Create Interactive Tour

Linux Analysis Report
bejv86.elf

Overview

General Information

Sample name:	bejv86.elf
Analysis ID:	1630499
MD5:	cb6cbec917fc2ebcf2ac8c6fda57235d
SHA1:	c7e4c19b8930d1ddb43d3ba9e36259abf8bc1e16
SHA256:	ca858d47f348e68a8ef7f562e6942a14822e4d014e131b103f10ad3dd87adc2c
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1630499
Start date and time:	2025-03-05 23:42:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	bejv86.elf
Detection:	MAL
Classification:	mal68.spre.troj.evad.linELF@0/54@161/0

Runtime Messages

Command:	/tmp/bejv86.elf
PID:	6242
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	kovey/cursinq was here, go away!
Standard Error:

Process Tree

system is lnxubuntu20

bejv86.elf (PID: 6242, Parent: 6165, MD5: cb6cbec917fc2ebcf2ac8c6fda57235d) Arguments: /tmp/bejv86.elf

bejv86.elf New Fork (PID: 6245, Parent: 6242)

bejv86.elf New Fork (PID: 6246, Parent: 6245)

bejv86.elf New Fork (PID: 6247, Parent: 6245)

bejv86.elf New Fork (PID: 6248, Parent: 6245)

systemd New Fork (PID: 6271, Parent: 1)

rsyslogd (PID: 6271, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 6272, Parent: 2063)

wrapper-2.0 (PID: 6272, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6273, Parent: 2063)

wrapper-2.0 (PID: 6273, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6274, Parent: 2063)

wrapper-2.0 (PID: 6274, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6275, Parent: 2063)

wrapper-2.0 (PID: 6275, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 6302, Parent: 6275)

xfpm-power-backlight-helper (PID: 6302, Parent: 6275, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6276, Parent: 2063)

wrapper-2.0 (PID: 6276, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6277, Parent: 2063)

wrapper-2.0 (PID: 6277, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

systemd New Fork (PID: 6278, Parent: 1)

rsyslogd (PID: 6278, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

dbus-daemon New Fork (PID: 6297, Parent: 6296)

xfconfd (PID: 6297, Parent: 6296, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 6318, Parent: 1)

rsyslogd (PID: 6318, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6338, Parent: 1)

rsyslogd (PID: 6338, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6346, Parent: 1)

rsyslogd (PID: 6346, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6356, Parent: 1)

rsyslogd (PID: 6356, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6362, Parent: 1)

rsyslogd (PID: 6362, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6384, Parent: 1)

rsyslogd (PID: 6384, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6390, Parent: 1)

rsyslogd (PID: 6390, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6413, Parent: 1)

rsyslogd (PID: 6413, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6435, Parent: 1)

rsyslogd (PID: 6435, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6458, Parent: 1)

rsyslogd (PID: 6458, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6480, Parent: 1)

rsyslogd (PID: 6480, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6505, Parent: 1)

rsyslogd (PID: 6505, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6525, Parent: 1)

rsyslogd (PID: 6525, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6549, Parent: 1)

rsyslogd (PID: 6549, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6571, Parent: 1)

rsyslogd (PID: 6571, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6588, Parent: 1)

rsyslogd (PID: 6588, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6594, Parent: 1)

rsyslogd (PID: 6594, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6618, Parent: 1)

rsyslogd (PID: 6618, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6640, Parent: 1)

rsyslogd (PID: 6640, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6665, Parent: 1)

rsyslogd (PID: 6665, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6686, Parent: 1)

rsyslogd (PID: 6686, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6709, Parent: 1)

rsyslogd (PID: 6709, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6730, Parent: 1)

rsyslogd (PID: 6730, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6752, Parent: 1)

rsyslogd (PID: 6752, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6772, Parent: 1)

rsyslogd (PID: 6772, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6794, Parent: 1)

rsyslogd (PID: 6794, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
bejv86.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4ab0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
bejv86.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x9515:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
bejv86.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7062:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
bejv86.elf	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
bejv86.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc749:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
bejv86.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xad0b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
bejv86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7032:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6242.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4ab0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6242.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x9515:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
6242.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7062:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6242.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6242.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc749:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6242.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xad0b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6242.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7032:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6248.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4ab0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6248.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x9515:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
6248.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7062:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6248.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6248.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc749:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6248.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xad0b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6248.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7032:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6247.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4ab0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6247.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x9515:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
6247.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7062:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6247.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6247.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc749:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6247.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xad0b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6247.1.0000000008048000.000000000805d000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7032:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 16 entries

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: bejv86.elf

ReversingLabs: Detection: 44%

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: raw.awaken-network.net. [malformed]

Source: global traffic

TCP traffic: 192.168.2.23:50628 -> 141.98.10.142:7733

Source: /usr/sbin/rsyslogd (PID: 6278)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6318)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6338)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6346)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6356)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6362)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6384)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6390)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6413)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6435)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6458)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6480)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6505)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6525)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6549)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6571)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6588)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6594)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6618)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6640)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6665)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6686)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6709)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6730)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6752)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6772)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6794)	Reads hosts file: /etc/hosts	Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic	DNS traffic detected: DNS query: raw.awaken-network.net
Source: global traffic	DNS traffic detected: DNS query: raw.awaken-network.net. [malformed]

