Create Interactive Tour

Linux Analysis Report
weje64.elf

Overview

General Information

Sample name:	weje64.elf
Analysis ID:	1630489
MD5:	227bdbc8178019950037e3e09cf0a6a4
SHA1:	651ef595fab3822b0ef705dd7e6c9c962b4707a6
SHA256:	bfbad5219465e0c915ad7113aeee5623aa088fb71c0cdf10cc1b3ff142e6c290
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1630489
Start date and time:	2025-03-05 23:27:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	weje64.elf
Detection:	MAL
Classification:	mal64.spre.evad.linELF@0/54@320/0

Runtime Messages

Command:	/tmp/weje64.elf
PID:	6225
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	kovey/cursinq was here, go away!
Standard Error:

Process Tree

system is lnxubuntu20

weje64.elf (PID: 6225, Parent: 6144, MD5: 227bdbc8178019950037e3e09cf0a6a4) Arguments: /tmp/weje64.elf

weje64.elf New Fork (PID: 6226, Parent: 6225)

weje64.elf New Fork (PID: 6227, Parent: 6226)

weje64.elf New Fork (PID: 6228, Parent: 6226)

weje64.elf New Fork (PID: 6229, Parent: 6226)

systemd New Fork (PID: 6251, Parent: 1)

rsyslogd (PID: 6251, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 6252, Parent: 2063)

wrapper-2.0 (PID: 6252, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6253, Parent: 2063)

wrapper-2.0 (PID: 6253, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6254, Parent: 2063)

wrapper-2.0 (PID: 6254, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6255, Parent: 2063)

wrapper-2.0 (PID: 6255, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 6278, Parent: 6255)

xfpm-power-backlight-helper (PID: 6278, Parent: 6255, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6256, Parent: 2063)

wrapper-2.0 (PID: 6256, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6257, Parent: 2063)

wrapper-2.0 (PID: 6257, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

systemd New Fork (PID: 6258, Parent: 1)

rsyslogd (PID: 6258, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

dbus-daemon New Fork (PID: 6277, Parent: 6276)

xfconfd (PID: 6277, Parent: 6276, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 6302, Parent: 1)

rsyslogd (PID: 6302, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6323, Parent: 1)

rsyslogd (PID: 6323, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6332, Parent: 1)

rsyslogd (PID: 6332, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6356, Parent: 1)

rsyslogd (PID: 6356, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6365, Parent: 1)

rsyslogd (PID: 6365, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6386, Parent: 1)

rsyslogd (PID: 6386, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6392, Parent: 1)

rsyslogd (PID: 6392, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6414, Parent: 1)

rsyslogd (PID: 6414, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6436, Parent: 1)

rsyslogd (PID: 6436, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6459, Parent: 1)

rsyslogd (PID: 6459, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6484, Parent: 1)

rsyslogd (PID: 6484, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6506, Parent: 1)

rsyslogd (PID: 6506, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6531, Parent: 1)

rsyslogd (PID: 6531, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6554, Parent: 1)

rsyslogd (PID: 6554, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6563, Parent: 1)

rsyslogd (PID: 6563, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6589, Parent: 1)

rsyslogd (PID: 6589, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6615, Parent: 1)

rsyslogd (PID: 6615, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6640, Parent: 1)

rsyslogd (PID: 6640, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6663, Parent: 1)

rsyslogd (PID: 6663, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6669, Parent: 1)

rsyslogd (PID: 6669, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6675, Parent: 1)

rsyslogd (PID: 6675, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6697, Parent: 1)

rsyslogd (PID: 6697, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6725, Parent: 1)

rsyslogd (PID: 6725, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6747, Parent: 1)

rsyslogd (PID: 6747, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6770, Parent: 1)

rsyslogd (PID: 6770, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6794, Parent: 1)

rsyslogd (PID: 6794, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
weje64.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf424:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
weje64.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xfc9b:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
weje64.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xbf26:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x11be0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
weje64.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x1395e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
weje64.elf	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x18ac2:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
weje64.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf85b:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
weje64.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x1713e:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
weje64.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xfb26:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
weje64.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x17337:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
weje64.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
weje64.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
weje64.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4f42:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6225.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf424:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6225.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xfc9b:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6225.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xbf26:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x11be0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6225.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x1395e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6225.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x18ac2:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
6225.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf85b:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6225.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x1713e:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6225.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xfb26:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6225.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x17337:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6225.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6225.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6225.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4f42:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6229.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf424:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6229.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xfc9b:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6229.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xbf26:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x11be0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6229.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x1395e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6229.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x18ac2:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
6229.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf85b:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6229.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x1713e:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6229.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xfb26:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6229.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x17337:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6229.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6229.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6229.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4f42:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6228.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xf424:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6228.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xfc9b:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6228.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xbf26:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x11be0:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6228.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x1395e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6228.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x18ac2:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
6228.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xf85b:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6228.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x1713e:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6228.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xfb26:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6228.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x17337:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6228.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6228.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6228.1.0000000000400000.000000000041e000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x4f42:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 31 entries

