Create Interactive Tour

Linux Analysis Report
bot.sh4.elf

Overview

General Information

Sample name:	bot.sh4.elf
Analysis ID:	1615776
MD5:	7ae4b1e544f495f02f2edaad5d800312
SHA1:	ced659d58b314c9d0ee14885b50b1212e1a3eae5
SHA256:	8188768868a7289f72f8f6ecaebb9b00856d089c7749a4027f994ed635c6a544
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Gafgyt, Okiru

Score:	100
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Performs DNS queries to domains with low reputation

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1615776
Start date and time:	2025-02-15 13:20:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	bot.sh4.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@23/0

Runtime Messages

Command:	/tmp/bot.sh4.elf
PID:	5454
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

bot.sh4.elf (PID: 5454, Parent: 5377, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/bot.sh4.elf

bot.sh4.elf New Fork (PID: 5456, Parent: 5454)

bot.sh4.elf New Fork (PID: 5458, Parent: 5456)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
bot.sh4.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
bot.sh4.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
bot.sh4.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
bot.sh4.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
bot.sh4.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16930:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16944:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1696c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
bot.sh4.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x167f0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x16930:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16944:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1696c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x169f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x167f0:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: bot.sh4.elf PID: 5454	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: bot.sh4.elf PID: 5454	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: bot.sh4.elf PID: 5454	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: bot.sh4.elf PID: 5454	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1893:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x190b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x191f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1933:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1947:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x195b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x196f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1983:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1997:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: bot.sh4.elf PID: 5454	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1779:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 6 entries

Suricata Signatures

ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T13:21:26.636236+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	59986	194.85.251.38	47925	TCP
2025-02-15T13:21:31.185071+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	59988	194.85.251.38	47925	TCP
2025-02-15T13:21:32.863693+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	59990	194.85.251.38	47925	TCP
2025-02-15T13:21:38.330028+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	59992	194.85.251.38	47925	TCP
2025-02-15T13:21:43.900132+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	59994	194.85.251.38	47925	TCP
2025-02-15T13:21:49.475255+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	59996	194.85.251.38	47925	TCP
2025-02-15T13:21:59.038904+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	59998	194.85.251.38	47925	TCP
2025-02-15T13:22:02.598850+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60000	194.85.251.38	47925	TCP
2025-02-15T13:22:07.152963+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60002	194.85.251.38	47925	TCP
2025-02-15T13:22:10.707391+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60004	194.85.251.38	47925	TCP
2025-02-15T13:22:15.280000+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60006	194.85.251.38	47925	TCP
2025-02-15T13:22:17.870383+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60008	194.85.251.38	47925	TCP
2025-02-15T13:22:23.427924+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60010	194.85.251.38	47925	TCP
2025-02-15T13:22:31.345875+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60012	194.85.251.38	47925	TCP
2025-02-15T13:22:40.923982+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60014	194.85.251.38	47925	TCP
2025-02-15T13:22:49.512673+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60016	194.85.251.38	47925	TCP
2025-02-15T13:22:59.064530+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60018	194.85.251.38	47925	TCP
2025-02-15T13:23:03.620199+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60020	194.85.251.38	47925	TCP
2025-02-15T13:23:08.174187+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60022	194.85.251.38	47925	TCP
2025-02-15T13:23:15.727900+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60024	194.85.251.38	47925	TCP
2025-02-15T13:23:17.323813+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60026	194.85.251.38	47925	TCP
2025-02-15T13:23:26.876389+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60028	194.85.251.38	47925	TCP
2025-02-15T13:23:28.440481+0100	2030490	1	Malware Command and Control Activity Detected	192.168.2.13	60030	194.85.251.38	47925	TCP

