Edit tour

Linux Analysis Report
boatnet.arm.elf

Overview

General Information

Sample name:boatnet.arm.elf
Analysis ID:1617387
MD5:c7fde8228b2adb2e7d33c053e1c675f7
SHA1:eb48c5ef38693611efd0e080cbe93243865d0c83
SHA256:d0e41be9379106a3277589d56a49786007feb0e63dfbe851559d5353842b0160
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:72
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1617387
Start date and time:2025-02-17 20:57:14 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 5m 6s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:boatnet.arm.elf
Detection:MAL
Classification:mal72.spre.troj.evad.linELF@0/0@2/0
Command:/tmp/boatnet.arm.elf
PID:5434
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:
  • system is lnxubuntu20
  • wrapper-2.0 (PID: 5445, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
  • wrapper-2.0 (PID: 5446, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
  • wrapper-2.0 (PID: 5447, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
  • wrapper-2.0 (PID: 5448, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
    • xfpm-power-backlight-helper (PID: 5467, Parent: 5448, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness
  • wrapper-2.0 (PID: 5449, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
  • wrapper-2.0 (PID: 5450, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
  • xfconfd (PID: 5466, Parent: 5465, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
  • systemd New Fork (PID: 5476, Parent: 2935)
  • xfce4-notifyd (PID: 5476, Parent: 2935, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
5434.1.00007fa45c017000.00007fa45c028000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    5434.1.00007fa45c017000.00007fa45c028000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0xf0f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf12c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf17c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf1a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf1b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf1cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf1e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf1f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf208:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf21c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf230:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf244:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf258:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf26c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xf280:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    5434.1.00007fa45c017000.00007fa45c028000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0xf648:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    5440.1.00007fa45c017000.00007fa45c028000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      5440.1.00007fa45c017000.00007fa45c028000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xf0f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf12c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf17c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf1a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf1b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf1cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf1e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf1f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf208:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf21c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf230:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf244:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf258:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf26c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf280:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      Click to see the 13 entries
      No Suricata rule has matched

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: boatnet.arm.elfReversingLabs: Detection: 32%
      Source: global trafficTCP traffic: 192.168.2.13:34380 -> 5.83.218.12:3778
      Source: global trafficTCP traffic: 192.168.2.13:50886 -> 45.135.194.29:2137
      Source: global trafficTCP traffic: 192.168.2.13:47918 -> 196.251.70.219:43782
      Source: global trafficTCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: unknownTCP traffic detected without corresponding DNS query: 5.83.218.12
      Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
      Source: boatnet.arm.elfString found in binary or memory: http://upx.sf.net
      Source: unknownNetwork traffic detected: HTTP traffic on port 48202 -> 443

      System Summary

      barindex
      Source: 5434.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5434.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 5440.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5440.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 5438.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5438.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: Process Memory Space: boatnet.arm.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: boatnet.arm.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: Process Memory Space: boatnet.arm.elf PID: 5438, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: boatnet.arm.elf PID: 5438, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: Process Memory Space: boatnet.arm.elf PID: 5440, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: boatnet.arm.elf PID: 5440, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3104, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3161, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3162, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3163, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3164, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3165, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3170, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3182, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3208, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3212, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5440, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5445, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5446, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5447, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5448, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5449, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5450, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5466, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5476, result: successfulJump to behavior
      Source: LOAD without section mappingsProgram segment: 0x8000
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3104, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3161, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3162, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3163, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3164, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3165, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3170, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3182, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3208, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 3212, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5440, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5445, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5446, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5447, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5448, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5449, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5450, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5466, result: successfulJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)SIGKILL sent: pid: 5476, result: successfulJump to behavior
      Source: 5434.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5434.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 5440.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5440.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 5438.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5438.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: Process Memory Space: boatnet.arm.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: boatnet.arm.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: Process Memory Space: boatnet.arm.elf PID: 5438, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: boatnet.arm.elf PID: 5438, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: Process Memory Space: boatnet.arm.elf PID: 5440, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: boatnet.arm.elf PID: 5440, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: classification engineClassification label: mal72.spre.troj.evad.linELF@0/0@2/0