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: weje64.elf

ReversingLabs: Detection: 44%

Source: global traffic

TCP traffic: 192.168.2.23:50618 -> 141.98.10.142:7733

Source: /usr/sbin/rsyslogd (PID: 6258)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6302)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6323)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6332)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6356)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6365)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6386)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6392)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6414)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6436)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6459)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6484)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6506)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6531)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6554)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6563)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6589)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6615)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6640)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6663)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6669)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6675)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6697)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6725)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6747)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6770)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6794)	Reads hosts file: /etc/hosts	Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic

DNS traffic detected: DNS query: raw.awaken-network.net

Source: syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.86.dr, syslog.82.dr, syslog.76.dr, syslog.52.dr, syslog.62.dr, syslog.74.dr, syslog.68.dr, syslog.78.dr, syslog.38.dr, syslog.50.dr, syslog.32.dr, syslog.60.dr, syslog.80.dr, syslog.72.dr, syslog.64.dr, syslog.56.dr, syslog.42.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/weje64.elf (PID: 6226)	SIGKILL sent: pid: 6228, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6229, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6251, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6252, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6253, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6254, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6255, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6256, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6257, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6258, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6277, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6302, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6323, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6332, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6356, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6365, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6386, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6392, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6414, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6436, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6459, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6484, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6506, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6531, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6554, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6563, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6589, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6615, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6640, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6663, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6669, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6675, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6697, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6725, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6747, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6770, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: A/proc/EOF/proc/%d/exe/proc/%d/stat/proc/%d/mapssys_monitor_cnrbusyboxadbddockerdBlink_Cloudsystemdhttpsshdbashmsg_centerlte_mgrmain_mgrpkarm7pkarm5pkarmpkarm6pkmipspkmpslpkx86/var/mnt/root/boot/sbin/home/dev/media/opt/../(deleted)sh4[aquabot_killer_EXE] Killed process: %s, PID: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/weje64.elf (PID: 6226)	SIGKILL sent: pid: 6228, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6229, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6251, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6252, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6253, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6254, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6255, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6256, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6257, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6258, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6277, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6302, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6323, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6332, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6356, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6365, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6386, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6392, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6414, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6436, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6459, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6484, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6506, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6531, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6554, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6563, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6589, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6615, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6640, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6663, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6669, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6675, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6697, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6725, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6747, result: successful	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	SIGKILL sent: pid: 6770, result: successful	Jump to behavior

Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: weje64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6225.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6229.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6228.1.0000000000400000.000000000041e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.spre.evad.linELF@0/54@320/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6252)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6253)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6254)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6255)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6256)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6256)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6256)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6256)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6257)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6277)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6277)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6277)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6277)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/6351/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/6350/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/6353/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/6352/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/6355/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/6354/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/6356/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/6348/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/6347/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/6349/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/weje64.elf (PID: 6227)	File opened: /proc/12/stat	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6258)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6302)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6323)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6332)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6356)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6365)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6386)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6392)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6414)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6436)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6459)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6484)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6506)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6531)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6554)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6563)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6589)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6615)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6640)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6663)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6669)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6675)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6697)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6725)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6747)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6770)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6794)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/weje64.elf (PID: 6226)

File: /tmp/weje64.elf

Jump to behavior

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6252)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6253)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6254)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6255)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6256)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6257)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6258)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6302)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6323)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6332)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6356)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6365)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6386)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6392)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6414)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6436)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6459)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6484)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6506)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6531)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6554)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6563)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6589)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6615)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6640)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6663)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6669)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6675)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6697)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6725)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6747)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6770)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6794)	Queries kernel information via 'uname':	Jump to behavior

