Edit tour

Linux Analysis Report
Space.spc.elf

Overview

General Information

Sample name:Space.spc.elf
Analysis ID:1654329
MD5:d9f71b2e332297826390e86b15382df7
SHA1:5f5f2b9fe4dcef1b5ada947758d355ab5b49a479
SHA256:30f6d52eafb79f979c495f137945fc702bc70ff5d695612cf8abe65f2ff5f228
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:72
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Executes the "rm" command used to delete files or directories
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1654329
Start date and time:2025-04-02 09:47:33 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 38s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:Space.spc.elf
Detection:MAL
Classification:mal72.troj.linELF@0/0@0/0
Command:/tmp/Space.spc.elf
PID:6233
Exit Code:139
Exit Code Info:SIGSEGV (11) Segmentation fault invalid memory reference
Killed:False
Standard Output:

Standard Error:
  • system is lnxubuntu20
  • Space.spc.elf (PID: 6233, Parent: 6151, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/Space.spc.elf
  • dash New Fork (PID: 6313, Parent: 4331)
  • rm (PID: 6313, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.mIpEx04mbe /tmp/tmp.8m65FHPTQp /tmp/tmp.2KzBHaUz5d
  • dash New Fork (PID: 6314, Parent: 4331)
  • rm (PID: 6314, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.mIpEx04mbe /tmp/tmp.8m65FHPTQp /tmp/tmp.2KzBHaUz5d
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
Space.spc.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    Space.spc.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0x25180:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x25194:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x251a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x251bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x251d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x251e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x251f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x2520c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x25220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x25234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x25248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x2525c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x25270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x25284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x25298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x252ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x252c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x252d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x252e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x252fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0x25310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    SourceRuleDescriptionAuthorStrings
    6233.1.00007f8660001000.00007f8660029000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6233.1.00007f8660001000.00007f8660029000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x25180:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x25194:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x251a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x251bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x251d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x251e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x251f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x2520c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x25220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x25234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x25248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x2525c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x25270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x25284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x25298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x252ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x252c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x252d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x252e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x252fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x25310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      Process Memory Space: Space.spc.elf PID: 6233JoeSecurity_Mirai_8Yara detected MiraiJoe Security
        Process Memory Space: Space.spc.elf PID: 6233Linux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0x2dbd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2dd1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2de5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2df9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2e0d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2e21:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2e35:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2e49:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2e5d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2e71:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2e85:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2e99:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2ead:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2ec1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2ed5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2ee9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2efd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2f11:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2f25:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2f39:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0x2f4d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: Space.spc.elfAvira: detected
        Source: Space.spc.elfReversingLabs: Detection: 58%
        Source: Space.spc.elfVirustotal: Detection: 64%Perma Link
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
        Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
        Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 34.249.145.219
        Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 39256
        Source: unknownNetwork traffic detected: HTTP traffic on port 39256 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

        System Summary

        barindex
        Source: Space.spc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 6233.1.00007f8660001000.00007f8660029000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: Space.spc.elf PID: 6233, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Initial sampleString containing 'busybox' found: /bin/busybox
        Source: Initial sampleString containing 'busybox' found: /proc/net/tcp/proc/proc/%d/exe/proc/%s/statusrName:%s/bin/busybox/bin/systemd/usr/bintest/tmp/condi/tmp/zxcr9999/tmp/condinetwork/var/condibot/var/zxcr9999/var/CondiBot/var/condinet/bin/watchdog.x86.x86_64.arm.arm5.arm6.arm7.mips.mipsel.sh4.ppc176.65.144.220
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: Space.spc.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 6233.1.00007f8660001000.00007f8660029000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: Space.spc.elf PID: 6233, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: classification engineClassification label: mal72.troj.linELF@0/0@0/0
        Source: /usr/bin/dash (PID: 6313)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.mIpEx04mbe /tmp/tmp.8m65FHPTQp /tmp/tmp.2KzBHaUz5dJump to behavior
        Source: /usr/bin/dash (PID: 6314)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.mIpEx04mbe /tmp/tmp.8m65FHPTQp /tmp/tmp.2KzBHaUz5dJump to behavior
        Source: /tmp/Space.spc.elf (PID: 6233)Queries kernel information via 'uname': Jump to behavior
        Source: Space.spc.elf, 6233.1.0000558751446000.00005587514ab000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sparc
        Source: Space.spc.elf, 6233.1.0000558751446000.00005587514ab000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/sparc
        Source: Space.spc.elf, 6233.1.00007ffdb18cb000.00007ffdb18ec000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sparc
        Source: Space.spc.elf, 6233.1.00007ffdb18cb000.00007ffdb18ec000.rw-.sdmpBinary or memory string: Wx86_64/usr/bin/qemu-sparc/tmp/Space.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Space.spc.elf