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60016 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:59990 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60006 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60018 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:59986 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:59994 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60002 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60024 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60020 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60000 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60028 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60012 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60026 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:59996 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:59988 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:59992 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60004 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:59998 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60010 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60030 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60022 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60014 -> 194.85.251.38:47925
Source: Network traffic	Suricata IDS: 2030490 - Severity 1 - ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) : 192.168.2.13:60008 -> 194.85.251.38:47925

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 194.85.251.38 ports 47925,2,4,5,7,9

Performs DNS queries to domains with low reputation

Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz
Source:	DNS query: bot.weizaipay.xyz

Source: global traffic

TCP traffic: 192.168.2.13:59986 -> 194.85.251.38:47925

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26

Source: global traffic

DNS traffic detected: DNS query: bot.weizaipay.xyz

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: bot.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: bot.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: bot.sh4.elf PID: 5454, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: bot.sh4.elf PID: 5454, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinernetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Source: ELF static info symbol of initial sample

.symtab present: no

Source: bot.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: bot.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: bot.sh4.elf PID: 5454, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: bot.sh4.elf PID: 5454, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/1025@23/0

Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/3642/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/816/cmdline	Jump to behavior
Source: /tmp/bot.sh4.elf (PID: 5458)	File opened: /proc/5295/cmdline	Jump to behavior

Source: /tmp/bot.sh4.elf (PID: 5454)

Queries kernel information via 'uname':

Jump to behavior

Source: bot.sh4.elf, 5454.1.00007ffd7aa9b000.00007ffd7aabc000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: bot.sh4.elf, 5454.1.000055f05fa89000.000055f05faec000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: bot.sh4.elf, 5454.1.000055f05fa89000.000055f05faec000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: bot.sh4.elf, 5454.1.00007ffd7aa9b000.00007ffd7aabc000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/bot.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/bot.sh4.elf

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: bot.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: bot.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bot.sh4.elf PID: 5454, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: bot.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bot.sh4.elf PID: 5454, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Suricata IDS: ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Yara detected Gafgyt

Source: Yara match	File source: bot.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: bot.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bot.sh4.elf PID: 5454, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: bot.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5454.1.00007fa9a8400000.00007fa9a8419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bot.sh4.elf PID: 5454, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
bot.sh4.elf	48%	Virustotal		Browse
bot.sh4.elf	54%	ReversingLabs	Linux.Trojan.Mirai
bot.sh4.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bot.weizaipay.xyz	194.85.251.38	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.85.251.38	bot.weizaipay.xyz	Russian Federation		35478	DATACENTERRO	false
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
194.85.251.38	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.ppc.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
185.125.190.26	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	vjwe68k.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	inter_sh4.elf	Get hash	malicious	Mirai, Okiru	Browse
	inter_ppc.elf	Get hash	malicious	Mirai, Okiru	Browse
	main_arm6.elf	Get hash	malicious	Mirai	Browse
	main_ppc.elf	Get hash	malicious	Mirai	Browse
	main_mpsl.elf	Get hash	malicious	Mirai	Browse
	main_arm5.elf	Get hash	malicious	Mirai	Browse
	main_arm6.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bot.weizaipay.xyz	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.ppc.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	194.85.251.38
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	194.85.251.38
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DATACENTERRO	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.ppc.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	194.85.251.38
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	194.85.251.38
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	194.85.251.38
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	194.85.251.9
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	194.85.251.9
CANONICAL-ASGB	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vjwe68k.elf	Get hash	malicious	Unknown	Browse	185.125.190.26

Process:	/tmp/bot.sh4.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	17
Entropy (8bit):	3.734521664779752
Encrypted:	false
SSDEEP:	3:TgxtGn:TgxtGn
MD5:	B6CBFB38E83A5DD11BA74ED3A837F67B
SHA1:	BC6DF8CE50E7FB23AF9508DEC8DCB9AF7C2F6044
SHA-256:	18F276FE692A8A87BBBA59AAD6A6FF45B4C7B758ED4B828242DA5540C5D8C397
SHA-512:	C3F26F26F05417E09546F1A391DF1406F5F0AE261CB8F68EBD1BE93B942424A7412226992CB126CD310F9B8327CFA5814B94311104DB6DECD029ECFDBE54F8BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/bot.sh4.elf.

