33960	45.133.74.89	43957	TCP
2025-01-14T20:43:51.465326+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33962	45.133.74.89	43957	TCP
2025-01-14T20:43:53.048218+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33964	45.133.74.89	43957	TCP
2025-01-14T20:43:54.676335+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.23	33966	45.133.74.89	43957	TCP

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: bot.mpsl.elf	Virustotal: Detection: 58%			Perma Link
Source: bot.mpsl.elf	ReversingLabs: Detection: 57%

Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33950 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33956 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33928 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33962 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33958 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33920 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33964 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33940 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33966 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33948 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33944 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33934 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33926 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33938 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33946 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33942 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33932 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33952 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33918 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33922 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33960 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33924 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33930 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33936 -> 45.133.74.89:43957
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.23:33954 -> 45.133.74.89:43957

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39256
Source: unknown	Network traffic detected: HTTP traffic on port 39256 -> 443

Source: bot.mpsl.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6269.1.00007fccbc400000.00007fccbc426000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: bot.mpsl.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: /tmp/bot.mpsl.elf (PID: 6273)	SIGKILL sent: pid: 4431, result: successful	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	SIGKILL sent: pid: 4439, result: successful	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	SIGKILL sent: pid: 4525, result: successful	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	SIGKILL sent: pid: 4529, result: successful	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	SIGKILL sent: pid: 4531, result: successful	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	SIGKILL sent: pid: 4533, result: successful	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	SIGKILL sent: pid: 4535, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/6106/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/bot.mpsl.elf (PID: 6273)	File opened: /proc/260/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 6275)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.TizcFVSH33 /tmp/tmp.uGz95LO1Bd /tmp/tmp.IroRpekwwO			Jump to behavior
Source: /usr/bin/dash (PID: 6276)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.TizcFVSH33 /tmp/tmp.uGz95LO1Bd /tmp/tmp.IroRpekwwO			Jump to behavior

Source: bot.mpsl.elf, 6269.1.0000561aa9926000.0000561aa99ad000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: bot.mpsl.elf, 6269.1.0000561aa9926000.0000561aa99ad000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/mipsel
Source: bot.mpsl.elf, 6269.1.00007ffefcac2000.00007ffefcae3000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/bot.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/bot.mpsl.elf
Source: bot.mpsl.elf, 6269.1.00007ffefcac2000.00007ffefcae3000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Source: bot.mpsl.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6269.1.00007fccbc400000.00007fccbc426000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: bot.mpsl.elf PID: 6269, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: Yara match	File source: bot.mpsl.elf, type: SAMPLE
Source: Yara match	File source: 6269.1.00007fccbc400000.00007fccbc426000.r-x.sdmp, type: MEMORY

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
bot.mpsl.elf	58%	Virustotal		Browse
bot.mpsl.elf	58%	ReversingLabs	Linux.Trojan.Mirai
bot.mpsl.elf	100%	Avira	EXP/ELF.Mirai.Z.A

IP	Domain	Country	ASN	ASN Name	Malicious
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
45.133.74.89	crystalc2.duckdns.org	Germany	202322	EVERYONE-BANDWIDTH-INCDE	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.249.145.219	hikarm4.elf	Get hash	malicious	Unknown	Browse
	yakuza.x32.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	yakuza.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse
	Space.mips.elf	Get hash	malicious	Unknown	Browse
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse
	mpsl.elf	Get hash	malicious	Mirai	Browse
45.133.74.89	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.sh4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.ppc.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.42	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	bin.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	Kloki.arm7.elf	Get hash	malicious	Unknown	Browse
	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse

Process:	/tmp/bot.mpsl.elf
File Type:	data
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5032583347756456
Encrypted:	false
SSDEEP:	3:Tg53:Tg53
MD5:	5B160722D69059F1B1C70CF20A4DB754
SHA1:	7882B9E687DAD9F4343B68E99C80CAB396882B78
SHA-256:	5AB2C2D1225AFCA3B993A0286C87A28E12D961B90A8E01FFB693A61255CDF9C8
SHA-512:	E518B5F065A5540998D57866A4C11C894E2CE996BDE435BA6BA203F90D567504EFACE3865CEDF23E58074A3A27F54FC286ED6D0A7E8DEDA4FA4028947CAD98C8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/bot.mpsl.elf.

