Edit tour

Linux Analysis Report
x86_64.elf

Overview

General Information

Sample name:	x86_64.elf
Analysis ID:	1646575
MD5:	782ffe675b6b9ac6984c1151e9f23888
SHA1:	821691e5903db1262110bec94f855b780539b635
SHA256:	45a6bfd0bbf04e4eddbfd9b15ab25aef89448f888c3cb215336ca8620747cbcc
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample is packed with UPX

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1646575
Start date and time:	2025-03-24 06:10:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	x86_64.elf
Detection:	MAL
Classification:	mal60.evad.linELF@0/0@32/0

Warnings

VT rate limit hit for: 198.98.51.68

Runtime Messages

Command:	/tmp/x86_64.elf
PID:	5486
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	skidmark botnet
Standard Error:

Process Tree

system is lnxubuntu20

x86_64.elf (PID: 5486, Parent: 5409, MD5: 782ffe675b6b9ac6984c1151e9f23888) Arguments: /tmp/x86_64.elf

x86_64.elf New Fork (PID: 5487, Parent: 5486)

x86_64.elf New Fork (PID: 5488, Parent: 5487)

x86_64.elf New Fork (PID: 5489, Parent: 5487)

x86_64.elf New Fork (PID: 5490, Parent: 5487)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
x86_64.elf	Linux_Trojan_Ircbot_bb204b81	unknown	unknown	0x6f6a:$a: 0F 44 C8 4C 5E F8 8D EF 80 83 CD FF 31 DB 30 22

Memory Dumps

Source	Rule	Description	Author	Strings
5486.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x7a04:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5486.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x81f3:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5486.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x51c2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x52f8:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5486.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xacba:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5486.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x7db3:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5486.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x807e:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5486.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x441f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5486.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x2fc2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
5490.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x7a04:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5490.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x81f3:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5490.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x51c2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x52f8:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5490.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xacba:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5490.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x7db3:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5490.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x807e:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5490.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x441f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
5490.1.0000000000400000.000000000040d000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x2fc2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: x86_64.elf

ReversingLabs: Detection: 22%

Source: /tmp/x86_64.elf (PID: 5486)

Socket: 127.0.0.1:47845

Jump to behavior

Source: unknown

DNS traffic detected: query: 198.98.51.68 replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown	UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown	UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown	UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown	UDP traffic detected without corresponding DNS query: 134.195.4.2
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 185.181.61.24
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 91.217.137.37
Source: unknown	UDP traffic detected without corresponding DNS query: 91.217.137.37
Source: unknown	UDP traffic detected without corresponding DNS query: 91.217.137.37
Source: unknown	UDP traffic detected without corresponding DNS query: 91.217.137.37
Source: unknown	UDP traffic detected without corresponding DNS query: 91.217.137.37
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 194.36.144.87
Source: unknown	UDP traffic detected without corresponding DNS query: 91.217.137.37

Source: global traffic

DNS traffic detected: DNS query: 198.98.51.68

Source: x86_64.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Ircbot_bb204b81 Author: unknown
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown

Source: LOAD without section mappings

Program segment: 0x100000

Source: x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Ircbot_bb204b81 reference_sample = 6147481d083c707dc98905a1286827a6e7009e08490e7d7c280ed5a6356527ad, os = linux, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Ircbot, fingerprint = 66f9a8a31653a5e480f427d2d6a25b934c2c53752308eedb57eaa7b7cb7dde2e, id = bb204b81-db58-434f-b834-672cdc25e56c, last_modified = 2021-09-16
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5486.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 5490.1.0000000000400000.000000000040d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16

Source: classification engine

Classification label: mal60.evad.linELF@0/0@32/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/3790/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/3791/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/3792/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/3793/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/x86_64.elf (PID: 5489)	File opened: /proc/262/cmdline	Jump to behavior

Source: x86_64.elf

Submission file: segment LOAD with 7.8856 entropy (max. 8.0)

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
x86_64.elf	22%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
198.98.51.68	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	x86_64.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
175.30.53.20	unknown	China		4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
175.30.53.20	arm.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	gjsoX84ZOy.elf	Get hash	malicious	Mirai	Browse
	skwXrj6q72.elf	Get hash	malicious	Unknown	Browse
	VqY324s7TO.elf	Get hash	malicious	Unknown	Browse
	1v1A4KluJp.elf	Get hash	malicious	Unknown	Browse
	fI2JqkDmZj.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINANET-BACKBONENo31Jin-rongStreetCN	arm.elf	Get hash	malicious	Unknown	Browse	175.30.53.20
	mpsl.elf	Get hash	malicious	Unknown	Browse	175.30.53.20
	resgod.arm.elf	Get hash	malicious	Mirai	Browse	223.8.175.23
	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	223.8.175.35
	resgod.sh4.elf	Get hash	malicious	Mirai	Browse	223.8.175.39
	resgod.mips.elf	Get hash	malicious	Mirai	Browse	223.8.175.35
	resgod.arm7.elf	Get hash	malicious	Mirai	Browse	223.8.175.38
	resgod.ppc.elf	Get hash	malicious	Mirai	Browse	223.8.175.37
	resgod.spc.elf	Get hash	malicious	Mirai	Browse	223.8.175.23
	resgod.mpsl.elf	Get hash	malicious	Mirai	Browse	223.8.175.24

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.880985249508648
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	x86_64.elf
File size:	29'500 bytes
MD5:	782ffe675b6b9ac6984c1151e9f23888
SHA1:	821691e5903db1262110bec94f855b780539b635
SHA256:	45a6bfd0bbf04e4eddbfd9b15ab25aef89448f888c3cb215336ca8620747cbcc
SHA512:	46d8c3e66917abb4a95285149d51db3669ba352c74030ee79b9834b5146a3dd3a8b670b978d4e44519acd688e5b8d206af6e8d017b799f2bf8d0136a4204dc6a
SSDEEP:	768:Xc05PipH4lbsTGgpT8UPQ5hZKP9B23S/JMJsG9:XDIp+bniT8uu8VYiWOU
TLSH:	BCD2F1619352215FFBEE94B08B116EADCDA68881DF463DCC1114EC8632AD5E0C3B1373
File Content Preview:	.ELF..............>.....@j......@...................@.8...@.....................................r......r................................Q.......Q.............................Q.td....................................................N.[.UPX!...............