      Data Obfuscation

      barindex
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5445)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5446)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5447)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/local/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /home/saturnino/.fonts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/X11/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/type1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /home/saturnino/.cacheJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /home/saturnino/.localJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Directory: /home/saturnino/.configJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5466)Directory: /home/saturnino/.cacheJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5466)Directory: /home/saturnino/.localJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5466)Directory: /home/saturnino/.configJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5466)Directory: /home/saturnino/.configJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5476)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5476)Directory: /home/saturnino/.cacheJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5476)Directory: /home/saturnino/.localJump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5476)Directory: /home/saturnino/.configJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5147/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3122/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3117/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3114/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5414/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/914/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/518/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5416/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/519/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3635/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/917/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5273/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3134/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3375/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3132/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3095/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1745/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1866/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1588/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/884/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1982/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/765/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3246/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/767/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/800/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3762/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1906/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/802/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/803/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1748/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5440/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3420/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1482/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/490/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1480/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1755/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1238/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1875/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/2964/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3413/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1751/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1872/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/2961/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1475/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/656/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/778/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/657/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/658/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/659/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/418/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/936/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/419/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/816/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1879/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5570/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5450/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1891/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3310/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3153/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/780/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/660/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1921/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/783/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1765/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/2974/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3707/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1400/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1884/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3424/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3708/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/2972/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3709/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3147/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/2970/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1881/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3146/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3300/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5445/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5446/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5447/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1805/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5448/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5569/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1925/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1804/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5449/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1648/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1922/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3429/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/5466/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3442/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3165/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3164/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3163/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3162/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/790/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3161/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/792/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/793/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/672/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1930/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/674/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/795/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/3315/cmdlineJump to behavior
      Source: /tmp/boatnet.arm.elf (PID: 5436)File opened: /proc/1411/cmdlineJump to behavior
      Source: boatnet.arm.elfSubmission file: segment LOAD with 7.9408 entropy (max. 8.0)
      Source: /tmp/boatnet.arm.elf (PID: 5434)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5445)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5446)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5447)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5448)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5449)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5450)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5476)Queries kernel information via 'uname': Jump to behavior
      Source: boatnet.arm.elf, 5434.1.00005587fd548000.00005587fd6b6000.rw-.sdmp, boatnet.arm.elf, 5438.1.00005587fd548000.00005587fd6b6000.rw-.sdmp, boatnet.arm.elf, 5440.1.00005587fd548000.00005587fd6b6000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/arm
      Source: boatnet.arm.elf, 5434.1.00005587fd548000.00005587fd6b6000.rw-.sdmp, boatnet.arm.elf, 5438.1.00005587fd548000.00005587fd6b6000.rw-.sdmp, boatnet.arm.elf, 5440.1.00005587fd548000.00005587fd6b6000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
      Source: boatnet.arm.elf, 5434.1.00007fffe13b5000.00007fffe13d6000.rw-.sdmp, boatnet.arm.elf, 5438.1.00007fffe13b5000.00007fffe13d6000.rw-.sdmp, boatnet.arm.elf, 5440.1.00007fffe13b5000.00007fffe13d6000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm
      Source: boatnet.arm.elf, 5434.1.00007fffe13b5000.00007fffe13d6000.rw-.sdmp, boatnet.arm.elf, 5438.1.00007fffe13b5000.00007fffe13d6000.rw-.sdmp, boatnet.arm.elf, 5440.1.00007fffe13b5000.00007fffe13d6000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/boatnet.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.arm.elf

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: 5434.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5440.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5438.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: boatnet.arm.elf PID: 5434, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: boatnet.arm.elf PID: 5438, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: boatnet.arm.elf PID: 5440, type: MEMORYSTR