Source: syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.86.dr, syslog.82.dr, syslog.76.dr, syslog.52.dr, syslog.62.dr, syslog.74.dr, syslog.68.dr, syslog.78.dr, syslog.38.dr, syslog.50.dr, syslog.32.dr, syslog.60.dr, syslog.80.dr, syslog.72.dr, syslog.64.dr, syslog.56.dr, syslog.42.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/bejv86.elf (PID: 6245)	SIGKILL sent: pid: 6247, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6248, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6271, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6272, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6273, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6275, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6276, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6277, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6297, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6318, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6338, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6346, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6356, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6362, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6384, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6390, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6413, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6435, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6480, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6505, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6525, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6549, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6571, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6588, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6594, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6618, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6640, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6665, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6686, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6709, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6772, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /proc/EOF/proc/%d/exe/proc/%d/stat/proc/%d/mapssys_monitor_cnrbusyboxadbddockerdBlink_Cloudsystemdhttpsshdbashmsg_centerlte_mgrmain_mgrpkarm7pkarm5pkarmpkarm6pkmipspkmpslpkx86/var/mnt/root/boot/sbin/home/dev/media/opt/../(deleted)sh4[aquabot_killer_EXE] Killed process: %s, PID: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/bejv86.elf (PID: 6245)	SIGKILL sent: pid: 6247, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6248, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6271, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6272, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6273, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6275, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6276, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6277, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6297, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6318, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6338, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6346, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6356, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6362, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6384, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6390, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6413, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6435, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6480, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6505, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6525, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6549, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6571, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6588, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6594, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6618, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6640, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6665, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6686, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6709, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	SIGKILL sent: pid: 6772, result: successful	Jump to behavior

Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: bejv86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6242.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6248.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6247.1.0000000008048000.000000000805d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal68.spre.troj.evad.linELF@0/54@161/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6272)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6273)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6274)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6297)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6297)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6297)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6297)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/6355/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/6354/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/6356/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/6227/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/6227/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/6227/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/6226/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/6226/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/6226/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/bejv86.elf (PID: 6246)	File opened: /proc/12/stat	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6278)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6318)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6338)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6346)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6356)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6362)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6384)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6390)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6413)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6435)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6458)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6480)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6505)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6525)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6549)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6571)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6588)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6594)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6618)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6640)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6665)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6686)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6709)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6730)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6752)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6772)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6794)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/bejv86.elf (PID: 6245)

File: /tmp/bejv86.elf

Jump to behavior

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6272)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6273)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6274)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6278)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6318)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6338)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6346)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6356)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6362)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6384)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6390)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6413)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6435)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6458)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6480)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6505)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6525)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6549)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6571)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6588)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6594)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6618)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6640)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6665)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6686)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6709)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6730)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6752)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6772)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6794)	Queries kernel information via 'uname':	Jump to behavior

Source: bejv86.elf, 6248.1.0000000009bb2000.0000000009bb9000.rw-.sdmp	Binary or memory string: Q/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f)/tmp/vmware-root_721-4290559889
Source: bejv86.elf, 6248.1.0000000009bb2000.0000000009bb9000.rw-.sdmp	Binary or memory string: vmware
Source: bejv86.elf, 6248.1.0000000009bb2000.0000000009bb9000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_721-4290559889

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
bejv86.elf	45%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.awaken-network.net	141.98.10.142	true	false		high
raw.awaken-network.net. [malformed]	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.86.dr, syslog.82.dr, syslog.76.dr, syslog.52.dr, syslog.62.dr, syslog.74.dr, syslog.68.dr, syslog.78.dr, syslog.38.dr, syslog.50.dr, syslog.32.dr, syslog.60.dr, syslog.80.dr, syslog.72.dr, syslog.64.dr, syslog.56.dr, syslog.42.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
141.98.10.142	raw.awaken-network.net	Lithuania	209605	HOSTBALTICLT	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.98.10.142	vejfa5.elf	Get hash	malicious	Unknown	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	drea4.elf	Get hash	malicious	Unknown	Browse
	jfeeps.elf	Get hash	malicious	Unknown	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	vjwe68k.elf	Get hash	malicious	Unknown	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	efjepc.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	vejfa5.elf	Get hash	malicious	Unknown	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	drea4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	vejfa5.elf	Get hash	malicious	Unknown	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	drea4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.awaken-network.net	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	vejfa5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	efefa7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	weje64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	drea4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	jfeeps.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	eehah4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	rjfe686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	vejfa5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	efefa7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	weje64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	drea4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	jfeeps.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	eehah4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	rjfe686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
HOSTBALTICLT	vejfa5.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efefa7.elf	Get hash	malicious	Mirai	Browse	141.98.10.142
	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	drea4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	eehah4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	vjwe68k.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rjfe686.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
INIT7CH	vejfa5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	efefa7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	weje64.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	drea4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	eehah4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	rjfe686.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	799
Entropy (8bit):	4.69311881568381
Encrypted:	false
SSDEEP:	24:pr5xY950PGAh51GFz5NQi715Wi5sH5195zAINm5/AIj:t2eJhebQI1zQZzNmzj
MD5:	6F918B55EDCD17E34A4B4506CB95BF4E
SHA1:	01D5A98B08BE9EC6E4694D5AA53F08265A9C8841
SHA-256:	621D0BC3BD8BBEE4EB3727CA20D0A15156E2EAEB84E409378E997171AE8E596F
SHA-512:	F6C1120F22C54CE7F1B9543214148BAEEFC0E8A2074245552F19025647B5EC69BC5702F486572F8C6A94E10DAE234DB9C74A1292CD7B5BFA4FF5FCFF573E1AB0
Malicious:	false
Reputation:	low
Preview:	Mar 5 16:45:10 galassia kernel: [ 543.312929] blocking signal 9: 6246 -> 1320.Mar 5 16:45:10 galassia kernel: [ 543.365735] blocking signal 9: 6246 -> 658.Mar 5 16:45:10 galassia kernel: [ 543.374545] blocking signal 9: 6246 -> 772.Mar 5 16:45:10 galassia kernel: [ 543.385733] blocking signal 9: 6246 -> 800.Mar 5 16:45:10 galassia kernel: [ 543.394251] blocking signal 9: 6246 -> 847.Mar 5 16:45:10 galassia kernel: [ 543.403393] blocking signal 9: 6246 -> 936.Mar 5 16:45:10 galassia kernel: [ 543.411663] blocking signal 9: 6246 -> 1320.Mar 5 16:45:10 galassia kernel: [ 543.763392] New task spawned: old: (tgid 6794, tid 6794), new (tgid: 6794, tid: 6795).Mar 5 16:45:10 galassia kernel: [ 543.763543] New task spawned: old: (tgid 6794, tid 6794), new (tgid: 6794, tid: 6796).