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.020316629671508
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	bot.mpsl.elf
File size:	177'860 bytes
MD5:	4abd9f8d315c83d39c0d6fde3b9241ed
SHA1:	93c7f180dc0623f816d4be807402049f608e9a41
SHA256:	2bf3bd6d6d28044e2ddd80c2fc39f71f76f14f1827117aadee1c05c4c12aaf6f
SHA512:	6dc55e80ab9f526e08119653b56b0c10f6c0245a26a7f16411cb9208b09f970c354dac8b562bfd822e0fc2b16114c242e6cc6c3adbb37c91a8f9191e127bf3d8
SSDEEP:	3072:ueEksFM+wX5OAaVR8H3NaMZOTTMJxt9U+7fKbDE:ueEnO+wXYVWdaMATwJHy+un
TLSH:	3D04D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68
File Content Preview:	.ELF....................`.@.4...........4. ...(...............@...@.`W..`W...............`...`F..`F.0T..............Q.td...............................<.).'!......'.......................<.).'!...$.........9'.. ........................<.).'!... ........,9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	177300
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x22be0	0x0	0x6	AX	16
.fini	PROGBITS	0x422d00	0x22d00	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x422d60	0x22d60	0x2a00	0x0	0x2	A	16
.ctors	PROGBITS	0x466000	0x26000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x46600c	0x2600c	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x466018	0x26018	0xcc	0x0	0x3	WA	4
.data	PROGBITS	0x466100	0x26100	0x4998	0x0	0x3	WA	32
.got	PROGBITS	0x46aaa0	0x2aaa0	0x990	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x46b430	0x2b430	0x4c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x46b480	0x2b430	0x4840	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x126c	0x2b430	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x2b430	0x64	0x0	0x0		1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report bot.mpsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.000tcw (deleted)

/tmp/qemu-open.02ViEy (deleted)

/tmp/qemu-open.04JgNy (deleted)

/tmp/qemu-open.05F6zz (deleted)

/tmp/qemu-open.06YJay (deleted)

/tmp/qemu-open.0AMKPv (deleted)

/tmp/qemu-open.0CHImz (deleted)

/tmp/qemu-open.0CxeWx (deleted)

/tmp/qemu-open.0MoWUy (deleted)

/tmp/qemu-open.0QIJsz (deleted)

/tmp/qemu-open.0Thjty (deleted)

/tmp/qemu-open.0XiEJw (deleted)

/tmp/qemu-open.0bXWvx (deleted)

/tmp/qemu-open.0gap1x (deleted)

/tmp/qemu-open.0h9Qqz (deleted)

/tmp/qemu-open.0rMwKv (deleted)

/tmp/qemu-open.0rfbVw (deleted)

/tmp/qemu-open.0tpFjv (deleted)

/tmp/qemu-open.0uYJjv (deleted)

/tmp/qemu-open.17objw (deleted)

/tmp/qemu-open.19OYqw (deleted)

/tmp/qemu-open.1B3lHy (deleted)

/tmp/qemu-open.1D1ELx (deleted)

/tmp/qemu-open.1QI5uz (deleted)

/tmp/qemu-open.1Ux7nx (deleted)

/tmp/qemu-open.1V5uFx (deleted)

/tmp/qemu-open.1V6PJx (deleted)

/tmp/qemu-open.1ZAWox (deleted)

/tmp/qemu-open.1aHNay (deleted)

/tmp/qemu-open.1ly4vx (deleted)

/tmp/qemu-open.1pOYTy (deleted)