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x106a40
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	64
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x100000	0x100000	0x722a	0x722a	7.8856	0x5	R E	0x100000
LOAD	0xe08	0x510e08	0x510e08	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 56
• 53 (DNS)
• 23 (Telnet)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 06:11:25.534778118 CET	54692	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:11:26.566454887 CET	54692	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:11:28.582988977 CET	54692	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:11:32.712368965 CET	54692	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:11:41.352091074 CET	54694	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:11:42.379337072 CET	54694	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:11:44.396120071 CET	54694	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:11:48.589365959 CET	54694	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:11:52.275846004 CET	54696	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:11:53.294797897 CET	54696	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:11:55.311439991 CET	54696	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:11:59.344770908 CET	54696	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:12:27.324592113 CET	54698	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:12:28.345884085 CET	54698	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:12:30.362565994 CET	54698	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:12:34.427817106 CET	54698	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:12:38.331322908 CET	54700	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:12:39.361362934 CET	54700	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:12:41.374095917 CET	54700	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:12:45.439413071 CET	54700	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:13:13.384669065 CET	54702	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:13:14.412682056 CET	54702	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:13:16.425246000 CET	54702	23	192.168.2.14	175.30.53.20
Mar 24, 2025 06:13:20.522433043 CET	54702	23	192.168.2.14	175.30.53.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 06:11:25.034584999 CET	33849	53	192.168.2.14	134.195.4.2
Mar 24, 2025 06:11:25.134345055 CET	53	33849	134.195.4.2	192.168.2.14
Mar 24, 2025 06:11:25.136209011 CET	60142	53	192.168.2.14	134.195.4.2
Mar 24, 2025 06:11:25.234746933 CET	53	60142	134.195.4.2	192.168.2.14
Mar 24, 2025 06:11:25.236613035 CET	53878	53	192.168.2.14	134.195.4.2
Mar 24, 2025 06:11:25.334769011 CET	53	53878	134.195.4.2	192.168.2.14
Mar 24, 2025 06:11:25.336991072 CET	46975	53	192.168.2.14	134.195.4.2
Mar 24, 2025 06:11:25.434053898 CET	53	46975	134.195.4.2	192.168.2.14
Mar 24, 2025 06:11:25.436017990 CET	45070	53	192.168.2.14	134.195.4.2
Mar 24, 2025 06:11:25.533813000 CET	53	45070	134.195.4.2	192.168.2.14
Mar 24, 2025 06:11:35.550836086 CET	44634	53	192.168.2.14	185.181.61.24
Mar 24, 2025 06:11:35.747632027 CET	53	44634	185.181.61.24	192.168.2.14
Mar 24, 2025 06:11:35.749397993 CET	48415	53	192.168.2.14	185.181.61.24
Mar 24, 2025 06:11:35.946481943 CET	53	48415	185.181.61.24	192.168.2.14
Mar 24, 2025 06:11:35.948523045 CET	48259	53	192.168.2.14	185.181.61.24
Mar 24, 2025 06:11:40.956161976 CET	33942	53	192.168.2.14	185.181.61.24
Mar 24, 2025 06:11:41.153479099 CET	53	33942	185.181.61.24	192.168.2.14
Mar 24, 2025 06:11:41.154627085 CET	55195	53	192.168.2.14	185.181.61.24
Mar 24, 2025 06:11:41.351164103 CET	53	55195	185.181.61.24	192.168.2.14
Mar 24, 2025 06:11:51.360347986 CET	32975	53	192.168.2.14	194.36.144.87
Mar 24, 2025 06:11:51.542870998 CET	53	32975	194.36.144.87	192.168.2.14
Mar 24, 2025 06:11:51.544044018 CET	58921	53	192.168.2.14	194.36.144.87
Mar 24, 2025 06:11:51.740086079 CET	53	58921	194.36.144.87	192.168.2.14
Mar 24, 2025 06:11:51.741502047 CET	41136	53	192.168.2.14	194.36.144.87
Mar 24, 2025 06:11:51.920114994 CET	53	41136	194.36.144.87	192.168.2.14
Mar 24, 2025 06:11:51.921578884 CET	49322	53	192.168.2.14	194.36.144.87
Mar 24, 2025 06:11:52.097975969 CET	53	49322	194.36.144.87	192.168.2.14
Mar 24, 2025 06:11:52.098994970 CET	38362	53	192.168.2.14	194.36.144.87
Mar 24, 2025 06:11:52.275387049 CET	53	38362	194.36.144.87	192.168.2.14
Mar 24, 2025 06:12:02.286360025 CET	35924	53	192.168.2.14	91.217.137.37
Mar 24, 2025 06:12:07.294364929 CET	36293	53	192.168.2.14	91.217.137.37
Mar 24, 2025 06:12:12.302130938 CET	48064	53	192.168.2.14	91.217.137.37
Mar 24, 2025 06:12:17.309910059 CET	60871	53	192.168.2.14	91.217.137.37
Mar 24, 2025 06:12:22.317410946 CET	54356	53	192.168.2.14	91.217.137.37
Mar 24, 2025 06:12:37.331150055 CET	51334	53	192.168.2.14	194.36.144.87
Mar 24, 2025 06:12:37.598212004 CET	53	51334	194.36.144.87	192.168.2.14
Mar 24, 2025 06:12:37.599522114 CET	40082	53	192.168.2.14	194.36.144.87
Mar 24, 2025 06:12:37.793144941 CET	53	40082	194.36.144.87	192.168.2.14
Mar 24, 2025 06:12:37.794384956 CET	43334	53	192.168.2.14	194.36.144.87
Mar 24, 2025 06:12:37.970537901 CET	53	43334	194.36.144.87	192.168.2.14
Mar 24, 2025 06:12:37.971514940 CET	38148	53	192.168.2.14	194.36.144.87
Mar 24, 2025 06:12:38.149961948 CET	53	38148	194.36.144.87	192.168.2.14
Mar 24, 2025 06:12:38.151350021 CET	58048	53	192.168.2.14	194.36.144.87
Mar 24, 2025 06:12:38.330676079 CET	53	58048	194.36.144.87	192.168.2.14
Mar 24, 2025 06:12:48.346551895 CET	59331	53	192.168.2.14	91.217.137.37
Mar 24, 2025 06:12:53.355118990 CET	43385	53	192.168.2.14	91.217.137.37
Mar 24, 2025 06:12:58.363590002 CET	56002	53	192.168.2.14	91.217.137.37
Mar 24, 2025 06:13:03.370649099 CET	44804	53	192.168.2.14	91.217.137.37
Mar 24, 2025 06:13:08.376152992 CET	55936	53	192.168.2.14	91.217.137.37
Mar 24, 2025 06:13:23.397069931 CET	35976	53	192.168.2.14	94.16.114.254
Mar 24, 2025 06:13:28.405303955 CET	38564	53	192.168.2.14	94.16.114.254

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 24, 2025 06:11:25.034584999 CET	192.168.2.14	134.195.4.2	0xf5e5	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:25.136209011 CET	192.168.2.14	134.195.4.2	0xf5e5	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:25.236613035 CET	192.168.2.14	134.195.4.2	0xf5e5	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:25.336991072 CET	192.168.2.14	134.195.4.2	0xf5e5	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:25.436017990 CET	192.168.2.14	134.195.4.2	0xf5e5	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:35.550836086 CET	192.168.2.14	185.181.61.24	0x9ac2	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:35.749397993 CET	192.168.2.14	185.181.61.24	0x9ac2	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:35.948523045 CET	192.168.2.14	185.181.61.24	0x9ac2	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:40.956161976 CET	192.168.2.14	185.181.61.24	0x9ac2	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:41.154627085 CET	192.168.2.14	185.181.61.24	0x9ac2	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:51.360347986 CET	192.168.2.14	194.36.144.87	0x80f	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:51.544044018 CET	192.168.2.14	194.36.144.87	0x80f	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:51.741502047 CET	192.168.2.14	194.36.144.87	0x80f	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:51.921578884 CET	192.168.2.14	194.36.144.87	0x80f	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:52.098994970 CET	192.168.2.14	194.36.144.87	0x80f	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:02.286360025 CET	192.168.2.14	91.217.137.37	0xcd81	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:07.294364929 CET	192.168.2.14	91.217.137.37	0xcd81	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:12.302130938 CET	192.168.2.14	91.217.137.37	0xcd81	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:17.309910059 CET	192.168.2.14	91.217.137.37	0xcd81	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:22.317410946 CET	192.168.2.14	91.217.137.37	0xcd81	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:37.331150055 CET	192.168.2.14	194.36.144.87	0xdb59	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:37.599522114 CET	192.168.2.14	194.36.144.87	0xdb59	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:37.794384956 CET	192.168.2.14	194.36.144.87	0xdb59	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:37.971514940 CET	192.168.2.14	194.36.144.87	0xdb59	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:38.151350021 CET	192.168.2.14	194.36.144.87	0xdb59	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:48.346551895 CET	192.168.2.14	91.217.137.37	0xa1c4	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:53.355118990 CET	192.168.2.14	91.217.137.37	0xa1c4	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:58.363590002 CET	192.168.2.14	91.217.137.37	0xa1c4	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:13:03.370649099 CET	192.168.2.14	91.217.137.37	0xa1c4	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:13:08.376152992 CET	192.168.2.14	91.217.137.37	0xa1c4	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:13:23.397069931 CET	192.168.2.14	94.16.114.254	0x9764	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:13:28.405303955 CET	192.168.2.14	94.16.114.254	0x9764	Standard query (0)	198.98.51.68	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 24, 2025 06:11:25.134345055 CET	134.195.4.2	192.168.2.14	0xf5e5	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:25.234746933 CET	134.195.4.2	192.168.2.14	0xf5e5	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:25.334769011 CET	134.195.4.2	192.168.2.14	0xf5e5	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:25.434053898 CET	134.195.4.2	192.168.2.14	0xf5e5	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:25.533813000 CET	134.195.4.2	192.168.2.14	0xf5e5	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:35.747632027 CET	185.181.61.24	192.168.2.14	0x9ac2	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:35.946481943 CET	185.181.61.24	192.168.2.14	0x9ac2	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:41.153479099 CET	185.181.61.24	192.168.2.14	0x9ac2	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:41.351164103 CET	185.181.61.24	192.168.2.14	0x9ac2	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:51.542870998 CET	194.36.144.87	192.168.2.14	0x80f	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:51.740086079 CET	194.36.144.87	192.168.2.14	0x80f	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:51.920114994 CET	194.36.144.87	192.168.2.14	0x80f	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:52.097975969 CET	194.36.144.87	192.168.2.14	0x80f	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:11:52.275387049 CET	194.36.144.87	192.168.2.14	0x80f	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:37.598212004 CET	194.36.144.87	192.168.2.14	0xdb59	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:37.793144941 CET	194.36.144.87	192.168.2.14	0xdb59	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:37.970537901 CET	194.36.144.87	192.168.2.14	0xdb59	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:38.149961948 CET	194.36.144.87	192.168.2.14	0xdb59	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false
Mar 24, 2025 06:12:38.330676079 CET	194.36.144.87	192.168.2.14	0xdb59	Name error (3)	198.98.51.68	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: x86_64.elf PID: 5486, Parent PID: 5409

