Create Interactive Tour

Linux Analysis Report
rjfe686.elf

Overview

General Information

Sample name:	rjfe686.elf
Analysis ID:	1630467
MD5:	e7443cb8a37b1c476578e43971de687a
SHA1:	3431b6e77f3a8d11082b83090c53a30abe4c58e9
SHA256:	1d672603551f05053477c2abfac905fda61d0c7415e25eca2e7a8dd59a3d8b99
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1630467
Start date and time:	2025-03-05 22:52:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	rjfe686.elf
Detection:	MAL
Classification:	mal68.spre.troj.evad.linELF@0/54@201/0

Runtime Messages

Command:	/tmp/rjfe686.elf
PID:	6237
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	kovey/cursinq was here, go away!
Standard Error:

Process Tree

system is lnxubuntu20

rjfe686.elf (PID: 6237, Parent: 6161, MD5: e7443cb8a37b1c476578e43971de687a) Arguments: /tmp/rjfe686.elf

rjfe686.elf New Fork (PID: 6238, Parent: 6237)

rjfe686.elf New Fork (PID: 6239, Parent: 6238)

rjfe686.elf New Fork (PID: 6240, Parent: 6238)

rjfe686.elf New Fork (PID: 6241, Parent: 6238)

systemd New Fork (PID: 6262, Parent: 1)

rsyslogd (PID: 6262, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 6264, Parent: 2063)

wrapper-2.0 (PID: 6264, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6265, Parent: 2063)

wrapper-2.0 (PID: 6265, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6266, Parent: 2063)

wrapper-2.0 (PID: 6266, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6267, Parent: 2063)

wrapper-2.0 (PID: 6267, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 6293, Parent: 6267)

xfpm-power-backlight-helper (PID: 6293, Parent: 6267, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6268, Parent: 2063)

wrapper-2.0 (PID: 6268, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6269, Parent: 2063)

wrapper-2.0 (PID: 6269, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

systemd New Fork (PID: 6270, Parent: 1)

rsyslogd (PID: 6270, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

dbus-daemon New Fork (PID: 6289, Parent: 6288)

xfconfd (PID: 6289, Parent: 6288, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 6312, Parent: 1)

rsyslogd (PID: 6312, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6336, Parent: 1)

rsyslogd (PID: 6336, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6341, Parent: 1)

rsyslogd (PID: 6341, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6368, Parent: 1)

rsyslogd (PID: 6368, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6373, Parent: 1)

rsyslogd (PID: 6373, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6396, Parent: 1)

rsyslogd (PID: 6396, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6402, Parent: 1)

rsyslogd (PID: 6402, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6425, Parent: 1)

rsyslogd (PID: 6425, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6445, Parent: 1)

rsyslogd (PID: 6445, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6470, Parent: 1)

rsyslogd (PID: 6470, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6487, Parent: 1)

rsyslogd (PID: 6487, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6513, Parent: 1)

rsyslogd (PID: 6513, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6536, Parent: 1)

rsyslogd (PID: 6536, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6557, Parent: 1)

rsyslogd (PID: 6557, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6581, Parent: 1)

rsyslogd (PID: 6581, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6604, Parent: 1)

rsyslogd (PID: 6604, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6629, Parent: 1)

rsyslogd (PID: 6629, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6653, Parent: 1)

rsyslogd (PID: 6653, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6674, Parent: 1)

rsyslogd (PID: 6674, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6696, Parent: 1)

rsyslogd (PID: 6696, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6704, Parent: 1)

rsyslogd (PID: 6704, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6727, Parent: 1)

rsyslogd (PID: 6727, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6752, Parent: 1)

rsyslogd (PID: 6752, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6776, Parent: 1)

rsyslogd (PID: 6776, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6798, Parent: 1)

rsyslogd (PID: 6798, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6820, Parent: 1)

rsyslogd (PID: 6820, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
rjfe686.elf	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x59ff:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
rjfe686.elf	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x59b2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
rjfe686.elf	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x7d6d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x7e0d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
rjfe686.elf	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
rjfe686.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x82a2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
rjfe686.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xbfcb:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6240.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x59ff:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6240.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x59b2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6240.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x7d6d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x7e0d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6240.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6240.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x82a2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6240.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xbfcb:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6241.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x59ff:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6241.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x59b2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6241.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x7d6d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x7e0d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6241.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6241.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x82a2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6241.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xbfcb:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6237.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x59ff:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6237.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x59b2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6237.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x7d6d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x7e0d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6237.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6237.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x82a2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6237.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xbfcb:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 13 entries