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	5.005281534458494
Encrypted:	false
SSDEEP:	24:p13PD5107PUVRjY5xY950PGAh51GFz5NQi715Wi5sH5195zAINm5/AIq7Jqvy9oK:T3F1GPqRM2eJhebQI1zQZzNmzsgvT4h
MD5:	A1857B2E7110B44931FDEBA943E3E3B2
SHA1:	81F6418EDA0F82AEED0AF5423668E9C7CBDC3F47
SHA-256:	869742B0B3F1368FC4A28A83929953817404F19CF6A0D054D1E9B1430326B6E7
SHA-512:	1D89E0B2996AAB636B0AB0DBB2BD17425A8AFB9473A7DD55C859258A7CB7086CB21240A790D10367E4649848BD200F0B24060708CA0C7527E32020D5402EEA00
Malicious:	false
Reputation:	low
Preview:	Mar 5 16:45:09 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Mar 5 16:45:09 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Mar 5 16:45:09 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 28..Mar 5 16:45:09 galassia systemd[1]: Stopped System Logging Service..Mar 5 16:45:09 galassia systemd[1]: Starting System Logging Service....Mar 5 16:45:10 galassia systemd[1]: Started System Logging Service..Mar 5 16:45:10 galassia kernel: [ 543.312929] blocking signal 9: 6246 -> 1320.Mar 5 16:45:10 galassia kernel: [ 543.365735] blocking signal 9: 6246 -> 658.Mar 5 16:45:10 galassia kernel: [ 543.374545] blocking signal 9: 6246 -> 772.Mar 5 16:45:10 galassia kernel: [ 543.385733] blocking signal 9: 6246 -> 800.Mar 5 16:45:10 galassia kernel: [ 543.394251] blocking signal 9: 6246 -> 847.Mar 5 16:45:10 galassia kernel: [ 543.403393] blocking signal 9: 6246 -> 936.Mar 5 16:45:10 galassia ke

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.663600858943527
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	bejv86.elf
File size:	104'456 bytes
MD5:	cb6cbec917fc2ebcf2ac8c6fda57235d
SHA1:	c7e4c19b8930d1ddb43d3ba9e36259abf8bc1e16
SHA256:	ca858d47f348e68a8ef7f562e6942a14822e4d014e131b103f10ad3dd87adc2c
SHA512:	035c899aa33b1eee55038ce75f05dd62888b3edcdcf311977b8cc70cd81426c606e243798a49c35e9346a6d5b2fa92e25af632bceb7f7c60117eea62f1e4f59d
SSDEEP:	3072:20+z7UIRZs33Krvqozl13m0A6DdJvMr5C8:l+z7d7snKrvqozl0mtQ5D
TLSH:	11A36BC4F683D4F9F89604B61137A7338733E43A5029DA87D3ADD936AC62950DA1B36C
File Content Preview:	.ELF....................d...4...x.......4. ...(.....................SN..SN..............XN..X...X....G..............Q.td............................U..S........]...h........[]...$.............U......=@&...t..5...................u........t....hT...........