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: Space.spc.elf, type: SAMPLE
        Source: Yara matchFile source: 6233.1.00007f8660001000.00007f8660029000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: Space.spc.elf PID: 6233, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: Space.spc.elf, type: SAMPLE
        Source: Yara matchFile source: 6233.1.00007f8660001000.00007f8660029000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: Space.spc.elf PID: 6233, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
        File Deletion
        OS Credential Dumping11
        Security Software Discovery
        Remote ServicesData from Local System1
        Encrypted Channel
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Application Layer Protocol
        Exfiltration Over BluetoothNetwork Denial of Service
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1654329 Sample: Space.spc.elf Startdate: 02/04/2025 Architecture: LINUX Score: 72 12 109.202.202.202, 80 INIT7CH Switzerland 2->12 14 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->14 16 2 other IPs or domains 2->16 18 Malicious sample detected (through community Yara rule) 2->18 20 Antivirus / Scanner detection for submitted sample 2->20 22 Multi AV Scanner detection for submitted file 2->22 24 Yara detected Mirai 2->24 6 dash rm 2->6         started        8 dash rm 2->8         started        10 Space.spc.elf 2->10         started        signatures3 process4
        SourceDetectionScannerLabelLink
        Space.spc.elf58%ReversingLabsLinux.Backdoor.Mirai
        Space.spc.elf64%VirustotalBrowse
        Space.spc.elf100%AviraLINUX/Mirai.bonb
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches

        Download Network PCAP: filteredfull

        No contacted domains info
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        34.249.145.219
        unknownUnited States
        16509AMAZON-02USfalse
        109.202.202.202
        unknownSwitzerland
        13030INIT7CHfalse
        91.189.91.43
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        91.189.91.42
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        34.249.145.219Space.arc.elfGet hashmaliciousMiraiBrowse
          mips.elfGet hashmaliciousUnknownBrowse
            FBI.x86.elfGet hashmaliciousGafgyt, MiraiBrowse
              FBI.arm5.elfGet hashmaliciousGafgyt, MiraiBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    efefa7.elfGet hashmaliciousMiraiBrowse
                      sh4.elfGet hashmaliciousUnknownBrowse
                        arm5.elfGet hashmaliciousUnknownBrowse
                          na.elfGet hashmaliciousPrometeiBrowse
                            109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                            • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                            91.189.91.43Space.ppc.elfGet hashmaliciousUnknownBrowse
                              Space.arc.elfGet hashmaliciousMiraiBrowse
                                mips.elfGet hashmaliciousUnknownBrowse
                                  FBI.mpsl.elfGet hashmaliciousGafgyt, MiraiBrowse
                                    FBI.x86.elfGet hashmaliciousGafgyt, MiraiBrowse
                                      FBI.arm5.elfGet hashmaliciousGafgyt, MiraiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          na.elfGet hashmaliciousPrometeiBrowse
                                            na.elfGet hashmaliciousPrometeiBrowse
                                              arm5.elfGet hashmaliciousUnknownBrowse
                                                91.189.91.42Space.ppc.elfGet hashmaliciousUnknownBrowse
                                                  Space.arc.elfGet hashmaliciousMiraiBrowse
                                                    mips.elfGet hashmaliciousUnknownBrowse
                                                      FBI.mpsl.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                        FBI.x86.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                          FBI.arm5.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                                na.elfGet hashmaliciousPrometeiBrowse
                                                                  arm5.elfGet hashmaliciousUnknownBrowse
                                                                    No context
                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                    CANONICAL-ASGBSpace.ppc.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    Space.mpsl.elfGet hashmaliciousUnknownBrowse
                                                                    • 185.125.190.26
                                                                    Space.arc.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    mips.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    FBI.mpsl.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                    • 91.189.91.42
                                                                    FBI.x86.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                    • 91.189.91.42
                                                                    FBI.arm5.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                    • 91.189.91.42
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 91.189.91.42
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 91.189.91.42
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 91.189.91.42
                                                                    CANONICAL-ASGBSpace.ppc.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    Space.mpsl.elfGet hashmaliciousUnknownBrowse
                                                                    • 185.125.190.26
                                                                    Space.arc.elfGet hashmaliciousMiraiBrowse
                                                                    • 91.189.91.42
                                                                    mips.elfGet hashmaliciousUnknownBrowse
                                                                    • 91.189.91.42
                                                                    FBI.mpsl.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                    • 91.189.91.42
                                                                    FBI.x86.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                    • 91.189.91.42
                                                                    FBI.arm5.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                    • 91.189.91.42
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 91.189.91.42
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 91.189.91.42
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 91.189.91.42
                                                                    INIT7CHSpace.ppc.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    Space.arc.elfGet hashmaliciousMiraiBrowse
                                                                    • 109.202.202.202
                                                                    mips.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    FBI.mpsl.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                    • 109.202.202.202
                                                                    FBI.x86.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                    • 109.202.202.202
                                                                    FBI.arm5.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                    • 109.202.202.202
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 109.202.202.202
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 109.202.202.202
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 109.202.202.202
                                                                    arm5.elfGet hashmaliciousUnknownBrowse
                                                                    • 109.202.202.202
                                                                    AMAZON-02USSpace.arc.elfGet hashmaliciousMiraiBrowse
                                                                    • 34.249.145.219
                                                                    5AzgNwCtN5.exeGet hashmaliciousCryptOne, LummaC StealerBrowse
                                                                    • 108.139.47.92
                                                                    mips.elfGet hashmaliciousUnknownBrowse
                                                                    • 34.249.145.219
                                                                    7H9CCIVPzr.exeGet hashmaliciousUnknownBrowse
                                                                    • 108.139.47.92
                                                                    http://cdn.systweak.com/downloads/setups/dpfw/dpfsetup_afterupdate_1004.exeGet hashmaliciousPureLog Stealer, zgRATBrowse
                                                                    • 108.138.113.91
                                                                    Order 501 & 502.exeGet hashmaliciousFormBookBrowse
                                                                    • 13.248.169.48
                                                                    FBI.x86.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                    • 34.249.145.219
                                                                    FBI.arm5.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                    • 34.249.145.219
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 34.249.145.219
                                                                    na.elfGet hashmaliciousPrometeiBrowse
                                                                    • 34.249.145.219
                                                                    No context
                                                                    No context
                                                                    No created / dropped files found
                                                                    File type:ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
                                                                    Entropy (8bit):3.2860031001787915
                                                                    TrID:
                                                                    • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                                    File name:Space.spc.elf
                                                                    File size:230'012 bytes
                                                                    MD5:d9f71b2e332297826390e86b15382df7
                                                                    SHA1:5f5f2b9fe4dcef1b5ada947758d355ab5b49a479
                                                                    SHA256:30f6d52eafb79f979c495f137945fc702bc70ff5d695612cf8abe65f2ff5f228
                                                                    SHA512:c12567ff861bdfdd6908720d2f137366051257f9734ef659ba95b2a2b16944b1ca1471c1712e263d7fd30755d8c2bcc0e5f1fbfd300d100c27ca6037a891fb37
                                                                    SSDEEP:1536:pHjMMgySQSQ/ZgwldmR+SdqIyucVBANJUxzydZFjoVgE8N3stl0JQ:ZE5hbFdq3uIBANeeLI1+JQ
                                                                    TLSH:41243A227A790B27C4F1913950E7972BB6FA4BC82464920F7EA14D8C7F5A9703253BF4
                                                                    File Content Preview:.ELF...........................4.........4. ...(......................{p..{p...............H...H...H......88...............H...H...H...............................H................dt.Q.......................................................................