Source: bot.sh4.elf	Virustotal: Detection: 47%			Perma Link
Source: bot.sh4.elf	ReversingLabs: Detection: 54%

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.26128622783806
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	bot.sh4.elf
File size:	120'832 bytes
MD5:	7ae4b1e544f495f02f2edaad5d800312
SHA1:	ced659d58b314c9d0ee14885b50b1212e1a3eae5
SHA256:	8188768868a7289f72f8f6ecaebb9b00856d089c7749a4027f994ed635c6a544
SHA512:	8ba674bc69ef626e7ea50bbf7bddca0693bc6d24253eb8a9235e3e6c82337acb329a5958ccc10a5e50ad0938532de0f2bc7a0e3382a6af467a4974b7f93e2ff3
SSDEEP:	1536:Da60wP/HOD9ZugbaDc+CD0K/nHflnMgEsNqmKW/FRDIhbeyzU:D/P/oz8c+K7/VMgJjKWNRDaeQU
TLSH:	EFC37C76DC2A5F68C695D1B0B0B08F792B63B59042875FBA19B7C2B54083C8DF605BB8
File Content Preview:	.ELF.....................@.4...H.......4. ...(...............@...@...........................B...B.XI..............Q.td............................././"O.n........#.@........#.*@L`...o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	120392
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x16060	0x0	0x6	AX	32
.fini	PROGBITS	0x416140	0x16140	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x416164	0x16164	0x2b44	0x0	0x2	A	4
.ctors	PROGBITS	0x428cac	0x18cac	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x428cb8	0x18cb8	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x428ce0	0x18ce0	0x4910	0x0	0x3	WA	32
.got	PROGBITS	0x42d5f0	0x1d5f0	0x14	0x4	0x3	WA	4
.bss	NOBITS	0x42d604	0x1d604	0x46bc	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1d604	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x18ca8	0x18ca8	6.9211	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x18cac	0x428cac	0x428cac	0x4958	0x9014	0.4129	0x6	RW	0x10000	.ctors .dtors .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 15, 2025 13:21:26.615330935 CET	59986	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:26.620214939 CET	47925	59986	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:26.620287895 CET	59986	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:26.636235952 CET	59986	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:26.641210079 CET	47925	59986	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:27.164931059 CET	47925	59986	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:27.165174007 CET	59986	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:27.170097113 CET	47925	59986	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:31.178723097 CET	59988	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:31.183613062 CET	47925	59988	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:31.183681011 CET	59988	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:31.185070992 CET	59988	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:31.189856052 CET	47925	59988	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:31.721208096 CET	47925	59988	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:31.721328974 CET	59988	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:31.726300955 CET	47925	59988	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:32.754841089 CET	59990	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:32.760035992 CET	47925	59990	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:32.760108948 CET	59990	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:32.863692999 CET	59990	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:32.869030952 CET	47925	59990	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:33.304235935 CET	47925	59990	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:33.304462910 CET	59990	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:33.309416056 CET	47925	59990	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:37.350389957 CET	48202	443	192.168.2.13	185.125.190.26
Feb 15, 2025 13:21:38.321141958 CET	59992	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:38.326234102 CET	47925	59992	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:38.326286077 CET	59992	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:38.330028057 CET	59992	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:38.335433960 CET	47925	59992	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:38.873001099 CET	47925	59992	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:38.873258114 CET	59992	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:38.882790089 CET	47925	59992	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:43.888391972 CET	59994	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:43.893261909 CET	47925	59994	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:43.895395994 CET	59994	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:43.900131941 CET	59994	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:43.905065060 CET	47925	59994	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:44.453847885 CET	47925	59994	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:44.454000950 CET	59994	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:44.458969116 CET	47925	59994	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:49.466484070 CET	59996	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:49.471502066 CET	47925	59996	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:49.471570969 CET	59996	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:49.475255013 CET	59996	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:49.480144978 CET	47925	59996	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:50.023853064 CET	47925	59996	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:50.024013996 CET	59996	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:50.029838085 CET	47925	59996	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:59.033404112 CET	59998	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:59.038295031 CET	47925	59998	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:59.038357019 CET	59998	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:59.038903952 CET	59998	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:59.043787003 CET	47925	59998	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:59.582439899 CET	47925	59998	194.85.251.38	192.168.2.13
Feb 15, 2025 13:21:59.582823992 CET	59998	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:21:59.587743044 CET	47925	59998	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:02.592683077 CET	60000	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:02.597897053 CET	47925	60000	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:02.597979069 CET	60000	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:02.598850012 CET	60000	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:02.604686975 CET	47925	60000	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:03.135618925 CET	47925	60000	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:03.135878086 CET	60000	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:03.141273975 CET	47925	60000	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:07.146495104 CET	60002	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:07.151947021 CET	47925	60002	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:07.152023077 CET	60002	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:07.152962923 CET	60002	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:07.157871008 CET	47925	60002	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:07.688597918 CET	47925	60002	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:07.688899994 CET	60002	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:07.694124937 CET	47925	60002	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:08.838715076 CET	48202	443	192.168.2.13	185.125.190.26