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	104056
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x116d6	0x0	0x6	AX	16
.fini	PROGBITS	0x8059786	0x11786	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x80597a0	0x117a0	0x36b3	0x0	0x2	A	32
.ctors	PROGBITS	0x805de58	0x14e58	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x805de64	0x14e64	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805de80	0x14e80	0x47b8	0x0	0x3	WA	32
.bss	NOBITS	0x8062640	0x19638	0xc90c	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x19638	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x14e53	0x14e53	6.4078	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x14e58	0x805de58	0x805de58	0x47e0	0x110f4	0.4167	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 5, 2025 23:43:05.877244949 CET	192.168.2.23	8.8.8.8	0x8769	Standard query (0)	raw.awaken-network.net	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:43:05.888223886 CET	192.168.2.23	8.8.8.8	0x4c15	Standard query (0)	raw.awaken-network.net. [malformed]	256	377	false
Mar 5, 2025 23:43:05.894994974 CET	192.168.2.23	8.8.8.8	0x4c15	Standard query (0)	raw.awaken-network.net. [malformed]	256	377	false
Mar 5, 2025 23:43:05.901624918 CET	192.168.2.23	8.8.8.8	0x4c15	Standard query (0)	raw.awaken-network.net. [malformed]	256	377	false
Mar 5, 2025 23:43:05.908030987 CET	192.168.2.23	8.8.8.8	0x4c15	Standard query (0)	raw.awaken-network.net. [malformed]	256	377	false
Mar 5, 2025 23:43:05.914704084 CET	192.168.2.23	8.8.8.8	0x4c15	Standard query (0)	raw.awaken-network.net. [malformed]	256	377	false
Mar 5, 2025 23:43:06.641957045 CET	192.168.2.23	8.8.8.8	0xd42d	Standard query (0)	raw.awaken-network.net. [malformed]	256	378	false
Mar 5, 2025 23:43:06.648617029 CET	192.168.2.23	8.8.8.8	0xd42d	Standard query (0)	raw.awaken-network.net. [malformed]	256	378	false
Mar 5, 2025 23:43:06.655214071 CET	192.168.2.23	8.8.8.8	0xd42d	Standard query (0)	raw.awaken-network.net. [malformed]	256	378	false
Mar 5, 2025 23:43:06.662072897 CET	192.168.2.23	8.8.8.8	0xd42d	Standard query (0)	raw.awaken-network.net. [malformed]	256	378	false
Mar 5, 2025 23:43:06.668839931 CET	192.168.2.23	8.8.8.8	0xd42d	Standard query (0)	raw.awaken-network.net. [malformed]	256	378	false
Mar 5, 2025 23:43:55.019614935 CET	192.168.2.23	8.8.8.8	0x496d	Standard query (0)	raw.awaken-network.net. [malformed]	256	427	false
Mar 5, 2025 23:43:55.026604891 CET	192.168.2.23	8.8.8.8	0x496d	Standard query (0)	raw.awaken-network.net. [malformed]	256	427	false
Mar 5, 2025 23:43:55.033546925 CET	192.168.2.23	8.8.8.8	0x496d	Standard query (0)	raw.awaken-network.net. [malformed]	256	427	false
Mar 5, 2025 23:43:55.040636063 CET	192.168.2.23	8.8.8.8	0x496d	Standard query (0)	raw.awaken-network.net. [malformed]	256	427	false
Mar 5, 2025 23:43:55.047950029 CET	192.168.2.23	8.8.8.8	0x496d	Standard query (0)	raw.awaken-network.net. [malformed]	256	427	false
Mar 5, 2025 23:43:55.776024103 CET	192.168.2.23	8.8.8.8	0x3025	Standard query (0)	raw.awaken-network.net. [malformed]	256	427	false
Mar 5, 2025 23:43:55.782895088 CET	192.168.2.23	8.8.8.8	0x3025	Standard query (0)	raw.awaken-network.net. [malformed]	256	427	false
Mar 5, 2025 23:43:55.789918900 CET	192.168.2.23	8.8.8.8	0x3025	Standard query (0)	raw.awaken-network.net. [malformed]	256	427	false
Mar 5, 2025 23:43:55.797251940 CET	192.168.2.23	8.8.8.8	0x3025	Standard query (0)	raw.awaken-network.net. [malformed]	256	427	false
Mar 5, 2025 23:43:55.804666042 CET	192.168.2.23	8.8.8.8	0x3025	Standard query (0)	raw.awaken-network.net. [malformed]	256	427	false
Mar 5, 2025 23:43:56.532397985 CET	192.168.2.23	8.8.8.8	0x9af8	Standard query (0)	raw.awaken-network.net. [malformed]	256	428	false
Mar 5, 2025 23:43:56.539423943 CET	192.168.2.23	8.8.8.8	0x9af8	Standard query (0)	raw.awaken-network.net. [malformed]	256	428	false
Mar 5, 2025 23:43:56.546469927 CET	192.168.2.23	8.8.8.8	0x9af8	Standard query (0)	raw.awaken-network.net. [malformed]	256	428	false
Mar 5, 2025 23:43:56.553621054 CET	192.168.2.23	8.8.8.8	0x9af8	Standard query (0)	raw.awaken-network.net. [malformed]	256	428	false
Mar 5, 2025 23:43:56.561248064 CET	192.168.2.23	8.8.8.8	0x9af8	Standard query (0)	raw.awaken-network.net. [malformed]	256	428	false
Mar 5, 2025 23:43:57.309760094 CET	192.168.2.23	8.8.8.8	0xc370	Standard query (0)	raw.awaken-network.net. [malformed]	256	429	false
Mar 5, 2025 23:43:57.317399979 CET	192.168.2.23	8.8.8.8	0xc370	Standard query (0)	raw.awaken-network.net. [malformed]	256	429	false
Mar 5, 2025 23:43:57.325171947 CET	192.168.2.23	8.8.8.8	0xc370	Standard query (0)	raw.awaken-network.net. [malformed]	256	429	false
Mar 5, 2025 23:43:57.332779884 CET	192.168.2.23	8.8.8.8	0xc370	Standard query (0)	raw.awaken-network.net. [malformed]	256	429	false
Mar 5, 2025 23:43:57.341248989 CET	192.168.2.23	8.8.8.8	0xc370	Standard query (0)	raw.awaken-network.net. [malformed]	256	429	false