Linux Analysis Report
bot.mpsl.elf

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x25760	0x25760	5.4462	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x26000	0x466000	0x466000	0x5430	0x9cc0	1.1558	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 20:41:48.523821115 CET	43928	443	192.168.2.23	91.189.91.42
Jan 14, 2025 20:41:50.779405117 CET	33918	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:41:50.784497976 CET	43957	33918	45.133.74.89	192.168.2.23
Jan 14, 2025 20:41:50.784540892 CET	33918	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:41:50.800853014 CET	33918	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:41:50.805711031 CET	43957	33918	45.133.74.89	192.168.2.23
Jan 14, 2025 20:41:51.306977034 CET	43957	33918	45.133.74.89	192.168.2.23
Jan 14, 2025 20:41:51.307235003 CET	33918	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:41:51.312194109 CET	43957	33918	45.133.74.89	192.168.2.23
Jan 14, 2025 20:41:51.791006088 CET	39256	443	192.168.2.23	34.249.145.219
Jan 14, 2025 20:41:51.835982084 CET	443	39256	34.249.145.219	192.168.2.23
Jan 14, 2025 20:41:54.410772085 CET	33920	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:41:54.415553093 CET	43957	33920	45.133.74.89	192.168.2.23
Jan 14, 2025 20:41:54.415612936 CET	33920	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:41:54.417907953 CET	33920	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:41:54.422748089 CET	43957	33920	45.133.74.89	192.168.2.23
Jan 14, 2025 20:41:54.966253996 CET	43957	33920	45.133.74.89	192.168.2.23
Jan 14, 2025 20:41:54.966341972 CET	33920	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:41:54.971151114 CET	43957	33920	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:01.976269960 CET	33922	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:01.981087923 CET	43957	33922	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:01.981141090 CET	33922	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:01.982229948 CET	33922	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:01.986996889 CET	43957	33922	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:02.518059015 CET	43957	33922	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:02.518136978 CET	33922	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:02.522893906 CET	43957	33922	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:04.432773113 CET	443	39256	34.249.145.219	192.168.2.23
Jan 14, 2025 20:42:04.432837009 CET	39256	443	192.168.2.23	34.249.145.219
Jan 14, 2025 20:42:05.528238058 CET	33924	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:05.533051968 CET	43957	33924	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:05.533097029 CET	33924	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:05.534178019 CET	33924	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:05.538901091 CET	43957	33924	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:06.094938040 CET	43957	33924	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:06.095014095 CET	33924	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:06.099811077 CET	43957	33924	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:06.953260899 CET	42516	80	192.168.2.23	109.202.202.202
Jan 14, 2025 20:42:09.000979900 CET	43928	443	192.168.2.23	91.189.91.42
Jan 14, 2025 20:42:13.103979111 CET	33926	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:13.108829975 CET	43957	33926	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:13.108889103 CET	33926	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:13.109646082 CET	33926	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:13.114470959 CET	43957	33926	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:13.631573915 CET	43957	33926	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:13.631768942 CET	33926	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:13.636795044 CET	43957	33926	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:21.640091896 CET	33928	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:21.645374060 CET	43957	33928	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:21.645417929 CET	33928	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:21.646164894 CET	33928	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:21.650975943 CET	43957	33928	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:22.192372084 CET	43957	33928	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:22.192545891 CET	33928	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:22.199242115 CET	43957	33928	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:28.201545954 CET	33930	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:28.206355095 CET	43957	33930	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:28.206481934 CET	33930	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:28.207267046 CET	33930	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:28.212049007 CET	43957	33930	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:28.753700972 CET	43957	33930	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:28.753866911 CET	33930	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:28.758661032 CET	43957	33930	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:29.763624907 CET	33932	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:29.768574953 CET	43957	33932	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:29.768657923 CET	33932	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:29.769573927 CET	33932	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:29.774442911 CET	43957	33932	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:30.308022022 CET	43957	33932	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:30.308310032 CET	33932	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:30.313277960 CET	43957	33932	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:34.317738056 CET	33934	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:34.322659969 CET	43957	33934	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:34.322721958 CET	33934	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:34.323841095 CET	33934	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:34.328701973 CET	43957	33934	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:34.858438015 CET	43957	33934	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:34.858664036 CET	33934	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:34.863495111 CET	43957	33934	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:35.869978905 CET	33936	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:35.875675917 CET	43957	33936	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:35.875768900 CET	33936	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:35.876440048 CET	33936	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:35.881267071 CET	43957	33936	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:36.404237986 CET	43957	33936	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:36.404457092 CET	33936	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:36.409308910 CET	43957	33936	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:43.414577007 CET	33938	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:43.419377089 CET	43957	33938	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:43.419469118 CET	33938	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:43.420531988 CET	33938	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:43.425364017 CET	43957	33938	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:43.950807095 CET	43957	33938	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:43.951175928 CET	33938	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:43.956104040 CET	43957	33938	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:47.052484035 CET	33940	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:47.057451963 CET	43957	33940	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:47.057549953 CET	33940	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:47.058815956 CET	33940	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:47.063658953 CET	43957	33940	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:47.580627918 CET	43957	33940	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:47.580821991 CET	33940	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:47.585714102 CET	43957	33940	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:49.955487967 CET	43928	443	192.168.2.23	91.189.91.42