Source: weje64.elf, 6229.1.0000000001c73000.0000000001c7a000.rw-.sdmp	Binary or memory string: vmwareS
Source: weje64.elf, 6229.1.0000000001c73000.0000000001c7a000.rw-.sdmp	Binary or memory string: vmware
Source: weje64.elf, 6229.1.0000000001c72000.0000000001c73000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_721-4290559889
Source: weje64.elf, 6229.1.0000000001c72000.0000000001c73000.rw-.sdmp	Binary or memory string: A/tmp/vmware-root_721-4290559889J

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
weje64.elf	45%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.awaken-network.net	141.98.10.142	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.86.dr, syslog.82.dr, syslog.76.dr, syslog.52.dr, syslog.62.dr, syslog.74.dr, syslog.68.dr, syslog.78.dr, syslog.38.dr, syslog.50.dr, syslog.32.dr, syslog.60.dr, syslog.80.dr, syslog.72.dr, syslog.64.dr, syslog.56.dr, syslog.42.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
141.98.10.142	raw.awaken-network.net	Lithuania	209605	HOSTBALTICLT	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.98.10.142	drea4.elf	Get hash	malicious	Unknown	Browse
	jfeeps.elf	Get hash	malicious	Unknown	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	vjwe68k.elf	Get hash	malicious	Unknown	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	efjepc.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
	vejfa5.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	drea4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	donk.arm6.elf	Get hash	malicious	Mirai	Browse
	donk.x86.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	drea4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	donk.arm6.elf	Get hash	malicious	Mirai	Browse
	donk.x86.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.awaken-network.net	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	drea4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	jfeeps.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	eehah4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	rjfe686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	donk.mips.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
CANONICAL-ASGB	drea4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	jfeeps.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	eehah4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	rjfe686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	donk.mips.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
HOSTBALTICLT	drea4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	eehah4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	vjwe68k.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rjfe686.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	eehah4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efefa7.elf	Get hash	malicious	Mirai	Browse	141.98.10.142
	vejfa5.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
INIT7CH	drea4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	eehah4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	rjfe686.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	donk.arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	donk.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	799
Entropy (8bit):	4.701988261923733
Encrypted:	false
SSDEEP:	24:p6S37knwD8CRwSMdLG2SzO33QAINX9wAIj:Ee4wRxMdS2U63ONXwj
MD5:	03D69ACAA62C27D140DA9F19317A510A
SHA1:	DB3D036B1F3FD1491521A921236D0FD90710B748
SHA-256:	D5D16AED64C41328EFE26F2C1D8FFB4929738404CC1D1FB057822DD3E233D2B7
SHA-512:	130E91C710C11A03932EE30407B368596AE99DA4FA3C6ECFDA2533751B5E038B2C42AE2BDF14A881216068873E85A6774B17630134A8F8CF4499DDDE985DB728
Malicious:	false
Reputation:	low
Preview:	Mar 5 16:30:06 galassia kernel: [ 532.478162] blocking signal 9: 6227 -> 1320.Mar 5 16:30:06 galassia kernel: [ 532.516512] blocking signal 9: 6227 -> 658.Mar 5 16:30:06 galassia kernel: [ 532.525722] blocking signal 9: 6227 -> 772.Mar 5 16:30:06 galassia kernel: [ 532.537847] blocking signal 9: 6227 -> 800.Mar 5 16:30:06 galassia kernel: [ 532.547179] blocking signal 9: 6227 -> 847.Mar 5 16:30:06 galassia kernel: [ 532.556449] blocking signal 9: 6227 -> 936.Mar 5 16:30:06 galassia kernel: [ 532.565233] blocking signal 9: 6227 -> 1320.Mar 5 16:30:06 galassia kernel: [ 532.759705] New task spawned: old: (tgid 6794, tid 6794), new (tgid: 6794, tid: 6795).Mar 5 16:30:06 galassia kernel: [ 532.760097] New task spawned: old: (tgid 6794, tid 6794), new (tgid: 6794, tid: 6796).