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: rjfe686.elf

ReversingLabs: Detection: 44%

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: raw.awaken-network.net. [malformed]

Source: global traffic

TCP traffic: 192.168.2.23:50632 -> 141.98.10.142:7733

Source: /usr/sbin/rsyslogd (PID: 6270)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6312)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6336)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6341)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6368)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6373)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6396)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6402)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6425)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6445)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6470)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6487)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6513)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6536)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6557)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6581)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6604)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6629)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6653)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6674)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6696)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6704)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6727)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6752)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6776)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6798)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6820)	Reads hosts file: /etc/hosts	Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic	DNS traffic detected: DNS query: raw.awaken-network.net
Source: global traffic	DNS traffic detected: DNS query: raw.awaken-network.net. [malformed]

Source: syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.86.dr, syslog.82.dr, syslog.76.dr, syslog.30.dr, syslog.52.dr, syslog.62.dr, syslog.74.dr, syslog.68.dr, syslog.78.dr, syslog.38.dr, syslog.50.dr, syslog.60.dr, syslog.80.dr, syslog.72.dr, syslog.64.dr, syslog.56.dr, syslog.42.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: rjfe686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: rjfe686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: rjfe686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: rjfe686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: rjfe686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: rjfe686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6240.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6240.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6240.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6240.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6240.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6240.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6241.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6241.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6241.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6241.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6241.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6241.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6237.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6237.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6237.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6237.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6237.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6237.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/rjfe686.elf (PID: 6238)	SIGKILL sent: pid: 6240, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6241, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6241, result: no such process	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6262, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6264, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6265, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6266, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6267, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6268, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6269, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6270, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6289, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6312, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6336, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6341, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6368, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6373, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6396, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6402, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6425, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6445, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6470, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6487, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6513, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6536, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6557, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6581, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6604, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6629, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6653, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6674, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6696, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6704, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6727, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6776, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6798, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /proc/EOF/proc/%d/exe/proc/%d/stat/proc/%d/mapssys_monitor_cnrbusyboxadbddockerdBlink_Cloudsystemdhttpsshdbashmsg_centerlte_mgrmain_mgrpkarm7pkarm5pkarmpkarm6pkmipspkmpslpkx86/var/mnt/root/boot/sbin/home/dev/media/opt/../(deleted)sh4[aquabot_killer_EXE] Killed process: %s, PID: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/rjfe686.elf (PID: 6238)	SIGKILL sent: pid: 6240, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6241, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6241, result: no such process	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6262, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6264, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6265, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6266, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6267, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6268, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6269, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6270, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6289, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6312, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6336, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6341, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6368, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6373, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6396, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6402, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6425, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6445, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6470, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6487, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6513, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6536, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6557, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6581, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6604, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6629, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6653, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6674, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6696, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6704, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6727, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6776, result: successful	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	SIGKILL sent: pid: 6798, result: successful	Jump to behavior

Source: rjfe686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: rjfe686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: rjfe686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: rjfe686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: rjfe686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: rjfe686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6240.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6241.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6241.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6237.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6237.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6237.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6237.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6237.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6237.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26

Source: classification engine

Classification label: mal68.spre.troj.evad.linELF@0/54@201/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6265)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6266)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6267)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6268)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6269)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6289)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6289)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6289)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6289)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/6351/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/6350/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/6353/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/6352/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/6355/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/6354/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/6357/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/6356/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/6107/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/6107/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/6107/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/6349/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/rjfe686.elf (PID: 6239)	File opened: /proc/11/stat	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6270)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6312)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6336)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6341)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6368)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6373)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6396)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6402)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6425)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6445)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6470)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6487)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6513)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6536)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6557)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6581)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6604)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6629)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6653)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6674)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6696)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6704)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6727)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6752)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6776)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6798)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6820)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/rjfe686.elf (PID: 6238)

File: /tmp/rjfe686.elf

Jump to behavior

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6265)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6266)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6267)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6268)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6269)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6270)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6312)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6336)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6341)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6368)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6373)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6396)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6402)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6425)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6445)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6470)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6487)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6513)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6536)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6557)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6581)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6604)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6629)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6653)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6674)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6696)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6704)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6727)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6752)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6776)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6798)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6820)	Queries kernel information via 'uname':	Jump to behavior