Feb 15, 2025 13:22:10.700366974 CET	60004	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:10.705976963 CET	47925	60004	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:10.706243038 CET	60004	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:10.707391024 CET	60004	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:10.712650061 CET	47925	60004	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:11.261173964 CET	47925	60004	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:11.261531115 CET	60004	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:11.268912077 CET	47925	60004	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:15.273228884 CET	60006	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:15.278439045 CET	47925	60006	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:15.278554916 CET	60006	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:15.279999971 CET	60006	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:15.284955025 CET	47925	60006	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:15.817771912 CET	47925	60006	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:15.818100929 CET	60006	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:15.823940039 CET	47925	60006	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:17.861902952 CET	60008	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:17.869273901 CET	47925	60008	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:17.869383097 CET	60008	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:17.870383024 CET	60008	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:17.876161098 CET	47925	60008	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:18.408308983 CET	47925	60008	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:18.408909082 CET	60008	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:18.415535927 CET	47925	60008	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:23.421039104 CET	60010	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:23.426486015 CET	47925	60010	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:23.426631927 CET	60010	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:23.427923918 CET	60010	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:23.432935953 CET	47925	60010	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:23.963551998 CET	47925	60010	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:23.963846922 CET	60010	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:23.968998909 CET	47925	60010	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:31.339514017 CET	60012	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:31.344669104 CET	47925	60012	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:31.344746113 CET	60012	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:31.345875025 CET	60012	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:31.351056099 CET	47925	60012	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:31.903896093 CET	47925	60012	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:31.904129982 CET	60012	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:31.909548044 CET	47925	60012	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:40.916976929 CET	60014	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:40.922388077 CET	47925	60014	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:40.922559023 CET	60014	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:40.923981905 CET	60014	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:40.930479050 CET	47925	60014	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:41.493556976 CET	47925	60014	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:41.494103909 CET	60014	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:41.499404907 CET	47925	60014	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:49.506393909 CET	60016	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:49.511221886 CET	47925	60016	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:49.511321068 CET	60016	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:49.512672901 CET	60016	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:49.517462969 CET	47925	60016	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:50.047949076 CET	47925	60016	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:50.048094988 CET	60016	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:50.052862883 CET	47925	60016	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:59.058547974 CET	60018	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:59.063401937 CET	47925	60018	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:59.063472033 CET	60018	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:59.064529896 CET	60018	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:59.069351912 CET	47925	60018	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:59.599771976 CET	47925	60018	194.85.251.38	192.168.2.13
Feb 15, 2025 13:22:59.600065947 CET	60018	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:22:59.605113983 CET	47925	60018	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:03.613487005 CET	60020	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:03.618418932 CET	47925	60020	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:03.618616104 CET	60020	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:03.620198965 CET	60020	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:03.625133038 CET	47925	60020	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:04.155941010 CET	47925	60020	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:04.156497002 CET	60020	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:04.161565065 CET	47925	60020	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:08.167845964 CET	60022	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:08.172791004 CET	47925	60022	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:08.172862053 CET	60022	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:08.174186945 CET	60022	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:08.178978920 CET	47925	60022	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:08.711961985 CET	47925	60022	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:08.712307930 CET	60022	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:08.717164040 CET	47925	60022	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:15.722131014 CET	60024	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:15.726913929 CET	47925	60024	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:15.727010965 CET	60024	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:15.727900028 CET	60024	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:15.732662916 CET	47925	60024	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:16.280195951 CET	47925	60024	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:16.280524969 CET	60024	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:16.285649061 CET	47925	60024	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:17.317352057 CET	60026	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:17.322746038 CET	47925	60026	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:17.322818041 CET	60026	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:17.323812962 CET	60026	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:17.328582048 CET	47925	60026	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:17.859499931 CET	47925	60026	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:17.859725952 CET	60026	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:17.864609003 CET	47925	60026	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:26.870223045 CET	60028	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:26.875389099 CET	47925	60028	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:26.875494003 CET	60028	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:26.876389027 CET	60028	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:26.881298065 CET	47925	60028	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:27.421348095 CET	47925	60028	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:27.421714067 CET	60028	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:27.426691055 CET	47925	60028	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:28.432391882 CET	60030	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:28.439495087 CET	47925	60030	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:28.439568043 CET	60030	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:28.440480947 CET	60030	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:28.445346117 CET	47925	60030	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:28.976334095 CET	47925	60030	194.85.251.38	192.168.2.13
Feb 15, 2025 13:23:28.976531982 CET	60030	47925	192.168.2.13	194.85.251.38
Feb 15, 2025 13:23:28.981420994 CET	47925	60030	194.85.251.38	192.168.2.13