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2039
Entropy (8bit):	4.988559193167062
Encrypted:	false
SSDEEP:	48:M3FmVP0Rae4wRxMdS2U63ONXwRfvf4RlVHVBVp:Z0RMhfMlhrr
MD5:	398F9FFBFFC14642EB828745E99A6707
SHA1:	5ECFCEC88CB727F96EDA9C1D8169C38101F6925D
SHA-256:	E89CCD31111978CFAA5F39F1218212BDA2B671E2CBAF08603CD06DC984D423EB
SHA-512:	769FBCF38AE0890FD4877E63B10E1088C8A87E1CB1FC79B8BC20F7FBFA23A15E6C6074303A84CDC0E28139A7A3D5FCCFC753472DEE9FAD093BB0D151BDCABBE3
Malicious:	false
Reputation:	low
Preview:	Mar 5 16:30:06 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Mar 5 16:30:06 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Mar 5 16:30:06 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 28..Mar 5 16:30:06 galassia systemd[1]: Stopped System Logging Service..Mar 5 16:30:06 galassia systemd[1]: Starting System Logging Service....Mar 5 16:30:06 galassia systemd[1]: Started System Logging Service..Mar 5 16:30:06 galassia kernel: [ 532.478162] blocking signal 9: 6227 -> 1320.Mar 5 16:30:06 galassia kernel: [ 532.516512] blocking signal 9: 6227 -> 658.Mar 5 16:30:06 galassia kernel: [ 532.525722] blocking signal 9: 6227 -> 772.Mar 5 16:30:06 galassia kernel: [ 532.537847] blocking signal 9: 6227 -> 800.Mar 5 16:30:06 galassia kernel: [ 532.547179] blocking signal 9: 6227 -> 847.Mar 5 16:30:06 galassia kernel: [ 532.556449] blocking signal 9: 6227 -> 936.Mar 5 16:30:06 galassia ke

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.165215258727304
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	weje64.elf
File size:	160'136 bytes
MD5:	227bdbc8178019950037e3e09cf0a6a4
SHA1:	651ef595fab3822b0ef705dd7e6c9c962b4707a6
SHA256:	bfbad5219465e0c915ad7113aeee5623aa088fb71c0cdf10cc1b3ff142e6c290
SHA512:	5de51e6b17101323cb9e544163fa6ec5b6571d86186ce1ff0721e15c4f2302bb153beacd1a3ad7b98ad319af4e5f6bb975b5cd6a12549c33da2287d897fb82c8
SSDEEP:	3072:zG0KSkBr3wg5KG5jDQz84jWxn/KJpWUER2pjoDilN+ZMG9o:zG0KSCr3wg5Kl9+wEMpoOG9o
TLSH:	95F34B0BB4C188FDC5DAC1744BAEB93AD971F11D1138B26B27D4EA222E4DE315F2DA50
File Content Preview:	.ELF..............>.......@.....@........o..........@.8...@.......................@.......@...............................................Q.......Q.............................Q.td....................................................H...._....:...H........