Source: rjfe686.elf, 6241.1.00000000091f1000.00000000091f8000.rw-.sdmp	Binary or memory string: Q/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f)/tmp/vmware-root_721-4290559889
Source: rjfe686.elf, 6241.1.00000000091f1000.00000000091f8000.rw-.sdmp	Binary or memory string: vmware
Source: rjfe686.elf, 6241.1.00000000091f1000.00000000091f8000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_721-4290559889

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
rjfe686.elf	45%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.awaken-network.net	141.98.10.142	true	false		high
raw.awaken-network.net. [malformed]	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.86.dr, syslog.82.dr, syslog.76.dr, syslog.30.dr, syslog.52.dr, syslog.62.dr, syslog.74.dr, syslog.68.dr, syslog.78.dr, syslog.38.dr, syslog.50.dr, syslog.60.dr, syslog.80.dr, syslog.72.dr, syslog.64.dr, syslog.56.dr, syslog.42.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
141.98.10.142	raw.awaken-network.net	Lithuania	209605	HOSTBALTICLT	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.98.10.142	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
	vejfa5.elf	Get hash	malicious	Unknown	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	jfeeps.elf	Get hash	malicious	Unknown	Browse
	efjepc.elf	Get hash	malicious	Unknown	Browse
	bejv86.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	donk.arm6.elf	Get hash	malicious	Mirai	Browse
	donk.x86.elf	Get hash	malicious	Mirai	Browse
	donk.arm7.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	donk.ppc.elf	Get hash	malicious	Mirai	Browse
	donk.arm.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.awaken-network.net	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
raw.awaken-network.net	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	rrrdsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	donk.mips.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	donk.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	donk.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	donk.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	donk.ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	rrrdsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	donk.mips.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	donk.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	donk.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	donk.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	donk.ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
HOSTBALTICLT	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	eehah4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efefa7.elf	Get hash	malicious	Mirai	Browse	141.98.10.142
	vejfa5.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rjfe686.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efefa7.elf	Get hash	malicious	Mirai	Browse	141.98.10.142
	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	bejv86.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
INIT7CH	rrrdsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	donk.arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	donk.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	donk.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	donk.ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	donk.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	799
Entropy (8bit):	4.699895930356139
Encrypted:	false
SSDEEP:	24:pU524d5fOO5+v85JZi5xeT5awZ5c4d5fAIHSk5sAIHSO:aNdgOJBi7YT/dr30D
MD5:	A338DBC949465D8667C73F334EB356D7
SHA1:	8D2D45436A8E6CEA01D8FC0F88B8EC219E40A85B
SHA-256:	7B51EA11989740102971F1F59362D57E267B9423CF18F57613CB3EEDA3737E5B
SHA-512:	1AADE6173708BA2DAEF9EF1E5EC6783E7E55728D88E172186AFDC808B00C1023215050FC7A978A2F3D0BB0377A81B52A7A5A9DA227F81F1C53E658ED56CDE495
Malicious:	false
Reputation:	low
Preview:	Mar 5 15:55:11 galassia kernel: [ 541.644880] blocking signal 9: 6239 -> 1320.Mar 5 15:55:11 galassia kernel: [ 541.691867] blocking signal 9: 6239 -> 658.Mar 5 15:55:11 galassia kernel: [ 541.699402] blocking signal 9: 6239 -> 772.Mar 5 15:55:11 galassia kernel: [ 541.707098] blocking signal 9: 6239 -> 800.Mar 5 15:55:11 galassia kernel: [ 541.714022] blocking signal 9: 6239 -> 847.Mar 5 15:55:11 galassia kernel: [ 541.721239] blocking signal 9: 6239 -> 936.Mar 5 15:55:11 galassia kernel: [ 541.728432] blocking signal 9: 6239 -> 1320.Mar 5 15:55:11 galassia kernel: [ 541.983567] New task spawned: old: (tgid 6820, tid 6820), new (tgid: 6820, tid: 6821).Mar 5 15:55:11 galassia kernel: [ 541.983713] New task spawned: old: (tgid 6820, tid 6820), new (tgid: 6820, tid: 6822).