Mar 5, 2025 23:43:58.075746059 CET	192.168.2.23	8.8.8.8	0x9c22	Standard query (0)	raw.awaken-network.net. [malformed]	256	430	false
Mar 5, 2025 23:43:58.082097054 CET	192.168.2.23	8.8.8.8	0x9c22	Standard query (0)	raw.awaken-network.net. [malformed]	256	430	false
Mar 5, 2025 23:43:58.088865042 CET	192.168.2.23	8.8.8.8	0x9c22	Standard query (0)	raw.awaken-network.net. [malformed]	256	430	false
Mar 5, 2025 23:43:58.095119953 CET	192.168.2.23	8.8.8.8	0x9c22	Standard query (0)	raw.awaken-network.net. [malformed]	256	430	false
Mar 5, 2025 23:43:58.101758957 CET	192.168.2.23	8.8.8.8	0x9c22	Standard query (0)	raw.awaken-network.net. [malformed]	256	430	false
Mar 5, 2025 23:43:58.837450981 CET	192.168.2.23	8.8.8.8	0xd1da	Standard query (0)	raw.awaken-network.net. [malformed]	256	430	false
Mar 5, 2025 23:43:58.843914986 CET	192.168.2.23	8.8.8.8	0xd1da	Standard query (0)	raw.awaken-network.net. [malformed]	256	430	false
Mar 5, 2025 23:43:58.850281954 CET	192.168.2.23	8.8.8.8	0xd1da	Standard query (0)	raw.awaken-network.net. [malformed]	256	430	false
Mar 5, 2025 23:43:58.856589079 CET	192.168.2.23	8.8.8.8	0xd1da	Standard query (0)	raw.awaken-network.net. [malformed]	256	430	false
Mar 5, 2025 23:43:58.863202095 CET	192.168.2.23	8.8.8.8	0xd1da	Standard query (0)	raw.awaken-network.net. [malformed]	256	430	false
Mar 5, 2025 23:43:59.597910881 CET	192.168.2.23	8.8.8.8	0x887e	Standard query (0)	raw.awaken-network.net. [malformed]	256	431	false
Mar 5, 2025 23:43:59.605287075 CET	192.168.2.23	8.8.8.8	0x887e	Standard query (0)	raw.awaken-network.net. [malformed]	256	431	false
Mar 5, 2025 23:43:59.611795902 CET	192.168.2.23	8.8.8.8	0x887e	Standard query (0)	raw.awaken-network.net. [malformed]	256	431	false
Mar 5, 2025 23:43:59.618482113 CET	192.168.2.23	8.8.8.8	0x887e	Standard query (0)	raw.awaken-network.net. [malformed]	256	431	false
Mar 5, 2025 23:43:59.625072956 CET	192.168.2.23	8.8.8.8	0x887e	Standard query (0)	raw.awaken-network.net. [malformed]	256	431	false
Mar 5, 2025 23:44:00.346313953 CET	192.168.2.23	8.8.8.8	0xe63b	Standard query (0)	raw.awaken-network.net. [malformed]	256	432	false
Mar 5, 2025 23:44:00.353303909 CET	192.168.2.23	8.8.8.8	0xe63b	Standard query (0)	raw.awaken-network.net. [malformed]	256	432	false
Mar 5, 2025 23:44:00.360461950 CET	192.168.2.23	8.8.8.8	0xe63b	Standard query (0)	raw.awaken-network.net. [malformed]	256	432	false
Mar 5, 2025 23:44:00.367314100 CET	192.168.2.23	8.8.8.8	0xe63b	Standard query (0)	raw.awaken-network.net. [malformed]	256	432	false
Mar 5, 2025 23:44:00.374304056 CET	192.168.2.23	8.8.8.8	0xe63b	Standard query (0)	raw.awaken-network.net. [malformed]	256	432	false
Mar 5, 2025 23:44:01.135380030 CET	192.168.2.23	8.8.8.8	0x4dd9	Standard query (0)	raw.awaken-network.net. [malformed]	256	433	false
Mar 5, 2025 23:44:01.146015882 CET	192.168.2.23	8.8.8.8	0x4dd9	Standard query (0)	raw.awaken-network.net. [malformed]	256	433	false
Mar 5, 2025 23:44:01.156105042 CET	192.168.2.23	8.8.8.8	0x4dd9	Standard query (0)	raw.awaken-network.net. [malformed]	256	433	false
Mar 5, 2025 23:44:01.166647911 CET	192.168.2.23	8.8.8.8	0x4dd9	Standard query (0)	raw.awaken-network.net. [malformed]	256	433	false
Mar 5, 2025 23:44:01.176559925 CET	192.168.2.23	8.8.8.8	0x4dd9	Standard query (0)	raw.awaken-network.net. [malformed]	256	433	false
Mar 5, 2025 23:44:01.923980951 CET	192.168.2.23	8.8.8.8	0xfa3	Standard query (0)	raw.awaken-network.net. [malformed]	256	433	false
Mar 5, 2025 23:44:01.931081057 CET	192.168.2.23	8.8.8.8	0xfa3	Standard query (0)	raw.awaken-network.net. [malformed]	256	433	false
Mar 5, 2025 23:44:01.937927961 CET	192.168.2.23	8.8.8.8	0xfa3	Standard query (0)	raw.awaken-network.net. [malformed]	256	433	false
Mar 5, 2025 23:44:01.945444107 CET	192.168.2.23	8.8.8.8	0xfa3	Standard query (0)	raw.awaken-network.net. [malformed]	256	433	false
Mar 5, 2025 23:44:01.952948093 CET	192.168.2.23	8.8.8.8	0xfa3	Standard query (0)	raw.awaken-network.net. [malformed]	256	433	false
Mar 5, 2025 23:44:02.697622061 CET	192.168.2.23	8.8.8.8	0x9d8c	Standard query (0)	raw.awaken-network.net. [malformed]	256	434	false
Mar 5, 2025 23:44:02.704200983 CET	192.168.2.23	8.8.8.8	0x9d8c	Standard query (0)	raw.awaken-network.net. [malformed]	256	434	false
Mar 5, 2025 23:44:02.710742950 CET	192.168.2.23	8.8.8.8	0x9d8c	Standard query (0)	raw.awaken-network.net. [malformed]	256	434	false
Mar 5, 2025 23:44:02.717376947 CET	192.168.2.23	8.8.8.8	0x9d8c	Standard query (0)	raw.awaken-network.net. [malformed]	256	434	false
Mar 5, 2025 23:44:02.724138021 CET	192.168.2.23	8.8.8.8	0x9d8c	Standard query (0)	raw.awaken-network.net. [malformed]	256	434	false
Mar 5, 2025 23:44:03.448016882 CET	192.168.2.23	8.8.8.8	0xf646	Standard query (0)	raw.awaken-network.net. [malformed]	256	435	false