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 15, 2025 13:21:26.593261003 CET	44239	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:21:26.600588083 CET	53	44239	8.8.8.8	192.168.2.13
Feb 15, 2025 13:21:31.171274900 CET	49624	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:21:31.178098917 CET	53	49624	8.8.8.8	192.168.2.13
Feb 15, 2025 13:21:32.725478888 CET	40885	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:21:32.733073950 CET	53	40885	8.8.8.8	192.168.2.13
Feb 15, 2025 13:21:38.313236952 CET	45115	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:21:38.320362091 CET	53	45115	8.8.8.8	192.168.2.13
Feb 15, 2025 13:21:43.879529953 CET	55440	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:21:43.887206078 CET	53	55440	8.8.8.8	192.168.2.13
Feb 15, 2025 13:21:49.457755089 CET	49305	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:21:49.465537071 CET	53	49305	8.8.8.8	192.168.2.13
Feb 15, 2025 13:21:59.025635004 CET	34009	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:21:59.033066988 CET	53	34009	8.8.8.8	192.168.2.13
Feb 15, 2025 13:22:02.585053921 CET	56756	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:22:02.592097044 CET	53	56756	8.8.8.8	192.168.2.13
Feb 15, 2025 13:22:07.138283014 CET	54698	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:22:07.145944118 CET	53	54698	8.8.8.8	192.168.2.13
Feb 15, 2025 13:22:10.692275047 CET	43648	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:22:10.699508905 CET	53	43648	8.8.8.8	192.168.2.13
Feb 15, 2025 13:22:15.265078068 CET	51216	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:22:15.272397041 CET	53	51216	8.8.8.8	192.168.2.13
Feb 15, 2025 13:22:17.821269989 CET	49153	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:22:17.860833883 CET	53	49153	8.8.8.8	192.168.2.13
Feb 15, 2025 13:22:23.412396908 CET	44463	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:22:23.420207024 CET	53	44463	8.8.8.8	192.168.2.13
Feb 15, 2025 13:22:30.966702938 CET	45231	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:22:31.338419914 CET	53	45231	8.8.8.8	192.168.2.13
Feb 15, 2025 13:22:40.908282042 CET	33289	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:22:40.915942907 CET	53	33289	8.8.8.8	192.168.2.13
Feb 15, 2025 13:22:49.498269081 CET	50181	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:22:49.505393982 CET	53	50181	8.8.8.8	192.168.2.13
Feb 15, 2025 13:22:59.051338911 CET	55381	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:22:59.057898998 CET	53	55381	8.8.8.8	192.168.2.13
Feb 15, 2025 13:23:03.605439901 CET	34191	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:23:03.612169027 CET	53	34191	8.8.8.8	192.168.2.13
Feb 15, 2025 13:23:08.160635948 CET	55681	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:23:08.167103052 CET	53	55681	8.8.8.8	192.168.2.13
Feb 15, 2025 13:23:15.714814901 CET	50282	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:23:15.721590042 CET	53	50282	8.8.8.8	192.168.2.13
Feb 15, 2025 13:23:17.282881021 CET	40542	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:23:17.316426039 CET	53	40542	8.8.8.8	192.168.2.13
Feb 15, 2025 13:23:26.862385988 CET	53115	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:23:26.869551897 CET	53	53115	8.8.8.8	192.168.2.13
Feb 15, 2025 13:23:28.424707890 CET	34916	53	192.168.2.13	8.8.8.8
Feb 15, 2025 13:23:28.431838036 CET	53	34916	8.8.8.8	192.168.2.13