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	4.971409882126667
Encrypted:	false
SSDEEP:	24:pF3PD5F0+PKVRj+524d5fOO5+v85JZi5xeT5awZ5c4d5fAIHSk5sAIHSC7kqvT9C:X3FFPPcRyNdgOJBi7YT/dr30H1vHih
MD5:	6F3AB707980CEF46E1326571384DE8D4
SHA1:	4C09BA595C276FE598DBE3474A89F7C32370DEF0
SHA-256:	9A7E34772B1334961E64C98AFB0818F5BF735390427FA8C51355AA35BC17FFE0
SHA-512:	4620AFD280F37EF17C3FA1537A21EDB236D53FA0E05EC1AFB99B1F7C5BC04A07359D63F23F510A4342B25231C0C9A762985E00863D408FA56BB68C5E630A4CBD
Malicious:	false
Reputation:	low
Preview:	Mar 5 15:55:10 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Mar 5 15:55:10 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Mar 5 15:55:11 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 28..Mar 5 15:55:11 galassia systemd[1]: Stopped System Logging Service..Mar 5 15:55:11 galassia systemd[1]: Starting System Logging Service....Mar 5 15:55:11 galassia systemd[1]: Started System Logging Service..Mar 5 15:55:11 galassia kernel: [ 541.644880] blocking signal 9: 6239 -> 1320.Mar 5 15:55:11 galassia kernel: [ 541.691867] blocking signal 9: 6239 -> 658.Mar 5 15:55:11 galassia kernel: [ 541.699402] blocking signal 9: 6239 -> 772.Mar 5 15:55:11 galassia kernel: [ 541.707098] blocking signal 9: 6239 -> 800.Mar 5 15:55:11 galassia kernel: [ 541.714022] blocking signal 9: 6239 -> 847.Mar 5 15:55:11 galassia kernel: [ 541.721239] blocking signal 9: 6239 -> 936.Mar 5 15:55:11 galassia ke

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.624854077957716
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	rjfe686.elf
File size:	109'416 bytes
MD5:	e7443cb8a37b1c476578e43971de687a
SHA1:	3431b6e77f3a8d11082b83090c53a30abe4c58e9
SHA256:	1d672603551f05053477c2abfac905fda61d0c7415e25eca2e7a8dd59a3d8b99
SHA512:	b07101d8f32253d2001042d7d2ba72e2d47d8cba0efed2479ecb895e0b661cb96d51b0c6adb73d8c228856c0b58873a7e988623f17ab61ce5d710199c2ce9602
SSDEEP:	1536:BcCeI64PIZzGINBz7YJvstbG/A+b6zeWYwpMs3UgV88qQc8JHPAj:BcCF64wZDBHevstbGoJjBpMGUgi6Aj
TLSH:	6FB328C0FA8BD1F6D45708714033B33F9A32E4256035DA5EEF9AAE26DA27582961731C
File Content Preview:	.ELF....................h...4...........4. ...(......................a...a...............a...........G..............Q.td............................U..S.......3q...h.....*..[]...$.............U......=.9...t..1...................u........t...$............9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	109016
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x12a31	0x0	0x6	AX	16
.fini	PROGBITS	0x805aae1	0x12ae1	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x805ab00	0x12b00	0x36b3	0x0	0x2	A	32
.ctors	PROGBITS	0x805f1b8	0x161b8	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x805f1c4	0x161c4	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805f1e0	0x161e0	0x47b8	0x0	0x3	WA	32
.bss	NOBITS	0x80639a0	0x1a998	0xc90c	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x1a998	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x161b3	0x161b3	6.3189	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x161b8	0x805f1b8	0x805f1b8	0x47e0	0x110f4	0.4207	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Start time (UTC):	21:53:06
Start date (UTC):	05/03/2025
Path:	/tmp/rjfe686.elf
Arguments:	/tmp/rjfe686.elf
File size:	109416 bytes
MD5 hash:	e7443cb8a37b1c476578e43971de687a

Start time (UTC):	21:53:07
Start date (UTC):	05/03/2025
Path:	/tmp/rjfe686.elf
Arguments:	-
File size:	109416 bytes
MD5 hash:	e7443cb8a37b1c476578e43971de687a

Start time (UTC):	21:53:14
Start date (UTC):	05/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	21:53:13
Start date (UTC):	05/03/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	21:53:15
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:53:20
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:53:21
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:53:26
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:53:27
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:53:32
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:53:33
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:53:38
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:53:43
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:53:48
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:53:53
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:53:59
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report rjfe686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: rjfe686.elf PID: 6237, Parent PID: 6161

General

File Activities

File Opened

File Deleted

File Written

File Moved

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: rjfe686.elf PID: 6238, Parent PID: 6237

General

File Activities

File Deleted

Process Activities

Linux Analysis Report
rjfe686.elf

Start time (UTC):	21:54:04
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:54:09
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:54:14
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:54:19
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:54:24
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:54:29
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:54:35
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:54:40
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:54:45
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:54:50
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75