Mar 5, 2025 23:44:03.454638958 CET	192.168.2.23	8.8.8.8	0xf646	Standard query (0)	raw.awaken-network.net. [malformed]	256	435	false
Mar 5, 2025 23:44:03.461205959 CET	192.168.2.23	8.8.8.8	0xf646	Standard query (0)	raw.awaken-network.net. [malformed]	256	435	false
Mar 5, 2025 23:44:03.468017101 CET	192.168.2.23	8.8.8.8	0xf646	Standard query (0)	raw.awaken-network.net. [malformed]	256	435	false
Mar 5, 2025 23:44:03.474453926 CET	192.168.2.23	8.8.8.8	0xf646	Standard query (0)	raw.awaken-network.net. [malformed]	256	435	false
Mar 5, 2025 23:44:04.196367025 CET	192.168.2.23	8.8.8.8	0x7241	Standard query (0)	raw.awaken-network.net. [malformed]	256	436	false
Mar 5, 2025 23:44:04.202694893 CET	192.168.2.23	8.8.8.8	0x7241	Standard query (0)	raw.awaken-network.net. [malformed]	256	436	false
Mar 5, 2025 23:44:04.209170103 CET	192.168.2.23	8.8.8.8	0x7241	Standard query (0)	raw.awaken-network.net. [malformed]	256	436	false
Mar 5, 2025 23:44:04.215920925 CET	192.168.2.23	8.8.8.8	0x7241	Standard query (0)	raw.awaken-network.net. [malformed]	256	436	false
Mar 5, 2025 23:44:04.222724915 CET	192.168.2.23	8.8.8.8	0x7241	Standard query (0)	raw.awaken-network.net. [malformed]	256	436	false
Mar 5, 2025 23:44:04.947102070 CET	192.168.2.23	8.8.8.8	0x7333	Standard query (0)	raw.awaken-network.net. [malformed]	256	436	false
Mar 5, 2025 23:44:04.953689098 CET	192.168.2.23	8.8.8.8	0x7333	Standard query (0)	raw.awaken-network.net. [malformed]	256	436	false
Mar 5, 2025 23:44:04.960210085 CET	192.168.2.23	8.8.8.8	0x7333	Standard query (0)	raw.awaken-network.net. [malformed]	256	436	false
Mar 5, 2025 23:44:04.966695070 CET	192.168.2.23	8.8.8.8	0x7333	Standard query (0)	raw.awaken-network.net. [malformed]	256	436	false
Mar 5, 2025 23:44:04.973129988 CET	192.168.2.23	8.8.8.8	0x7333	Standard query (0)	raw.awaken-network.net. [malformed]	256	436	false
Mar 5, 2025 23:44:05.700968027 CET	192.168.2.23	8.8.8.8	0xd3f	Standard query (0)	raw.awaken-network.net. [malformed]	256	437	false
Mar 5, 2025 23:44:05.709532976 CET	192.168.2.23	8.8.8.8	0xd3f	Standard query (0)	raw.awaken-network.net. [malformed]	256	437	false
Mar 5, 2025 23:44:05.716273069 CET	192.168.2.23	8.8.8.8	0xd3f	Standard query (0)	raw.awaken-network.net. [malformed]	256	437	false
Mar 5, 2025 23:44:05.723786116 CET	192.168.2.23	8.8.8.8	0xd3f	Standard query (0)	raw.awaken-network.net. [malformed]	256	437	false
Mar 5, 2025 23:44:05.732630968 CET	192.168.2.23	8.8.8.8	0xd3f	Standard query (0)	raw.awaken-network.net. [malformed]	256	437	false
Mar 5, 2025 23:44:06.609389067 CET	192.168.2.23	8.8.8.8	0x354d	Standard query (0)	raw.awaken-network.net. [malformed]	256	438	false
Mar 5, 2025 23:44:06.616174936 CET	192.168.2.23	8.8.8.8	0x354d	Standard query (0)	raw.awaken-network.net. [malformed]	256	438	false
Mar 5, 2025 23:44:06.833292007 CET	192.168.2.23	8.8.8.8	0x354d	Standard query (0)	raw.awaken-network.net. [malformed]	256	438	false
Mar 5, 2025 23:44:06.840115070 CET	192.168.2.23	8.8.8.8	0x354d	Standard query (0)	raw.awaken-network.net. [malformed]	256	438	false
Mar 5, 2025 23:44:06.846954107 CET	192.168.2.23	8.8.8.8	0x354d	Standard query (0)	raw.awaken-network.net. [malformed]	256	438	false
Mar 5, 2025 23:44:07.598450899 CET	192.168.2.23	8.8.8.8	0x94fd	Standard query (0)	raw.awaken-network.net. [malformed]	256	439	false
Mar 5, 2025 23:44:07.604814053 CET	192.168.2.23	8.8.8.8	0x94fd	Standard query (0)	raw.awaken-network.net. [malformed]	256	439	false
Mar 5, 2025 23:44:07.611711025 CET	192.168.2.23	8.8.8.8	0x94fd	Standard query (0)	raw.awaken-network.net. [malformed]	256	439	false
Mar 5, 2025 23:44:07.618524075 CET	192.168.2.23	8.8.8.8	0x94fd	Standard query (0)	raw.awaken-network.net. [malformed]	256	439	false
Mar 5, 2025 23:44:07.625386953 CET	192.168.2.23	8.8.8.8	0x94fd	Standard query (0)	raw.awaken-network.net. [malformed]	256	439	false
Mar 5, 2025 23:44:08.358694077 CET	192.168.2.23	8.8.8.8	0x58e8	Standard query (0)	raw.awaken-network.net. [malformed]	256	440	false
Mar 5, 2025 23:44:08.365339994 CET	192.168.2.23	8.8.8.8	0x58e8	Standard query (0)	raw.awaken-network.net. [malformed]	256	440	false
Mar 5, 2025 23:44:08.371871948 CET	192.168.2.23	8.8.8.8	0x58e8	Standard query (0)	raw.awaken-network.net. [malformed]	256	440	false
Mar 5, 2025 23:44:08.378516912 CET	192.168.2.23	8.8.8.8	0x58e8	Standard query (0)	raw.awaken-network.net. [malformed]	256	440	false
Mar 5, 2025 23:44:08.385188103 CET	192.168.2.23	8.8.8.8	0x58e8	Standard query (0)	raw.awaken-network.net. [malformed]	256	440	false
Mar 5, 2025 23:44:09.116107941 CET	192.168.2.23	8.8.8.8	0x9525	Standard query (0)	raw.awaken-network.net. [malformed]	256	441	false
Mar 5, 2025 23:44:09.122687101 CET	192.168.2.23	8.8.8.8	0x9525	Standard query (0)	raw.awaken-network.net. [malformed]	256	441	false
Mar 5, 2025 23:44:09.129450083 CET	192.168.2.23	8.8.8.8	0x9525	Standard query (0)	raw.awaken-network.net. [malformed]	256	441	false
