Edit tour

Linux Analysis Report
EdiAf.m68k.elf

Overview

General Information

Sample name:EdiAf.m68k.elf
Analysis ID:1641210
MD5:08def1ebb01b5e513bf58d4ef06b5956
SHA1:56265e14c96207308fbeabf88f3a3a9a62492196
SHA256:06a3df086c290d6817a0ff7bdfaeffbd2c0caca1cc94fd698c3555b0c7987bfb
Tags:elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru
Score:84
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Yara detected Okiru
Sample deletes itself
Sample has stripped symbol table
Sample listens on a socket
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1641210
Start date and time:2025-03-18 04:25:41 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 26s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:EdiAf.m68k.elf
Detection:MAL
Classification:mal84.troj.evad.linELF@0/0@0/0
Command:/tmp/EdiAf.m68k.elf
PID:6216
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
VagneRHere
Standard Error:
  • system is lnxubuntu20
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
EdiAf.m68k.elfJoeSecurity_OkiruYara detected OkiruJoe Security
    EdiAf.m68k.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      EdiAf.m68k.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x10abb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10acf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10ae3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10af7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10b0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10b1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10b33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10b47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10b5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10b6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10b83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10b97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10bab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10bbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10bd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10be7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10bfb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10c0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10c23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10c37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x10c4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      SourceRuleDescriptionAuthorStrings
      6220.1.00007f7548001000.00007f7548014000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
        6220.1.00007f7548001000.00007f7548014000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          6220.1.00007f7548001000.00007f7548014000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0x10abb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10acf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10ae3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10af7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10b0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10b1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10b33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10b47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10b5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10b6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10b83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10b97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10bab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10bbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10bd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10be7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10bfb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10c0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10c23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10c37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0x10c4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          6216.1.00007f7548001000.00007f7548014000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
            6216.1.00007f7548001000.00007f7548014000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
              Click to see the 13 entries
              No Suricata rule has matched

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Source: EdiAf.m68k.elfAvira: detected
              Source: EdiAf.m68k.elfVirustotal: Detection: 57%Perma Link
              Source: EdiAf.m68k.elfReversingLabs: Detection: 66%
              Source: /tmp/EdiAf.m68k.elf (PID: 6216)Socket: 127.0.0.1:39148Jump to behavior
              Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
              Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
              Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
              Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
              Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
              Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
              Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

              System Summary

              barindex
              Source: EdiAf.m68k.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: 6220.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: 6216.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: 6218.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: Process Memory Space: EdiAf.m68k.elf PID: 6216, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: Process Memory Space: EdiAf.m68k.elf PID: 6218, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: Process Memory Space: EdiAf.m68k.elf PID: 6220, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
              Source: ELF static info symbol of initial sample.symtab present: no
              Source: EdiAf.m68k.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: 6220.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: 6216.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: 6218.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: Process Memory Space: EdiAf.m68k.elf PID: 6216, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: Process Memory Space: EdiAf.m68k.elf PID: 6218, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: Process Memory Space: EdiAf.m68k.elf PID: 6220, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
              Source: classification engineClassification label: mal84.troj.evad.linELF@0/0@0/0

              Hooking and other Techniques for Hiding and Protection

              barindex
              Source: /tmp/EdiAf.m68k.elf (PID: 6216)File: /tmp/EdiAf.m68k.elfJump to behavior
              Source: /tmp/EdiAf.m68k.elf (PID: 6216)Queries kernel information via 'uname': Jump to behavior
              Source: EdiAf.m68k.elf, 6216.1.00007ffe3df68000.00007ffe3df89000.rw-.sdmp, EdiAf.m68k.elf, 6218.1.00007ffe3df68000.00007ffe3df89000.rw-.sdmp, EdiAf.m68k.elf, 6220.1.00007ffe3df68000.00007ffe3df89000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-m68k/tmp/EdiAf.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/EdiAf.m68k.elf
              Source: EdiAf.m68k.elf, 6216.1.000055bfe0522000.000055bfe05a7000.rw-.sdmp, EdiAf.m68k.elf, 6218.1.000055bfe0522000.000055bfe05a7000.rw-.sdmp, EdiAf.m68k.elf, 6220.1.000055bfe0522000.000055bfe05a7000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/m68k
              Source: EdiAf.m68k.elf, 6216.1.00007ffe3df68000.00007ffe3df89000.rw-.sdmp, EdiAf.m68k.elf, 6218.1.00007ffe3df68000.00007ffe3df89000.rw-.sdmp, EdiAf.m68k.elf, 6220.1.00007ffe3df68000.00007ffe3df89000.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
              Source: EdiAf.m68k.elf, 6216.1.000055bfe0522000.000055bfe05a7000.rw-.sdmp, EdiAf.m68k.elf, 6218.1.000055bfe0522000.000055bfe05a7000.rw-.sdmp, EdiAf.m68k.elf, 6220.1.000055bfe0522000.000055bfe05a7000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k
              Source: EdiAf.m68k.elf, 6218.1.00007ffe3df68000.00007ffe3df89000.rw-.sdmpBinary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

              Stealing of Sensitive Information

              barindex
              Source: Yara matchFile source: EdiAf.m68k.elf, type: SAMPLE
              Source: Yara matchFile source: 6220.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6216.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6218.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: EdiAf.m68k.elf PID: 6216, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: EdiAf.m68k.elf PID: 6218, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: EdiAf.m68k.elf PID: 6220, type: MEMORYSTR
              Source: Yara matchFile source: EdiAf.m68k.elf, type: SAMPLE
              Source: Yara matchFile source: 6220.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6216.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6218.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: EdiAf.m68k.elf PID: 6216, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: EdiAf.m68k.elf PID: 6218, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: EdiAf.m68k.elf PID: 6220, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Source: Yara matchFile source: EdiAf.m68k.elf, type: SAMPLE
              Source: Yara matchFile source: 6220.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6216.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6218.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: EdiAf.m68k.elf PID: 6216, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: EdiAf.m68k.elf PID: 6218, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: EdiAf.m68k.elf PID: 6220, type: MEMORYSTR
              Source: Yara matchFile source: EdiAf.m68k.elf, type: SAMPLE
              Source: Yara matchFile source: 6220.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6216.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: 6218.1.00007f7548001000.00007f7548014000.r-x.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: EdiAf.m68k.elf PID: 6216, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: EdiAf.m68k.elf PID: 6218, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: EdiAf.m68k.elf PID: 6220, type: MEMORYSTR
              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
              File Deletion
              OS Credential Dumping11
              Security Software Discovery
              Remote ServicesData from Local System1
              Encrypted Channel
              Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
              Application Layer Protocol
              Exfiltration Over BluetoothNetwork Denial of Service
              No configs have been found
              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Number of created Files
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1641210 Sample: EdiAf.m68k.elf Startdate: 18/03/2025 Architecture: LINUX Score: 84 15 109.202.202.202, 80 INIT7CH Switzerland 2->15 17 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->17 19 91.189.91.43, 443 CANONICAL-ASGB United Kingdom 2->19 21 Malicious sample detected (through community Yara rule) 2->21 23 Antivirus / Scanner detection for submitted sample 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 2 other signatures 2->27 8 EdiAf.m68k.elf 2->8         started        signatures3 process4 signatures5 29 Sample deletes itself 8->29 11 EdiAf.m68k.elf 8->11         started        process6 process7 13 EdiAf.m68k.elf 11->13         started       

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand
              SourceDetectionScannerLabelLink
              EdiAf.m68k.elf58%VirustotalBrowse
              EdiAf.m68k.elf67%ReversingLabsLinux.Trojan.Mirai
              EdiAf.m68k.elf100%AviraEXP/ELF.Mirai.Z.A
              No Antivirus matches
              No Antivirus matches
              No Antivirus matches

              Download Network PCAP: filteredfull

              No contacted domains info
              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs
              IPDomainCountryFlagASNASN NameMalicious
              109.202.202.202
              unknownSwitzerland
              13030INIT7CHfalse
              91.189.91.43
              unknownUnited Kingdom
              41231CANONICAL-ASGBfalse
              91.189.91.42
              unknownUnited Kingdom
              41231CANONICAL-ASGBfalse
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
              • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
              91.189.91.43na.elfGet hashmaliciousPrometeiBrowse
                EdiAf.mips.elfGet hashmaliciousUnknownBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    hgfs.arm6.elfGet hashmaliciousUnknownBrowse
                      kaizen.sh4.elfGet hashmaliciousMiraiBrowse
                        boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                          boatnet.arc.elfGet hashmaliciousMiraiBrowse
                            sync.arm5.elfGet hashmaliciousUnknownBrowse
                              sync.x86_64.elfGet hashmaliciousUnknownBrowse
                                sync.x86.elfGet hashmaliciousUnknownBrowse
                                  91.189.91.42na.elfGet hashmaliciousPrometeiBrowse
                                    EdiAf.mips.elfGet hashmaliciousUnknownBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          na.elfGet hashmaliciousPrometeiBrowse
                                            na.elfGet hashmaliciousPrometeiBrowse
                                              hgfs.arm6.elfGet hashmaliciousUnknownBrowse
                                                kaizen.sh4.elfGet hashmaliciousMiraiBrowse
                                                  boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                                                    boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                                      No context
                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      CANONICAL-ASGBna.elfGet hashmaliciousPrometeiBrowse
                                                      • 91.189.91.42
                                                      EdiAf.mips.elfGet hashmaliciousUnknownBrowse
                                                      • 91.189.91.42
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 91.189.91.42
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 91.189.91.42
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 91.189.91.42
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 91.189.91.42
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 185.125.190.26
                                                      hgfs.arm6.elfGet hashmaliciousUnknownBrowse
                                                      • 91.189.91.42
                                                      kaizen.sh4.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      boatnet.arm6.elfGet hashmaliciousMiraiBrowse
                                                      • 185.125.190.26
                                                      CANONICAL-ASGBna.elfGet hashmaliciousPrometeiBrowse
                                                      • 91.189.91.42
                                                      EdiAf.mips.elfGet hashmaliciousUnknownBrowse
                                                      • 91.189.91.42
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 91.189.91.42
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 91.189.91.42
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 91.189.91.42
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 91.189.91.42
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 185.125.190.26
                                                      hgfs.arm6.elfGet hashmaliciousUnknownBrowse
                                                      • 91.189.91.42
                                                      kaizen.sh4.elfGet hashmaliciousMiraiBrowse
                                                      • 91.189.91.42
                                                      boatnet.arm6.elfGet hashmaliciousMiraiBrowse
                                                      • 185.125.190.26
                                                      INIT7CHna.elfGet hashmaliciousPrometeiBrowse
                                                      • 109.202.202.202
                                                      EdiAf.mips.elfGet hashmaliciousUnknownBrowse
                                                      • 109.202.202.202
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 109.202.202.202
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 109.202.202.202
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 109.202.202.202
                                                      na.elfGet hashmaliciousPrometeiBrowse
                                                      • 109.202.202.202
                                                      hgfs.arm6.elfGet hashmaliciousUnknownBrowse
                                                      • 109.202.202.202
                                                      kaizen.sh4.elfGet hashmaliciousMiraiBrowse
                                                      • 109.202.202.202
                                                      boatnet.m68k.elfGet hashmaliciousMiraiBrowse
                                                      • 109.202.202.202
                                                      boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                                      • 109.202.202.202
                                                      No context
                                                      No context
                                                      No created / dropped files found
                                                      File type:ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
                                                      Entropy (8bit):6.311753645477806
                                                      TrID:
                                                      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                      File name:EdiAf.m68k.elf
                                                      File size:77'812 bytes
                                                      MD5:08def1ebb01b5e513bf58d4ef06b5956
                                                      SHA1:56265e14c96207308fbeabf88f3a3a9a62492196
                                                      SHA256:06a3df086c290d6817a0ff7bdfaeffbd2c0caca1cc94fd698c3555b0c7987bfb
                                                      SHA512:d4c2ccf0c9cb3e229e299b585b0ce83b26a0a8d3e220f785aeb7cb4ab062d569da790a8a1c38567a0c5db38c3ef247a472b09f1b9d0a1218faf63166e50e4216
                                                      SSDEEP:1536:95EDkCPgRujEBrxD8mOfYLF9jT/jITyIYZeuVz:9aoCnwrx9vFNTrInCz
                                                      TLSH:1B732A8AF801DC7DF80BD27A44174D0AB971639216930B2B67A7FDE37C731E91922E81
                                                      File Content Preview:.ELF.......................D...4...d.....4. ...(......................*...*....... .......*...J...J.......'4...... .dt.Q............................NV..a....da.....N^NuNV..J9..N$f>"y..J. QJ.g.X.#...J.N."y..J. QJ.f.A.....J.g.Hy..*.N.X.......N$N^NuNV..N^NuN