Jan 14, 2025 20:42:52.681761980 CET	33942	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:52.686646938 CET	43957	33942	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:52.686723948 CET	33942	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:52.687978029 CET	33942	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:52.692768097 CET	43957	33942	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:53.219449043 CET	43957	33942	45.133.74.89	192.168.2.23
Jan 14, 2025 20:42:53.219664097 CET	33942	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:42:53.224575996 CET	43957	33942	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:03.229899883 CET	33944	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:03.234849930 CET	43957	33944	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:03.234945059 CET	33944	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:03.236186981 CET	33944	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:03.241043091 CET	43957	33944	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:03.772445917 CET	43957	33944	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:03.772855043 CET	33944	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:03.777826071 CET	43957	33944	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:12.872407913 CET	33946	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:12.877378941 CET	43957	33946	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:12.877479076 CET	33946	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:12.878642082 CET	33946	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:12.883441925 CET	43957	33946	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:13.407388926 CET	43957	33946	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:13.407567978 CET	33946	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:13.413284063 CET	43957	33946	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:19.417371035 CET	33948	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:19.422410011 CET	43957	33948	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:19.422513962 CET	33948	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:19.423794031 CET	33948	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:19.428632021 CET	43957	33948	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:19.970305920 CET	43957	33948	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:19.970494986 CET	33948	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:19.975395918 CET	43957	33948	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:20.982532978 CET	33950	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:20.987427950 CET	43957	33950	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:20.987514973 CET	33950	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:20.988388062 CET	33950	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:20.993200064 CET	43957	33950	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:21.523797035 CET	43957	33950	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:21.524003983 CET	33950	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:21.528841972 CET	43957	33950	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:24.535161972 CET	33952	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:24.540024042 CET	43957	33952	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:24.540132046 CET	33952	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:24.541594982 CET	33952	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:24.546391964 CET	43957	33952	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:25.111975908 CET	43957	33952	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:25.112385035 CET	33952	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:25.117410898 CET	43957	33952	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:34.121917009 CET	33954	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:34.126856089 CET	43957	33954	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:34.126919031 CET	33954	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:34.127573967 CET	33954	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:34.132477045 CET	43957	33954	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:34.684290886 CET	43957	33954	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:34.684546947 CET	33954	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:34.689600945 CET	43957	33954	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:40.785444975 CET	33956	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:40.790633917 CET	43957	33956	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:40.790693045 CET	33956	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:40.791721106 CET	33956	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:40.796663046 CET	43957	33956	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:41.330094099 CET	43957	33956	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:41.330224037 CET	33956	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:41.335072994 CET	43957	33956	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:45.340132952 CET	33958	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:45.345624924 CET	43957	33958	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:45.345684052 CET	33958	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:45.346574068 CET	33958	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:45.352961063 CET	43957	33958	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:45.878681898 CET	43957	33958	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:45.878822088 CET	33958	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:45.883738041 CET	43957	33958	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:46.889148951 CET	33960	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:46.894131899 CET	43957	33960	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:46.894198895 CET	33960	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:46.895102024 CET	33960	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:46.899997950 CET	43957	33960	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:47.444399118 CET	43957	33960	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:47.444816113 CET	33960	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:47.449754000 CET	43957	33960	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:51.457597971 CET	33962	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:51.463984013 CET	43957	33962	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:51.464056969 CET	33962	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:51.465326071 CET	33962	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:51.470165014 CET	43957	33962	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:52.022517920 CET	43957	33962	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:52.022663116 CET	33962	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:52.027697086 CET	43957	33962	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:53.040386915 CET	33964	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:53.045219898 CET	43957	33964	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:53.045316935 CET	33964	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:53.048218012 CET	33964	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:53.053179026 CET	43957	33964	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:53.568016052 CET	43957	33964	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:53.568288088 CET	33964	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:53.573143959 CET	43957	33964	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:54.669965982 CET	33966	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:54.674825907 CET	43957	33966	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:54.674876928 CET	33966	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:54.676335096 CET	33966	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:54.681093931 CET	43957	33966	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:55.221561909 CET	43957	33966	45.133.74.89	192.168.2.23
Jan 14, 2025 20:43:55.221705914 CET	33966	43957	192.168.2.23	45.133.74.89
Jan 14, 2025 20:43:55.226507902 CET	43957	33966	45.133.74.89	192.168.2.23