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: 5434.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5440.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5438.1.00007fa45c017000.00007fa45c028000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: boatnet.arm.elf PID: 5434, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: boatnet.arm.elf PID: 5438, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: boatnet.arm.elf PID: 5440, type: MEMORYSTR
      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
      Hidden Files and Directories
      1
      OS Credential Dumping
      11
      Security Software Discovery
      Remote ServicesData from Local System1
      Encrypted Channel
      Exfiltration Over Other Network Medium1
      Service Stop
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts11
      Obfuscated Files or Information
      LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
      Non-Standard Port
      Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
      Non-Application Layer Protocol
      Automated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture2
      Application Layer Protocol
      Traffic DuplicationData Destruction
      No configs have been found
      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1617387 Sample: boatnet.arm.elf Startdate: 17/02/2025 Architecture: LINUX Score: 72 24 196.251.70.219, 43782, 47918 Web4AfricaZA Seychelles 2->24 26 45.135.194.29, 2137, 50886 SKYLINKCZ Germany 2->26 28 3 other IPs or domains 2->28 30 Malicious sample detected (through community Yara rule) 2->30 32 Multi AV Scanner detection for submitted file 2->32 34 Yara detected Mirai 2->34 36 Sample is packed with UPX 2->36 7 boatnet.arm.elf 2->7         started        9 xfce4-panel wrapper-2.0 2->9         started        11 xfce4-panel wrapper-2.0 2->11         started        13 6 other processes 2->13 signatures3 process4 process5 15 boatnet.arm.elf 7->15         started        18 boatnet.arm.elf 7->18         started        20 boatnet.arm.elf 7->20         started        22 wrapper-2.0 xfpm-power-backlight-helper 9->22         started        signatures6 38 Sample tries to kill multiple processes (SIGKILL) 15->38

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand
      SourceDetectionScannerLabelLink
      boatnet.arm.elf32%ReversingLabsLinux.Trojan.Mirai
      No Antivirus matches
      No Antivirus matches
      No Antivirus matches