General

Start time (UTC):	05:11:24
Start date (UTC):	24/03/2025
Path:	/tmp/x86_64.elf
Arguments:	/tmp/x86_64.elf
File size:	29500 bytes
MD5 hash:	782ffe675b6b9ac6984c1151e9f23888

Process Activities

Process Forked

Prctl Requested

Network Activities

Socket Listening

Chronological Activities

Analysis Process: x86_64.elf PID: 5487, Parent PID: 5486

General

Start time (UTC):	05:11:24
Start date (UTC):	24/03/2025
Path:	/tmp/x86_64.elf
Arguments:	-
File size:	29500 bytes
MD5 hash:	782ffe675b6b9ac6984c1151e9f23888

Process Activities

Process Forked

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: x86_64.elf PID: 5488, Parent PID: 5487

General

Start time (UTC):	05:11:24
Start date (UTC):	24/03/2025
Path:	/tmp/x86_64.elf
Arguments:	-
File size:	29500 bytes
MD5 hash:	782ffe675b6b9ac6984c1151e9f23888

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: x86_64.elf PID: 5489, Parent PID: 5487

General

Start time (UTC):	05:11:24
Start date (UTC):	24/03/2025
Path:	/tmp/x86_64.elf
Arguments:	-
File size:	29500 bytes
MD5 hash:	782ffe675b6b9ac6984c1151e9f23888

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: x86_64.elf PID: 5490, Parent PID: 5487

General

Start time (UTC):	05:11:24
Start date (UTC):	24/03/2025
Path:	/tmp/x86_64.elf
Arguments:	-
File size:	29500 bytes
MD5 hash:	782ffe675b6b9ac6984c1151e9f23888

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report x86_64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: x86_64.elf PID: 5486, Parent PID: 5409

General

Process Activities

Process Forked

Prctl Requested

Network Activities

Socket Listening

Chronological Activities

Analysis Process: x86_64.elf PID: 5487, Parent PID: 5486

General

Process Activities

Process Forked

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: x86_64.elf PID: 5488, Parent PID: 5487

General

File Activities

Linux Analysis Report
x86_64.elf