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 20:41:50.757396936 CET	43369	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:41:50.764436960 CET	53	43369	8.8.8.8	192.168.2.23
Jan 14, 2025 20:41:54.312355995 CET	38020	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:41:54.409857035 CET	53	38020	8.8.8.8	192.168.2.23
Jan 14, 2025 20:42:01.967509031 CET	53515	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:42:01.975878954 CET	53	53515	8.8.8.8	192.168.2.23
Jan 14, 2025 20:42:05.520710945 CET	43170	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:42:05.527641058 CET	53	43170	8.8.8.8	192.168.2.23
Jan 14, 2025 20:42:13.095750093 CET	46983	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:42:13.103283882 CET	53	46983	8.8.8.8	192.168.2.23
Jan 14, 2025 20:42:21.632451057 CET	48227	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:42:21.639692068 CET	53	48227	8.8.8.8	192.168.2.23
Jan 14, 2025 20:42:28.194123983 CET	44944	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:42:28.200877905 CET	53	44944	8.8.8.8	192.168.2.23
Jan 14, 2025 20:42:29.756051064 CET	47032	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:42:29.763122082 CET	53	47032	8.8.8.8	192.168.2.23
Jan 14, 2025 20:42:34.310391903 CET	38094	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:42:34.317095041 CET	53	38094	8.8.8.8	192.168.2.23
Jan 14, 2025 20:42:35.860546112 CET	41277	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:42:35.869565964 CET	53	41277	8.8.8.8	192.168.2.23
Jan 14, 2025 20:42:43.406496048 CET	34098	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:42:43.413961887 CET	53	34098	8.8.8.8	192.168.2.23
Jan 14, 2025 20:42:46.953474998 CET	53278	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:42:47.051371098 CET	53	53278	8.8.8.8	192.168.2.23
Jan 14, 2025 20:42:52.584254026 CET	45128	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:42:52.680721045 CET	53	45128	8.8.8.8	192.168.2.23
Jan 14, 2025 20:43:03.221932888 CET	56411	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:43:03.229223967 CET	53	56411	8.8.8.8	192.168.2.23
Jan 14, 2025 20:43:12.774982929 CET	37602	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:43:12.871433020 CET	53	37602	8.8.8.8	192.168.2.23
Jan 14, 2025 20:43:19.409446001 CET	43935	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:43:19.416663885 CET	53	43935	8.8.8.8	192.168.2.23
Jan 14, 2025 20:43:20.974801064 CET	60626	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:43:20.981977940 CET	53	60626	8.8.8.8	192.168.2.23
Jan 14, 2025 20:43:24.527198076 CET	59743	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:43:24.534255028 CET	53	59743	8.8.8.8	192.168.2.23
Jan 14, 2025 20:43:34.113706112 CET	49643	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:43:34.121436119 CET	53	49643	8.8.8.8	192.168.2.23
Jan 14, 2025 20:43:40.686702013 CET	48091	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:43:40.784518003 CET	53	48091	8.8.8.8	192.168.2.23
Jan 14, 2025 20:43:45.332498074 CET	53944	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:43:45.339637995 CET	53	53944	8.8.8.8	192.168.2.23
Jan 14, 2025 20:43:46.881438017 CET	51775	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:43:46.888468027 CET	53	51775	8.8.8.8	192.168.2.23
Jan 14, 2025 20:43:51.448139906 CET	52622	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:43:51.456640005 CET	53	52622	8.8.8.8	192.168.2.23
Jan 14, 2025 20:43:53.029733896 CET	60190	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:43:53.037071943 CET	53	60190	8.8.8.8	192.168.2.23
Jan 14, 2025 20:43:54.572263956 CET	34028	53	192.168.2.23	8.8.8.8
Jan 14, 2025 20:43:54.668914080 CET	53	34028	8.8.8.8	192.168.2.23

Start time (UTC):	19:41:49
Start date (UTC):	14/01/2025
Path:	/tmp/bot.mpsl.elf
Arguments:	/tmp/bot.mpsl.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Start time (UTC):	19:41:50
Start date (UTC):	14/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre