Edit tour

Linux Analysis Report
Space.mpsl.elf

Overview

General Information

Sample name:Space.mpsl.elf
Analysis ID:1644271
MD5:92cbd3549361cc6766eabc5ffae9d086
SHA1:93fd50736f83c0d27bb20eb0620bf15ba50f5bea
SHA256:0b9c554e5fb0c25ac58dd84bf23fb43cb94580fe388d57b0bf68b61d31ab029b
Tags:elfMiraiuser-abuse_ch
Infos:

Detection

Score:68
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1644271
Start date and time:2025-03-20 13:57:03 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 40s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:Space.mpsl.elf
Detection:MAL
Classification:mal68.evad.linELF@0/0@0/0
Command:/tmp/Space.mpsl.elf
PID:5434
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:
  • system is lnxubuntu20
  • cleanup
SourceRuleDescriptionAuthorStrings
5438.1.00007fa294400000.00007fa29442a000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x2739c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2743c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2748c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2752c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5436.1.00007fa294400000.00007fa29442a000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x2739c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2743c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2748c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2752c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5434.1.00007fa294400000.00007fa29442a000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x2739c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2743c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2748c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2752c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5454.1.00007fa294400000.00007fa29442a000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0x2739c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x273ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27414:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27428:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2743c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27450:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27464:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27478:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2748c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x274f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27504:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x27518:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0x2752c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Space.mpsl.elf PID: 5434Linux_Trojan_Gafgyt_28a2fe0cunknownunknown
  • 0xaca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xacb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xaccc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xace0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xacf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xad08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xad1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xad30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xad44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xad58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xad6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xad80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xad94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xada8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xadbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xadd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xade4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xadf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xae0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xae20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
  • 0xae34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: Space.mpsl.elfAvira: detected
Source: Space.mpsl.elfVirustotal: Detection: 42%Perma Link
Source: Space.mpsl.elfReversingLabs: Detection: 44%
Source: global trafficTCP traffic: 192.168.2.13:45902 -> 209.97.147.158:3778
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: unknownTCP traffic detected without corresponding DNS query: 209.97.147.158
Source: Space.mpsl.elfString found in binary or memory: http://upx.sf.net

System Summary

barindex
Source: 5438.1.00007fa294400000.00007fa29442a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5436.1.00007fa294400000.00007fa29442a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5434.1.00007fa294400000.00007fa29442a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5454.1.00007fa294400000.00007fa29442a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.mpsl.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.mpsl.elf PID: 5436, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.mpsl.elf PID: 5438, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Space.mpsl.elf PID: 5454, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: LOAD without section mappingsProgram segment: 0x100000
Source: 5438.1.00007fa294400000.00007fa29442a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5436.1.00007fa294400000.00007fa29442a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5434.1.00007fa294400000.00007fa29442a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5454.1.00007fa294400000.00007fa29442a000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.mpsl.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.mpsl.elf PID: 5436, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.mpsl.elf PID: 5438, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Space.mpsl.elf PID: 5454, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: classification engineClassification label: mal68.evad.linELF@0/0@0/0

Data Obfuscation

barindex
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/230/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/110/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/231/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/111/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/232/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/112/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/233/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/113/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/234/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/114/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/235/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/115/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/236/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/116/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/237/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/117/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/238/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/118/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/239/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/3630/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/5379/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/119/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/914/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/10/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/917/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/11/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/12/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/13/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/5274/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/14/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/15/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/16/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/17/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/18/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/19/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/240/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/3095/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/120/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/241/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/121/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/242/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/1/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/122/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/243/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/2/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/123/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/244/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/3/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/124/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/245/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/1588/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/125/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/4/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/246/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/126/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/5/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/247/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/127/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/6/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/248/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/128/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/7/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/249/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/129/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/8/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/800/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/9/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/1906/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/802/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/803/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/20/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/21/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/22/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/23/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/24/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/25/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/26/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/27/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/28/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/29/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/3420/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/1482/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/490/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/1480/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/250/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/371/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/130/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/251/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/131/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/252/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/132/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/253/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/254/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/1238/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/134/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/255/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/256/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/257/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/378/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/3413/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/258/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/259/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/1475/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/936/statusJump to behavior
Source: /tmp/Space.mpsl.elf (PID: 5434)File opened: /proc/30/statusJump to behavior
Source: Space.mpsl.elfSubmission file: segment LOAD with 7.9461 entropy (max. 8.0)
Source: /tmp/Space.mpsl.elf (PID: 5434)Queries kernel information via 'uname': Jump to behavior
Source: Space.mpsl.elf, 5434.1.000055a50caab000.000055a50cb53000.rw-.sdmp, Space.mpsl.elf, 5436.1.000055a50caab000.000055a50cb53000.rw-.sdmp, Space.mpsl.elf, 5438.1.000055a50caab000.000055a50cb53000.rw-.sdmp, Space.mpsl.elf, 5454.1.000055a50caab000.000055a50cb53000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mipsel
Source: Space.mpsl.elf, 5434.1.000055a50caab000.000055a50cb53000.rw-.sdmp, Space.mpsl.elf, 5436.1.000055a50caab000.000055a50cb53000.rw-.sdmp, Space.mpsl.elf, 5438.1.000055a50caab000.000055a50cb53000.rw-.sdmp, Space.mpsl.elf, 5454.1.000055a50caab000.000055a50cb53000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/mipsel
Source: Space.mpsl.elf, 5434.1.00007fff0752a000.00007fff0754b000.rw-.sdmp, Space.mpsl.elf, 5436.1.00007fff0752a000.00007fff0754b000.rw-.sdmp, Space.mpsl.elf, 5438.1.00007fff0752a000.00007fff0754b000.rw-.sdmp, Space.mpsl.elf, 5454.1.00007fff0752a000.00007fff0754b000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/Space.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Space.mpsl.elf
Source: Space.mpsl.elf, 5434.1.00007fff0752a000.00007fff0754b000.rw-.sdmp, Space.mpsl.elf, 5436.1.00007fff0752a000.00007fff0754b000.rw-.sdmp, Space.mpsl.elf, 5438.1.00007fff0752a000.00007fff0754b000.rw-.sdmp, Space.mpsl.elf, 5454.1.00007fff0752a000.00007fff0754b000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mipsel
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
Obfuscated Files or Information
1
OS Credential Dumping
11
Security Software Discovery
Remote ServicesData from Local System1
Non-Standard Port
Exfiltration Over Other Network MediumAbuse Accessibility Features
No configs have been found
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1644271 Sample: Space.mpsl.elf Startdate: 20/03/2025 Architecture: LINUX Score: 68 20 209.97.147.158, 3778 DIGITALOCEAN-ASNUS United States 2->20 22 Malicious sample detected (through community Yara rule) 2->22 24 Antivirus / Scanner detection for submitted sample 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Sample is packed with UPX 2->28 8 Space.mpsl.elf 2->8         started        signatures3 process4 process5 10 Space.mpsl.elf 8->10         started        12 Space.mpsl.elf 8->12         started        14 Space.mpsl.elf 8->14         started        process6 16 Space.mpsl.elf 10->16         started        18 Space.mpsl.elf 10->18         started       
SourceDetectionScannerLabelLink
Space.mpsl.elf42%VirustotalBrowse
Space.mpsl.elf44%ReversingLabsLinux.Trojan.Mirai
Space.mpsl.elf100%AviraEXP/ELF.Agent.M.28
No Antivirus matches
No Antivirus matches
No Antivirus matches

Download Network PCAP: filteredfull

No contacted domains info
NameSourceMaliciousAntivirus DetectionReputation
http://upx.sf.netSpace.mpsl.elffalse
    high
    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs
    IPDomainCountryFlagASNASN NameMalicious
    209.97.147.158
    unknownUnited States
    14061DIGITALOCEAN-ASNUSfalse
    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    209.97.147.158Space.i686.elfGet hashmaliciousUnknownBrowse
      Space.x86_64.elfGet hashmaliciousUnknownBrowse
        Space.sh4.elfGet hashmaliciousUnknownBrowse
          Space.m68k.elfGet hashmaliciousMiraiBrowse
            Space.x86.elfGet hashmaliciousUnknownBrowse
              No context
              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              DIGITALOCEAN-ASNUSSpace.i686.elfGet hashmaliciousUnknownBrowse
              • 209.97.147.158
              Space.x86_64.elfGet hashmaliciousUnknownBrowse
              • 209.97.147.158
              Space.sh4.elfGet hashmaliciousUnknownBrowse
              • 209.97.147.158
              Space.m68k.elfGet hashmaliciousMiraiBrowse
              • 209.97.147.158
              Space.x86.elfGet hashmaliciousUnknownBrowse
              • 209.97.147.158
              https://bjpgckrr.ciaxalimited.com/T/?ur=lpOIUYFTDCVBKNLMJIHUGyfbnpohiguyftcgvhBNLKPOIHUGYFCGvhbjknkpojhiugyfvhjbKNLM;KPJOHIGUFYCGOYFTGUHIJDOKFLMEKNJBHYG478U9I3OKFJKNGHGRYUH3OKPEFI09U8Y7GVHBJFNKLG4KPI0U9Y87GYFGUHI4GJONK4YBJEVGUHIOJNK4BJEVUGHIJOY8T7F6DTXCGHVJBKNOJGet hashmaliciousUnknownBrowse
              • 165.22.210.101
              http://fliqlo.appGet hashmaliciousUnknownBrowse
              • 161.35.127.181
              task1.exeGet hashmaliciousEmotetBrowse
              • 134.209.36.254
              task1.exeGet hashmaliciousEmotetBrowse
              • 134.209.36.254
              PvOhS0dkw2.exeGet hashmaliciousRusty StealerBrowse
              • 157.230.108.102
              No context
              No context
              No created / dropped files found
              File type:ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
              Entropy (8bit):7.943478508741437
              TrID:
              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
              File name:Space.mpsl.elf
              File size:44'352 bytes
              MD5:92cbd3549361cc6766eabc5ffae9d086
              SHA1:93fd50736f83c0d27bb20eb0620bf15ba50f5bea
              SHA256:0b9c554e5fb0c25ac58dd84bf23fb43cb94580fe388d57b0bf68b61d31ab029b
              SHA512:036d157a6b4309a54d81359086f61f09984488ad8922acd63fb8a2ca42b367eec8dc6d356d6238e5316543f54a5257eab1819dc6890344b163853557a66fbb7a
              SSDEEP:768:4QdzLFMbXkqyyxwmGFm3qsSPhkj96MiKrecs6cDtyO5XnQDhuF+69uWh:nPmwqBOc31LNrecs6KtPXQDhsl
              TLSH:6913F14EDBE2ED65C8CF5839B4CD03615A92B1C224270FDCA3596C8CA5958CA78CD8B5
              File Content Preview:.ELF........................4...........4. ...(...............................................C...C.....................UPX!d...................V..........?.E.h;....#......b.L#>g7.9f......1....F.....f.u.(L.X.Ak..8......~.Dl0..Wl../... ..il...&..........p?

              ELF header

              Class:ELF32
              Data:2's complement, little endian
              Version:1 (current)
              Machine:MIPS R3000
              Version Number:0x1
              Type:EXEC (Executable file)
              OS/ABI:UNIX - System V
              ABI Version:0
              Entry Point Address:0x1098d8
              Flags:0x1007
              ELF Header Size:52
              Program Header Offset:52
              Program Header Size:32
              Number of Program Headers:2
              Section Header Offset:0
              Section Header Size:40
              Number of Section Headers:0
              Header String Table Index:0
              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
              LOAD0x00x1000000x1000000xac150xac157.94610x5R E0x10000
              LOAD0xaffc0x43affc0x43affc0x00x00.00000x6RW 0x10000

              Download Network PCAP: filteredfull

              TimestampSource PortDest PortSource IPDest IP
              Mar 20, 2025 13:57:52.188072920 CET459023778192.168.2.13209.97.147.158
              Mar 20, 2025 13:57:53.207586050 CET459023778192.168.2.13209.97.147.158
              Mar 20, 2025 13:57:55.223783016 CET459023778192.168.2.13209.97.147.158
              Mar 20, 2025 13:57:57.810692072 CET459043778192.168.2.13209.97.147.158
              Mar 20, 2025 13:57:58.839797020 CET459043778192.168.2.13209.97.147.158
              Mar 20, 2025 13:57:59.319787979 CET459023778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:00.855639935 CET459043778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:03.214822054 CET459063778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:04.215786934 CET459063778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:04.951781988 CET459043778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:06.231695890 CET459063778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:08.864934921 CET459083778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:09.879759073 CET459083778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:10.327729940 CET459063778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:11.895804882 CET459083778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:14.222759962 CET459103778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:15.223759890 CET459103778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:15.959640026 CET459083778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:17.239561081 CET459103778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:19.881611109 CET459123778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:20.887816906 CET459123778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:21.335887909 CET459103778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:22.903749943 CET459123778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:25.239286900 CET459143778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:26.263798952 CET459143778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:26.967910051 CET459123778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:28.279757023 CET459143778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:30.899297953 CET459163778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:31.927834988 CET459163778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:32.343609095 CET459143778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:33.943759918 CET459163778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:36.257667065 CET459183778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:37.271672964 CET459183778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:37.975651979 CET459163778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:39.287796021 CET459183778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:41.916951895 CET459203778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:42.935935020 CET459203778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:43.351702929 CET459183778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:44.951862097 CET459203778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:47.270987034 CET459223778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:48.279863119 CET459223778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:48.983880043 CET459203778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:50.295906067 CET459223778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:52.924627066 CET459243778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:53.943787098 CET459243778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:54.359838009 CET459223778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:55.959887981 CET459243778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:58.286300898 CET459263778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:59.287719965 CET459263778192.168.2.13209.97.147.158
              Mar 20, 2025 13:58:59.991653919 CET459243778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:01.303747892 CET459263778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:03.930619001 CET459283778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:04.951693058 CET459283778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:05.367713928 CET459263778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:06.967667103 CET459283778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:09.300539017 CET459303778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:10.327877998 CET459303778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:10.999686003 CET459283778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:12.343713045 CET459303778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:14.936901093 CET459323778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:15.959600925 CET459323778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:16.375674009 CET459303778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:17.975661039 CET459323778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:20.315452099 CET459343778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:21.335786104 CET459343778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:22.007747889 CET459323778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:23.351809025 CET459343778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:25.947319984 CET459363778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:26.967612028 CET459363778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:27.383713961 CET459343778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:28.983637094 CET459363778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:31.329303980 CET459383778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:32.343677044 CET459383778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:33.015755892 CET459363778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:34.359635115 CET459383778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:36.960259914 CET459403778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:37.975725889 CET459403778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:38.391813993 CET459383778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:39.991739988 CET459403778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:42.342192888 CET459423778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:43.351735115 CET459423778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:44.023721933 CET459403778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:45.367649078 CET459423778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:47.974133968 CET459443778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:48.984352112 CET459443778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:49.399647951 CET459423778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:50.999646902 CET459443778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:53.355725050 CET459463778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:54.359663010 CET459463778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:55.031639099 CET459443778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:56.375637054 CET459463778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:58.986974955 CET459483778192.168.2.13209.97.147.158
              Mar 20, 2025 13:59:59.991614103 CET459483778192.168.2.13209.97.147.158
              Mar 20, 2025 14:00:00.407629013 CET459463778192.168.2.13209.97.147.158
              Mar 20, 2025 14:00:02.007584095 CET459483778192.168.2.13209.97.147.158

              System Behavior

              Start time (UTC):12:57:51
              Start date (UTC):20/03/2025
              Path:/tmp/Space.mpsl.elf
              Arguments:/tmp/Space.mpsl.elf
              File size:5773336 bytes
              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

              Start time (UTC):12:57:51
              Start date (UTC):20/03/2025
              Path:/tmp/Space.mpsl.elf
              Arguments:-
              File size:5773336 bytes
              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

              Start time (UTC):12:57:51
              Start date (UTC):20/03/2025
              Path:/tmp/Space.mpsl.elf
              Arguments:-
              File size:5773336 bytes
              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

              Start time (UTC):12:57:51
              Start date (UTC):20/03/2025
              Path:/tmp/Space.mpsl.elf
              Arguments:-
              File size:5773336 bytes
              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

              Start time (UTC):12:57:57
              Start date (UTC):20/03/2025
              Path:/tmp/Space.mpsl.elf
              Arguments:-
              File size:5773336 bytes
              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9

              Start time (UTC):12:57:57
              Start date (UTC):20/03/2025
              Path:/tmp/Space.mpsl.elf
              Arguments:-
              File size:5773336 bytes
              MD5 hash:0d6f61f82cf2f781c6eb0661071d42d9