Start time (UTC):	12:21:25
Start date (UTC):	15/02/2025
Path:	/tmp/bot.sh4.elf
Arguments:	/tmp/bot.sh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report bot.sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00BSdU (deleted)

/tmp/qemu-open.00NmST (deleted)

/tmp/qemu-open.00rkYV (deleted)

/tmp/qemu-open.01gBtV (deleted)

/tmp/qemu-open.0C6vST (deleted)

/tmp/qemu-open.0GkQSV (deleted)

/tmp/qemu-open.0JgS5V (deleted)

/tmp/qemu-open.0KaTxS (deleted)

/tmp/qemu-open.0L4ZrT (deleted)

/tmp/qemu-open.0LANXS (deleted)

/tmp/qemu-open.0MkiaS (deleted)

/tmp/qemu-open.0N8kaV (deleted)

/tmp/qemu-open.0QgJMS (deleted)

/tmp/qemu-open.0THOvV (deleted)

/tmp/qemu-open.0VEqCS (deleted)

/tmp/qemu-open.0VKSlT (deleted)

/tmp/qemu-open.0ZhQQT (deleted)

/tmp/qemu-open.0eob0T (deleted)

/tmp/qemu-open.0i1jxW (deleted)

/tmp/qemu-open.0jORDV (deleted)

/tmp/qemu-open.0lAkcV (deleted)

/tmp/qemu-open.0nU1eS (deleted)

/tmp/qemu-open.0nbnqT (deleted)

/tmp/qemu-open.0pDfQU (deleted)

/tmp/qemu-open.0rwmrV (deleted)

/tmp/qemu-open.0tJIiW (deleted)

/tmp/qemu-open.0xtEYT (deleted)

/tmp/qemu-open.139zEV (deleted)

/tmp/qemu-open.1FGEvS (deleted)

/tmp/qemu-open.1VQOXS (deleted)

/tmp/qemu-open.1XEmaS (deleted)

Linux Analysis Report
bot.sh4.elf