Mar 5, 2025 23:44:09.135921001 CET	192.168.2.23	8.8.8.8	0x9525	Standard query (0)	raw.awaken-network.net. [malformed]	256	441	false
Mar 5, 2025 23:44:09.142429113 CET	192.168.2.23	8.8.8.8	0x9525	Standard query (0)	raw.awaken-network.net. [malformed]	256	441	false
Mar 5, 2025 23:44:09.870858908 CET	192.168.2.23	8.8.8.8	0xc07a	Standard query (0)	raw.awaken-network.net. [malformed]	256	441	false
Mar 5, 2025 23:44:09.877332926 CET	192.168.2.23	8.8.8.8	0xc07a	Standard query (0)	raw.awaken-network.net. [malformed]	256	441	false
Mar 5, 2025 23:44:09.883836985 CET	192.168.2.23	8.8.8.8	0xc07a	Standard query (0)	raw.awaken-network.net. [malformed]	256	441	false
Mar 5, 2025 23:44:09.890250921 CET	192.168.2.23	8.8.8.8	0xc07a	Standard query (0)	raw.awaken-network.net. [malformed]	256	441	false
Mar 5, 2025 23:44:09.896600962 CET	192.168.2.23	8.8.8.8	0xc07a	Standard query (0)	raw.awaken-network.net. [malformed]	256	441	false
Mar 5, 2025 23:44:10.636302948 CET	192.168.2.23	8.8.8.8	0xe7ca	Standard query (0)	raw.awaken-network.net. [malformed]	256	442	false
Mar 5, 2025 23:44:10.645032883 CET	192.168.2.23	8.8.8.8	0xe7ca	Standard query (0)	raw.awaken-network.net. [malformed]	256	442	false
Mar 5, 2025 23:44:10.652885914 CET	192.168.2.23	8.8.8.8	0xe7ca	Standard query (0)	raw.awaken-network.net. [malformed]	256	442	false
Mar 5, 2025 23:44:10.662193060 CET	192.168.2.23	8.8.8.8	0xe7ca	Standard query (0)	raw.awaken-network.net. [malformed]	256	442	false
Mar 5, 2025 23:44:10.670694113 CET	192.168.2.23	8.8.8.8	0xe7ca	Standard query (0)	raw.awaken-network.net. [malformed]	256	442	false
Mar 5, 2025 23:44:11.411129951 CET	192.168.2.23	8.8.8.8	0x6e85	Standard query (0)	raw.awaken-network.net. [malformed]	256	443	false
Mar 5, 2025 23:44:11.417789936 CET	192.168.2.23	8.8.8.8	0x6e85	Standard query (0)	raw.awaken-network.net. [malformed]	256	443	false
Mar 5, 2025 23:44:11.424702883 CET	192.168.2.23	8.8.8.8	0x6e85	Standard query (0)	raw.awaken-network.net. [malformed]	256	443	false
Mar 5, 2025 23:44:11.431569099 CET	192.168.2.23	8.8.8.8	0x6e85	Standard query (0)	raw.awaken-network.net. [malformed]	256	443	false
Mar 5, 2025 23:44:11.438513041 CET	192.168.2.23	8.8.8.8	0x6e85	Standard query (0)	raw.awaken-network.net. [malformed]	256	443	false
Mar 5, 2025 23:44:12.153755903 CET	192.168.2.23	8.8.8.8	0x901	Standard query (0)	raw.awaken-network.net. [malformed]	256	444	false
Mar 5, 2025 23:44:12.160618067 CET	192.168.2.23	8.8.8.8	0x901	Standard query (0)	raw.awaken-network.net. [malformed]	256	444	false
Mar 5, 2025 23:44:12.167051077 CET	192.168.2.23	8.8.8.8	0x901	Standard query (0)	raw.awaken-network.net. [malformed]	256	444	false
Mar 5, 2025 23:44:12.173922062 CET	192.168.2.23	8.8.8.8	0x901	Standard query (0)	raw.awaken-network.net. [malformed]	256	444	false
Mar 5, 2025 23:44:12.181204081 CET	192.168.2.23	8.8.8.8	0x901	Standard query (0)	raw.awaken-network.net. [malformed]	256	444	false
Mar 5, 2025 23:44:12.901506901 CET	192.168.2.23	8.8.8.8	0xdd94	Standard query (0)	raw.awaken-network.net. [malformed]	256	444	false
Mar 5, 2025 23:44:12.908709049 CET	192.168.2.23	8.8.8.8	0xdd94	Standard query (0)	raw.awaken-network.net. [malformed]	256	444	false
Mar 5, 2025 23:44:12.915283918 CET	192.168.2.23	8.8.8.8	0xdd94	Standard query (0)	raw.awaken-network.net. [malformed]	256	444	false
Mar 5, 2025 23:44:12.922413111 CET	192.168.2.23	8.8.8.8	0xdd94	Standard query (0)	raw.awaken-network.net. [malformed]	256	444	false
Mar 5, 2025 23:44:12.929228067 CET	192.168.2.23	8.8.8.8	0xdd94	Standard query (0)	raw.awaken-network.net. [malformed]	256	444	false
Mar 5, 2025 23:44:13.646330118 CET	192.168.2.23	8.8.8.8	0xd0f9	Standard query (0)	raw.awaken-network.net. [malformed]	256	445	false
Mar 5, 2025 23:44:13.652870893 CET	192.168.2.23	8.8.8.8	0xd0f9	Standard query (0)	raw.awaken-network.net. [malformed]	256	445	false
Mar 5, 2025 23:44:13.659485102 CET	192.168.2.23	8.8.8.8	0xd0f9	Standard query (0)	raw.awaken-network.net. [malformed]	256	445	false
Mar 5, 2025 23:44:13.666310072 CET	192.168.2.23	8.8.8.8	0xd0f9	Standard query (0)	raw.awaken-network.net. [malformed]	256	445	false
Mar 5, 2025 23:44:13.672986984 CET	192.168.2.23	8.8.8.8	0xd0f9	Standard query (0)	raw.awaken-network.net. [malformed]	256	445	false
Mar 5, 2025 23:44:14.390893936 CET	192.168.2.23	8.8.8.8	0x56c1	Standard query (0)	raw.awaken-network.net. [malformed]	256	446	false
Mar 5, 2025 23:44:14.397737026 CET	192.168.2.23	8.8.8.8	0x56c1	Standard query (0)	raw.awaken-network.net. [malformed]	256	446	false
Mar 5, 2025 23:44:14.404238939 CET	192.168.2.23	8.8.8.8	0x56c1	Standard query (0)	raw.awaken-network.net. [malformed]	256	446	false
Mar 5, 2025 23:44:14.411237001 CET	192.168.2.23	8.8.8.8	0x56c1	Standard query (0)	raw.awaken-network.net. [malformed]	256	446	false