                                                                    ELF header

                                                                    Class:ELF32
                                                                    Data:2's complement, big endian
                                                                    Version:1 (current)
                                                                    Machine:Sparc
                                                                    Version Number:0x1
                                                                    Type:EXEC (Executable file)
                                                                    OS/ABI:UNIX - System V
                                                                    ABI Version:0
                                                                    Entry Point Address:0x101c4
                                                                    Flags:0x0
                                                                    ELF Header Size:52
                                                                    Program Header Offset:52
                                                                    Program Header Size:32
                                                                    Number of Program Headers:5
                                                                    Section Header Offset:229532
                                                                    Section Header Size:40
                                                                    Number of Section Headers:12
                                                                    Header String Table Index:11
                                                                    NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                                    NULL0x00x00x00x00x0000
                                                                    .initPROGBITS0x100b40x100b40x1c0x00x6AX004
                                                                    .textPROGBITS0x100d00x100d00x14f8c0x00x6AX004
                                                                    .finiPROGBITS0x2505c0x2505c0x140x00x6AX004
                                                                    .rodataPROGBITS0x250700x250700x2b000x00x2A008
                                                                    .tbssNOBITS0x380480x280480x80x00x403WAT004
                                                                    .ctorsPROGBITS0x380480x380480x80x00x3WA004
                                                                    .dtorsPROGBITS0x380500x280500x80x00x3WA004
                                                                    .gotPROGBITS0x3805c0x2805c0x1c00x40x3WA004
                                                                    .dataPROGBITS0x3821c0x2821c0x2100x00x3WA004
                                                                    .bssNOBITS0x384300x2842c0x34500x00x3WA008
                                                                    .shstrtabSTRTAB0x00x380500x490x00x0001
                                                                    TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                                    LOAD0x00x00x100000x27b700x27b704.28010x5R E0x10000.init .text .fini .rodata
                                                                    LOAD0x280480x380480x380480x3e40x38384.46090x6RW 0x10000.tbss .dtors .got .data .bss
                                                                    LOAD0x380480x380480x380480x80x81.00000x6RW 0x10000.tbss .ctors
                                                                    TLS0x00x00x380480x00x00.00000x4R 0x4
                                                                    GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                                                                    Download Network PCAP: filteredfull

                                                                    • Total Packets: 11
                                                                    • 443 (HTTPS)
                                                                    • 80 (HTTP)
                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                    Apr 2, 2025 09:48:19.994898081 CEST43928443192.168.2.2391.189.91.42
                                                                    Apr 2, 2025 09:48:25.626297951 CEST42836443192.168.2.2391.189.91.43
                                                                    Apr 2, 2025 09:48:26.650182009 CEST4251680192.168.2.23109.202.202.202
                                                                    Apr 2, 2025 09:48:40.728373051 CEST43928443192.168.2.2391.189.91.42
                                                                    Apr 2, 2025 09:48:40.736165047 CEST39256443192.168.2.2334.249.145.219
                                                                    Apr 2, 2025 09:48:40.736212969 CEST4433925634.249.145.219192.168.2.23
                                                                    Apr 2, 2025 09:48:40.736301899 CEST39256443192.168.2.2334.249.145.219
                                                                    Apr 2, 2025 09:48:40.737122059 CEST39256443192.168.2.2334.249.145.219
                                                                    Apr 2, 2025 09:48:40.737133980 CEST4433925634.249.145.219192.168.2.23
                                                                    Apr 2, 2025 09:48:53.014389992 CEST42836443192.168.2.2391.189.91.43
                                                                    Apr 2, 2025 09:48:57.109908104 CEST4251680192.168.2.23109.202.202.202
                                                                    Apr 2, 2025 09:49:21.682555914 CEST43928443192.168.2.2391.189.91.42
                                                                    Apr 2, 2025 09:49:40.728828907 CEST39256443192.168.2.2334.249.145.219
                                                                    Apr 2, 2025 09:49:40.772274971 CEST4433925634.249.145.219192.168.2.23
                                                                    Apr 2, 2025 09:50:24.929244041 CEST4433925634.249.145.219192.168.2.23

                                                                    System Behavior

                                                                    Start time (UTC):07:48:20
                                                                    Start date (UTC):02/04/2025
                                                                    Path:/tmp/Space.spc.elf
                                                                    Arguments:/tmp/Space.spc.elf
                                                                    File size:4379400 bytes
                                                                    MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

                                                                    Start time (UTC):07:49:39
                                                                    Start date (UTC):02/04/2025
                                                                    Path:/usr/bin/dash
                                                                    Arguments:-
                                                                    File size:129816 bytes
                                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                    Start time (UTC):07:49:39
                                                                    Start date (UTC):02/04/2025
                                                                    Path:/usr/bin/rm
                                                                    Arguments:rm -f /tmp/tmp.mIpEx04mbe /tmp/tmp.8m65FHPTQp /tmp/tmp.2KzBHaUz5d
                                                                    File size:72056 bytes
                                                                    MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                                    Start time (UTC):07:49:39
                                                                    Start date (UTC):02/04/2025
                                                                    Path:/usr/bin/dash
                                                                    Arguments:-
                                                                    File size:129816 bytes
                                                                    MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                                    Start time (UTC):07:49:39
                                                                    Start date (UTC):02/04/2025
                                                                    Path:/usr/bin/rm
                                                                    Arguments:rm -f /tmp/tmp.mIpEx04mbe /tmp/tmp.8m65FHPTQp /tmp/tmp.2KzBHaUz5d
                                                                    File size:72056 bytes
                                                                    MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b