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	159496
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x19166	0x0	0x6	AX	16
.fini	PROGBITS	0x419266	0x19266	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x419280	0x19280	0x4540	0x0	0x2	A	32
.ctors	PROGBITS	0x51e000	0x1e000	0x18	0x0	0x3	WA	8
.dtors	PROGBITS	0x51e018	0x1e018	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x51e040	0x1e040	0x8e88	0x0	0x3	WA	32
.bss	NOBITS	0x526ee0	0x26ec8	0xf0a0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x26ec8	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1d7c0	0x1d7c0	6.2317	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x1e000	0x51e000	0x51e000	0x8ec8	0x17f80	0.2518	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 5, 2025 23:28:03.540738106 CET	8.8.8.8	192.168.2.23	0x8c02	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:28:03.552630901 CET	8.8.8.8	192.168.2.23	0xc08b	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:28.277302027 CET	8.8.8.8	192.168.2.23	0x318b	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:29.217279911 CET	8.8.8.8	192.168.2.23	0x3fe0	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:29.964718103 CET	8.8.8.8	192.168.2.23	0x1533	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:30.707811117 CET	8.8.8.8	192.168.2.23	0x9dcf	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:31.440188885 CET	8.8.8.8	192.168.2.23	0x744e	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:32.162014008 CET	8.8.8.8	192.168.2.23	0xc5d2	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:32.892175913 CET	8.8.8.8	192.168.2.23	0x5a24	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:33.625817060 CET	8.8.8.8	192.168.2.23	0x24bf	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:34.348424911 CET	8.8.8.8	192.168.2.23	0x1bd4	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:35.093157053 CET	8.8.8.8	192.168.2.23	0xa539	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:36.326560974 CET	8.8.8.8	192.168.2.23	0x474e	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:37.049313068 CET	8.8.8.8	192.168.2.23	0x911b	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:37.776216030 CET	8.8.8.8	192.168.2.23	0x5a35	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:38.535244942 CET	8.8.8.8	192.168.2.23	0x46c8	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:39.286907911 CET	8.8.8.8	192.168.2.23	0xd23f	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:40.030304909 CET	8.8.8.8	192.168.2.23	0xf2a5	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:40.769222021 CET	8.8.8.8	192.168.2.23	0xc3ed	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:41.503792048 CET	8.8.8.8	192.168.2.23	0x305c	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:42.238668919 CET	8.8.8.8	192.168.2.23	0xb726	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:42.999130964 CET	8.8.8.8	192.168.2.23	0xde03	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:43.752162933 CET	8.8.8.8	192.168.2.23	0xbc3e	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:44.500825882 CET	8.8.8.8	192.168.2.23	0x8a94	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:45.225753069 CET	8.8.8.8	192.168.2.23	0xd382	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:45.935362101 CET	8.8.8.8	192.168.2.23	0x4ea0	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:46.662803888 CET	8.8.8.8	192.168.2.23	0xaab3	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:47.385526896 CET	8.8.8.8	192.168.2.23	0x1b31	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:48.119180918 CET	8.8.8.8	192.168.2.23	0x6c2a	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:48.850364923 CET	8.8.8.8	192.168.2.23	0xfd61	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:49.574198961 CET	8.8.8.8	192.168.2.23	0x7bb8	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:50.323321104 CET	8.8.8.8	192.168.2.23	0x386a	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:51.110759974 CET	8.8.8.8	192.168.2.23	0x3e4f	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:51.839097977 CET	8.8.8.8	192.168.2.23	0x4d17	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:52.593225002 CET	8.8.8.8	192.168.2.23	0x3655	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:53.338412046 CET	8.8.8.8	192.168.2.23	0xe89d	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:54.084647894 CET	8.8.8.8	192.168.2.23	0x6e6a	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:54.815411091 CET	8.8.8.8	192.168.2.23	0xc8e5	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:55.576709032 CET	8.8.8.8	192.168.2.23	0xb4f6	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:56.325886965 CET	8.8.8.8	192.168.2.23	0x3244	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:57.081584930 CET	8.8.8.8	192.168.2.23	0xc7e3	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:57.811373949 CET	8.8.8.8	192.168.2.23	0x8670	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:58.572390079 CET	8.8.8.8	192.168.2.23	0x682e	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:29:59.311321974 CET	8.8.8.8	192.168.2.23	0x8c1a	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:30:00.085293055 CET	8.8.8.8	192.168.2.23	0x3aa2	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:30:00.831880093 CET	8.8.8.8	192.168.2.23	0xd960	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:30:01.573136091 CET	8.8.8.8	192.168.2.23	0x18b	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:30:02.310314894 CET	8.8.8.8	192.168.2.23	0xb9c2	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:30:03.042642117 CET	8.8.8.8	192.168.2.23	0xac6f	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:30:03.794526100 CET	8.8.8.8	192.168.2.23	0xe430	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:30:04.528076887 CET	8.8.8.8	192.168.2.23	0xbedc	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:30:05.280914068 CET	8.8.8.8	192.168.2.23	0x9633	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:30:06.023251057 CET	8.8.8.8	192.168.2.23	0xc85b	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:30:06.750876904 CET	8.8.8.8	192.168.2.23	0x5e1e	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:30:07.481235027 CET	8.8.8.8	192.168.2.23	0x4271	No error (0)	raw.awaken-network.net	141.98.10.142	A (IP address)	IN (0x0001)	false

Start time (UTC):	22:28:03
Start date (UTC):	05/03/2025
Path:	/tmp/weje64.elf
Arguments:	/tmp/weje64.elf
File size:	160136 bytes
MD5 hash:	227bdbc8178019950037e3e09cf0a6a4

Start time (UTC):	22:28:11
Start date (UTC):	05/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	22:28:14
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:28:19
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:28:21
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:28:26
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:28:27
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:28:32
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:28:33
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:28:38
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:28:43
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:28:48
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:28:53
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:28:58
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:29:04
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report weje64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: weje64.elf PID: 6225, Parent PID: 6144

General

File Activities

File Opened

File Deleted

File Written

File Moved

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: weje64.elf PID: 6226, Parent PID: 6225

General

File Activities

File Deleted

Process Activities

Linux Analysis Report
weje64.elf

Start time (UTC):	22:29:09
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:29:14
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:29:19
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:29:24
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:29:29
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:29:35
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:29:36
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:29:41
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:29:46
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:29:51
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75