      Download Network PCAP: filteredfull

      NameIPActiveMaliciousAntivirus DetectionReputation
      daisy.ubuntu.com
      162.213.35.24
      truefalse
        high
        NameSourceMaliciousAntivirus DetectionReputation
        http://upx.sf.netboatnet.arm.elffalse
          high
          • No. of IPs < 25%
          • 25% < No. of IPs < 50%
          • 50% < No. of IPs < 75%
          • 75% < No. of IPs
          IPDomainCountryFlagASNASN NameMalicious
          45.135.194.29
          unknownGermany
          213030SKYLINKCZfalse
          196.251.70.219
          unknownSeychelles
          327813Web4AfricaZAfalse
          185.125.190.26
          unknownUnited Kingdom
          41231CANONICAL-ASGBfalse
          5.83.218.12
          unknownUnited Kingdom
          51059BRIGHTBOX-ASGBfalse
          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
          185.125.190.26x86_64.elfGet hashmaliciousMirai, MoobotBrowse
            sh4.elfGet hashmaliciousUnknownBrowse
              kre4per.mpsl.elfGet hashmaliciousUnknownBrowse
                kre4per.x86.elfGet hashmaliciousUnknownBrowse
                  kre4per.arm7.elfGet hashmaliciousMiraiBrowse
                    sh4.elfGet hashmaliciousUnknownBrowse
                      na.elfGet hashmaliciousPrometeiBrowse
                        a-r.m-4.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                          m-6.8-k.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                            main_x86.elfGet hashmaliciousMiraiBrowse
                              5.83.218.12boatnet.x86.elfGet hashmaliciousMiraiBrowse
                                boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                  boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                    boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                      5.83.218.12-boatnet.x86-2025-02-14T10_12_14.elfGet hashmaliciousMiraiBrowse
                                        5.83.218.12-boatnet.arm-2025-02-08T08_23_58.elfGet hashmaliciousMiraiBrowse
                                          boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                            boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              daisy.ubuntu.comna.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 162.213.35.24
                                              arm5.elfGet hashmaliciousUnknownBrowse
                                              • 162.213.35.25
                                              arm6.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 162.213.35.24
                                              cron.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 162.213.35.25
                                              sh.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 162.213.35.24
                                              pftp.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 162.213.35.25
                                              tftp.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 162.213.35.24
                                              sshd.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 162.213.35.24
                                              bash.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 162.213.35.25
                                              apache2.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 162.213.35.24
                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              BRIGHTBOX-ASGBboatnet.x86.elfGet hashmaliciousMiraiBrowse
                                              • 5.83.218.12
                                              boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                              • 5.83.218.12
                                              boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                              • 5.83.218.12
                                              boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                              • 5.83.218.12
                                              https://account.apscan.orgGet hashmaliciousHTMLPhisherBrowse
                                              • 37.230.62.64
                                              5.83.218.12-boatnet.x86-2025-02-14T10_12_14.elfGet hashmaliciousMiraiBrowse
                                              • 5.83.218.12
                                              5.83.218.12-boatnet.arm-2025-02-08T08_23_58.elfGet hashmaliciousMiraiBrowse
                                              • 5.83.218.12
                                              boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                                              • 5.83.218.12
                                              boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                              • 5.83.218.12
                                              Clienter.dll.dllGet hashmaliciousUnknownBrowse
                                              • 109.107.35.154