Mar 5, 2025 23:44:14.417690992 CET	192.168.2.23	8.8.8.8	0x56c1	Standard query (0)	raw.awaken-network.net. [malformed]	256	446	false
Mar 5, 2025 23:44:15.147969961 CET	192.168.2.23	8.8.8.8	0xca47	Standard query (0)	raw.awaken-network.net. [malformed]	256	447	false
Mar 5, 2025 23:44:15.154520988 CET	192.168.2.23	8.8.8.8	0xca47	Standard query (0)	raw.awaken-network.net. [malformed]	256	447	false
Mar 5, 2025 23:44:15.161246061 CET	192.168.2.23	8.8.8.8	0xca47	Standard query (0)	raw.awaken-network.net. [malformed]	256	447	false
Mar 5, 2025 23:44:15.167889118 CET	192.168.2.23	8.8.8.8	0xca47	Standard query (0)	raw.awaken-network.net. [malformed]	256	447	false
Mar 5, 2025 23:44:15.174715996 CET	192.168.2.23	8.8.8.8	0xca47	Standard query (0)	raw.awaken-network.net. [malformed]	256	447	false
Mar 5, 2025 23:44:15.952228069 CET	192.168.2.23	8.8.8.8	0xa271	Standard query (0)	raw.awaken-network.net. [malformed]	256	447	false
Mar 5, 2025 23:44:15.959397078 CET	192.168.2.23	8.8.8.8	0xa271	Standard query (0)	raw.awaken-network.net. [malformed]	256	447	false
Mar 5, 2025 23:44:15.966556072 CET	192.168.2.23	8.8.8.8	0xa271	Standard query (0)	raw.awaken-network.net. [malformed]	256	447	false
Mar 5, 2025 23:44:15.974031925 CET	192.168.2.23	8.8.8.8	0xa271	Standard query (0)	raw.awaken-network.net. [malformed]	256	447	false
Mar 5, 2025 23:44:15.981271982 CET	192.168.2.23	8.8.8.8	0xa271	Standard query (0)	raw.awaken-network.net. [malformed]	256	447	false
Mar 5, 2025 23:44:16.710470915 CET	192.168.2.23	8.8.8.8	0xfab6	Standard query (0)	raw.awaken-network.net. [malformed]	256	448	false
Mar 5, 2025 23:44:16.717284918 CET	192.168.2.23	8.8.8.8	0xfab6	Standard query (0)	raw.awaken-network.net. [malformed]	256	448	false
Mar 5, 2025 23:44:16.724170923 CET	192.168.2.23	8.8.8.8	0xfab6	Standard query (0)	raw.awaken-network.net. [malformed]	256	448	false
Mar 5, 2025 23:44:16.730925083 CET	192.168.2.23	8.8.8.8	0xfab6	Standard query (0)	raw.awaken-network.net. [malformed]	256	448	false
Mar 5, 2025 23:44:16.737550020 CET	192.168.2.23	8.8.8.8	0xfab6	Standard query (0)	raw.awaken-network.net. [malformed]	256	448	false
Mar 5, 2025 23:44:17.512805939 CET	192.168.2.23	8.8.8.8	0x7f89	Standard query (0)	raw.awaken-network.net. [malformed]	256	449	false
Mar 5, 2025 23:44:17.519993067 CET	192.168.2.23	8.8.8.8	0x7f89	Standard query (0)	raw.awaken-network.net. [malformed]	256	449	false
Mar 5, 2025 23:44:17.526879072 CET	192.168.2.23	8.8.8.8	0x7f89	Standard query (0)	raw.awaken-network.net. [malformed]	256	449	false
Mar 5, 2025 23:44:17.533816099 CET	192.168.2.23	8.8.8.8	0x7f89	Standard query (0)	raw.awaken-network.net. [malformed]	256	449	false
Mar 5, 2025 23:44:17.540452003 CET	192.168.2.23	8.8.8.8	0x7f89	Standard query (0)	raw.awaken-network.net. [malformed]	256	449	false

Start time (UTC):	22:43:05
Start date (UTC):	05/03/2025
Path:	/tmp/bejv86.elf
Arguments:	/tmp/bejv86.elf
File size:	104456 bytes
MD5 hash:	cb6cbec917fc2ebcf2ac8c6fda57235d

Start time (UTC):	22:43:13
Start date (UTC):	05/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	22:43:12
Start date (UTC):	05/03/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	22:43:14
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:43:19
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:43:20
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:43:25
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:43:26
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:43:31
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:43:36
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:43:42
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:43:47
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:43:52
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:43:57
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:44:02
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report bejv86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: bejv86.elf PID: 6242, Parent PID: 6165

General

File Activities

File Opened

File Deleted

File Written

File Moved

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: bejv86.elf PID: 6245, Parent PID: 6242

General

File Activities

File Deleted

Process Activities

Linux Analysis Report
bejv86.elf

Start time (UTC):	22:44:07
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:44:13
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:44:18
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:44:23
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:44:28
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:44:33
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:44:38
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:44:43
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:44:49
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:44:54
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75