                                                      ELF header

                                                      Class:ELF32
                                                      Data:2's complement, big endian
                                                      Version:1 (current)
                                                      Machine:MC68000
                                                      Version Number:0x1
                                                      Type:EXEC (Executable file)
                                                      OS/ABI:UNIX - System V
                                                      ABI Version:0
                                                      Entry Point Address:0x80000144
                                                      Flags:0x0
                                                      ELF Header Size:52
                                                      Program Header Offset:52
                                                      Program Header Size:32
                                                      Number of Program Headers:3
                                                      Section Header Offset:77412
                                                      Section Header Size:40
                                                      Number of Section Headers:10
                                                      Header String Table Index:9
                                                      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                      NULL0x00x00x00x00x0000
                                                      .initPROGBITS0x800000940x940x140x00x6AX002
                                                      .textPROGBITS0x800000a80xa80x10a020x00x6AX004
                                                      .finiPROGBITS0x80010aaa0x10aaa0xe0x00x6AX002
                                                      .rodataPROGBITS0x80010ab80x10ab80x1fca0x00x2A002
                                                      .ctorsPROGBITS0x80014a880x12a880x80x00x3WA004
                                                      .dtorsPROGBITS0x80014a900x12a900x80x00x3WA004
                                                      .dataPROGBITS0x80014a9c0x12a9c0x3880x00x3WA004
                                                      .bssNOBITS0x80014e240x12e240x23980x00x3WA004
                                                      .shstrtabSTRTAB0x00x12e240x3e0x00x0001
                                                      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                      LOAD0x00x800000000x800000000x12a820x12a826.34330x5R E0x2000.init .text .fini .rodata
                                                      LOAD0x12a880x80014a880x80014a880x39c0x27343.23920x6RW 0x2000.ctors .dtors .data .bss
                                                      GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                                                      Download Network PCAP: filteredfull

                                                      • Total Packets: 7
                                                      • 443 (HTTPS)
                                                      • 80 (HTTP)
                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Mar 18, 2025 04:26:21.708242893 CET43928443192.168.2.2391.189.91.42
                                                      Mar 18, 2025 04:26:27.339461088 CET42836443192.168.2.2391.189.91.43
                                                      Mar 18, 2025 04:26:28.875272989 CET4251680192.168.2.23109.202.202.202
                                                      Mar 18, 2025 04:26:41.929429054 CET43928443192.168.2.2391.189.91.42
                                                      Mar 18, 2025 04:26:54.215825081 CET42836443192.168.2.2391.189.91.43
                                                      Mar 18, 2025 04:26:58.311117887 CET4251680192.168.2.23109.202.202.202
                                                      Mar 18, 2025 04:27:22.883647919 CET43928443192.168.2.2391.189.91.42

                                                      System Behavior

                                                      Start time (UTC):03:26:19
                                                      Start date (UTC):18/03/2025
                                                      Path:/tmp/EdiAf.m68k.elf
                                                      Arguments:/tmp/EdiAf.m68k.elf
                                                      File size:4463432 bytes
                                                      MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                                      Start time (UTC):03:26:19
                                                      Start date (UTC):18/03/2025
                                                      Path:/tmp/EdiAf.m68k.elf
                                                      Arguments:-
                                                      File size:4463432 bytes
                                                      MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                                      Start time (UTC):03:26:19
                                                      Start date (UTC):18/03/2025
                                                      Path:/tmp/EdiAf.m68k.elf
                                                      Arguments:-
                                                      File size:4463432 bytes
                                                      MD5 hash:cd177594338c77b895ae27c33f8f86cc