                                              CANONICAL-ASGBna.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              ub8ehJSePAfc9FYqZIT6.arc.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              ub8ehJSePAfc9FYqZIT6.spc.elfGet hashmaliciousMiraiBrowse
                                              • 91.189.91.42
                                              ub8ehJSePAfc9FYqZIT6.mpsl.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              na.elfGet hashmaliciousPrometeiBrowse
                                              • 91.189.91.42
                                              ub8ehJSePAfc9FYqZIT6.x86.elfGet hashmaliciousUnknownBrowse
                                              • 91.189.91.42
                                              Web4AfricaZAinspection_draft.jsGet hashmaliciousRemcosBrowse
                                              • 196.251.92.64
                                              Purchase Order_36718933PDF.exeGet hashmaliciousXWormBrowse
                                              • 196.251.90.21
                                              SWIFT COPY.jsGet hashmaliciousFormBookBrowse
                                              • 196.251.92.64
                                              res.spc.elfGet hashmaliciousUnknownBrowse
                                              • 102.135.52.83
                                              hide.sh4.elfGet hashmaliciousUnknownBrowse
                                              • 196.251.67.134
                                              hide.m68k.elfGet hashmaliciousUnknownBrowse
                                              • 196.251.67.134
                                              hide.mpsl.elfGet hashmaliciousUnknownBrowse
                                              • 196.251.67.134
                                              hide.arm6.elfGet hashmaliciousUnknownBrowse
                                              • 196.251.67.134
                                              hide.ppc.elfGet hashmaliciousUnknownBrowse
                                              • 196.251.67.134
                                              hide.mips.elfGet hashmaliciousUnknownBrowse
                                              • 196.251.67.134
                                              SKYLINKCZnetworkrip.mips.elfGet hashmaliciousMirai, GafgytBrowse
                                              • 45.135.194.61
                                              networkrip.armv7l.elfGet hashmaliciousMirai, GafgytBrowse
                                              • 45.135.194.61
                                              networkrip.x86.elfGet hashmaliciousMirai, GafgytBrowse
                                              • 45.135.194.61
                                              networkrip.arm4.elfGet hashmaliciousMirai, GafgytBrowse
                                              • 45.135.194.61
                                              networkrip.ppc.elfGet hashmaliciousMirai, GafgytBrowse
                                              • 45.135.194.61
                                              networkrip.arm5.elfGet hashmaliciousMirai, GafgytBrowse
                                              • 45.135.194.61
                                              networkrip.mpsl.elfGet hashmaliciousMirai, GafgytBrowse
                                              • 45.135.194.61
                                              networkrip.sparc.elfGet hashmaliciousMirai, GafgytBrowse
                                              • 45.135.194.61
                                              No context
                                              No context
                                              No created / dropped files found
                                              File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
                                              Entropy (8bit):7.936886258465793
                                              TrID:
                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                              File name:boatnet.arm.elf
                                              File size:26'776 bytes
                                              MD5:c7fde8228b2adb2e7d33c053e1c675f7
                                              SHA1:eb48c5ef38693611efd0e080cbe93243865d0c83
                                              SHA256:d0e41be9379106a3277589d56a49786007feb0e63dfbe851559d5353842b0160
                                              SHA512:c122715c5a2e17e0795dc27eec37c58c075c7665c1084521f5d3c4c071665c20040a205e6ee8f58dac847f846d6cea8fe9f570b8038c7e0ebd81866e97f9ce82
                                              SSDEEP:768:RRTirMYkp/fMFTbZBmDmt9l6oChs3Uozhs:TMEmhwrozzhs
                                              TLSH:4BC2E1E17D57EC67DA1001388DF8D48B6A62347E52F3727310B75060E6DA94B6CB40DB
                                              File Content Preview:.ELF...a..........(.........4...........4. ...(......................g...g...............+...+...+..................Q.td............................s.y.UPX!........4...4.......S..........?.E.h;.}...^..........f..J.I~....S...w..'PI..qg_'..._.........Wun.;.

                                              ELF header

                                              Class:ELF32
                                              Data:2's complement, little endian
                                              Version:1 (current)
                                              Machine:ARM
                                              Version Number:0x1
                                              Type:EXEC (Executable file)
                                              OS/ABI:ARM - ABI
                                              ABI Version:0
                                              Entry Point Address:0xd5d8
                                              Flags:0x202
                                              ELF Header Size:52
                                              Program Header Offset:52
                                              Program Header Size:32
                                              Number of Program Headers:3
                                              Section Header Offset:0
                                              Section Header Size:40
                                              Number of Section Headers:0
                                              Header String Table Index:0
                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                              LOAD0x00x80000x80000x67870x67877.94080x5R E0x8000
                                              LOAD0x2b040x22b040x22b040x00x00.00000x6RW 0x8000
                                              GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                              Download Network PCAP: filteredfull

                                              • Total Packets: 60
                                              • 43782 undefined
                                              • 3778 undefined
                                              • 2137 undefined
                                              • 443 (HTTPS)
                                              • 53 (DNS)
                                              TimestampSource PortDest PortSource IPDest IP
                                              Feb 17, 2025 20:57:56.687932014 CET343803778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:56.692833900 CET3778343805.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:56.692923069 CET343803778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:56.754378080 CET343803778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:56.759407997 CET3778343805.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:56.759471893 CET343803778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:56.764405966 CET3778343805.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:57.291405916 CET3778343805.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:57.291974068 CET343803778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:57.291974068 CET343803778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:57.292531967 CET343823778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:57.297513962 CET3778343825.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:57.297642946 CET343823778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:57.298728943 CET343823778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:57.303554058 CET3778343825.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:57.303641081 CET343823778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:57.308423996 CET3778343825.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:57.945203066 CET3778343825.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:57.945470095 CET343823778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:57.945471048 CET343823778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:57.946193933 CET343843778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:57.951049089 CET3778343845.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:57.951143026 CET343843778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:57.952325106 CET343843778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:57.957189083 CET3778343845.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:57.957278967 CET343843778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:57.962074041 CET3778343845.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:58.559597969 CET3778343845.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:58.559932947 CET343843778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:58.559973955 CET343843778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:58.560921907 CET343863778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:58.565978050 CET3778343865.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:58.566051006 CET343863778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:58.567727089 CET343863778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:58.572649956 CET3778343865.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:58.572778940 CET343863778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:58.577609062 CET3778343865.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:59.309514999 CET3778343865.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:59.309792995 CET343863778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:59.309792995 CET343863778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:59.310425043 CET343883778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:59.315341949 CET3778343885.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:59.315443993 CET343883778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:59.316354990 CET343883778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:59.321301937 CET3778343885.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:59.321389914 CET343883778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:59.326224089 CET3778343885.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:59.953241110 CET3778343885.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:59.953480959 CET343883778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:59.953481913 CET343883778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:59.954209089 CET343903778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:59.959049940 CET3778343905.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:59.959115028 CET343903778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:59.960180044 CET343903778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:59.965096951 CET3778343905.83.218.12192.168.2.13
                                              Feb 17, 2025 20:57:59.965162039 CET343903778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:57:59.970030069 CET3778343905.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:00.581995964 CET3778343905.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:00.582304955 CET343903778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:00.582304955 CET343903778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:00.582981110 CET343923778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:00.587860107 CET3778343925.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:00.588057041 CET343923778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:00.589063883 CET343923778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:00.593883991 CET3778343925.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:00.593930006 CET343923778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:00.598730087 CET3778343925.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:01.204451084 CET3778343925.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:01.204626083 CET343923778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:01.204626083 CET343923778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:01.205318928 CET343943778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:01.210205078 CET3778343945.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:01.210299969 CET343943778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:01.211514950 CET343943778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:01.216361046 CET3778343945.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:01.216427088 CET343943778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:01.221292019 CET3778343945.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:01.799237967 CET3778343945.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:01.799319029 CET343943778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:01.799374104 CET343943778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:01.800220013 CET343963778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:01.805094004 CET3778343965.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:01.805166960 CET343963778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:01.806802988 CET343963778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:01.811625004 CET3778343965.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:01.811686993 CET343963778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:01.816492081 CET3778343965.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:02.400367022 CET343963778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:02.407413006 CET3778343965.83.218.12192.168.2.13
                                              Feb 17, 2025 20:58:02.407572985 CET343963778192.168.2.135.83.218.12
                                              Feb 17, 2025 20:58:07.077159882 CET48202443192.168.2.13185.125.190.26
                                              Feb 17, 2025 20:58:38.565390110 CET48202443192.168.2.13185.125.190.26
                                              Feb 17, 2025 20:58:59.989130974 CET21375088645.135.194.29192.168.2.13
                                              Feb 17, 2025 20:58:59.989475965 CET508862137192.168.2.1345.135.194.29
                                              Feb 17, 2025 20:59:08.181221962 CET4378247918196.251.70.219192.168.2.13
                                              Feb 17, 2025 20:59:08.181746960 CET4791843782192.168.2.13196.251.70.219
                                              TimestampSource PortDest PortSource IPDest IP
                                              Feb 17, 2025 21:00:41.758865118 CET4411653192.168.2.131.1.1.1
                                              Feb 17, 2025 21:00:41.758939981 CET5119453192.168.2.131.1.1.1
                                              Feb 17, 2025 21:00:41.766238928 CET53511941.1.1.1192.168.2.13
                                              Feb 17, 2025 21:00:41.767263889 CET53441161.1.1.1192.168.2.13
                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                              Feb 17, 2025 21:00:41.758865118 CET192.168.2.131.1.1.10xb3fStandard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                              Feb 17, 2025 21:00:41.758939981 CET192.168.2.131.1.1.10x48f4Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                              Feb 17, 2025 21:00:41.767263889 CET1.1.1.1192.168.2.130xb3fNo error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                                              Feb 17, 2025 21:00:41.767263889 CET1.1.1.1192.168.2.130xb3fNo error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false

                                              System Behavior

                                              Start time (UTC):19:57:55
                                              Start date (UTC):17/02/2025
                                              Path:/tmp/boatnet.arm.elf
                                              Arguments:/tmp/boatnet.arm.elf
                                              File size:4956856 bytes
                                              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                              Start time (UTC):19:57:55
                                              Start date (UTC):17/02/2025
                                              Path:/tmp/boatnet.arm.elf
                                              Arguments:-
                                              File size:4956856 bytes
                                              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                              Start time (UTC):19:57:55
                                              Start date (UTC):17/02/2025
                                              Path:/tmp/boatnet.arm.elf
                                              Arguments:-
                                              File size:4956856 bytes
                                              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                              Start time (UTC):19:57:55
                                              Start date (UTC):17/02/2025
                                              Path:/tmp/boatnet.arm.elf
                                              Arguments:-
                                              File size:4956856 bytes
                                              MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                              Start time (UTC):19:58:01
                                              Start date (UTC):17/02/2025
                                              Path:/usr/bin/xfce4-panel
                                              Arguments:-
                                              File size:375768 bytes
                                              MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                              Start time (UTC):19:58:01
                                              Start date (UTC):17/02/2025
                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
                                              File size:35136 bytes
                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                              Start time (UTC):19:58:01
                                              Start date (UTC):17/02/2025
                                              Path:/usr/bin/xfce4-panel
                                              Arguments:-
                                              File size:375768 bytes
                                              MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                              Start time (UTC):19:58:01
                                              Start date (UTC):17/02/2025
                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
                                              File size:35136 bytes
                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                              Start time (UTC):19:58:01
                                              Start date (UTC):17/02/2025
                                              Path:/usr/bin/xfce4-panel
                                              Arguments:-
                                              File size:375768 bytes
                                              MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                              Start time (UTC):19:58:01
                                              Start date (UTC):17/02/2025
                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
                                              File size:35136 bytes
                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                              Start time (UTC):19:58:01
                                              Start date (UTC):17/02/2025
                                              Path:/usr/bin/xfce4-panel
                                              Arguments:-
                                              File size:375768 bytes
                                              MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                              Start time (UTC):19:58:01
                                              Start date (UTC):17/02/2025
                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
                                              File size:35136 bytes
                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                              Start time (UTC):19:58:08
                                              Start date (UTC):17/02/2025
                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                              Arguments:-
                                              File size:35136 bytes
                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                              Start time (UTC):19:58:09
                                              Start date (UTC):17/02/2025
                                              Path:/usr/sbin/xfpm-power-backlight-helper
                                              Arguments:/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
                                              File size:14656 bytes
                                              MD5 hash:3d221ad23f28ca3259f599b1664e2427

                                              Start time (UTC):19:58:01
                                              Start date (UTC):17/02/2025
                                              Path:/usr/bin/xfce4-panel
                                              Arguments:-
                                              File size:375768 bytes
                                              MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                              Start time (UTC):19:58:01
                                              Start date (UTC):17/02/2025
                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
                                              File size:35136 bytes
                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                              Start time (UTC):19:58:01
                                              Start date (UTC):17/02/2025
                                              Path:/usr/bin/xfce4-panel
                                              Arguments:-
                                              File size:375768 bytes
                                              MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                              Start time (UTC):19:58:01
                                              Start date (UTC):17/02/2025
                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
                                              File size:35136 bytes
                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                              Start time (UTC):19:58:08
                                              Start date (UTC):17/02/2025
                                              Path:/usr/bin/dbus-daemon
                                              Arguments:-
                                              File size:249032 bytes
                                              MD5 hash:3089d47e3f3ab84cd81c48fd406d7a8c

                                              Start time (UTC):19:58:08
                                              Start date (UTC):17/02/2025
                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                                              File size:112880 bytes
                                              MD5 hash:4c7a0d6d258bb970905b19b84abcd8e9

                                              Start time (UTC):19:58:13
                                              Start date (UTC):17/02/2025
                                              Path:/usr/lib/systemd/systemd
                                              Arguments:-
                                              File size:1620224 bytes
                                              MD5 hash:9b2bec7092a40488108543f9334aab75

                                              Start time (UTC):19:58:13
                                              Start date (UTC):17/02/2025
                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd
                                              File size:112872 bytes
                                              MD5 hash:eee956f1b227c1d5031f9c61223255d1