Edit tour

Linux Analysis Report
xd.m68k.elf

Overview

General Information

Sample name:xd.m68k.elf
Analysis ID:1654423
MD5:53047fd604b4acbb942156b0cdf5ca4f
SHA1:16acfabd92e2ce386bef3e8223db7ffab469bbad
SHA256:52bfde2e002519b8f475c1d7e1c8e26e00163b027ad868aae3dea4b8e0544a18
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:80
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1654423
Start date and time:2025-04-02 11:07:28 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 22s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:xd.m68k.elf
Detection:MAL
Classification:mal80.troj.linELF@0/0@2/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample
Command:/tmp/xd.m68k.elf
PID:5482
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:/lib/ld-uClibc.so.0: No such file or directory
  • system is lnxubuntu20
  • xd.m68k.elf (PID: 5482, Parent: 5406, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/xd.m68k.elf
  • dash New Fork (PID: 5525, Parent: 3632)
  • rm (PID: 5525, Parent: 3632, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.vVupYHKVDI /tmp/tmp.zyEHtHcjbc /tmp/tmp.6rzpHe8hdu
  • dash New Fork (PID: 5526, Parent: 3632)
  • rm (PID: 5526, Parent: 3632, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.vVupYHKVDI /tmp/tmp.zyEHtHcjbc /tmp/tmp.6rzpHe8hdu
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
xd.m68k.elfJoeSecurity_Mirai_9Yara detected MiraiJoe Security
    xd.m68k.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      xd.m68k.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xbf26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbf3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbf4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbf62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbf76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbf8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbf9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbfb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbfc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbfda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xbfee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc002:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc016:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc02a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc03e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc052:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc066:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc07a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc08e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc0a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc0b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      xd.m68k.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0xbec6:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      SourceRuleDescriptionAuthorStrings
      5482.1.00007f943c00f000.00007f943c011000.rw-.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0x2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x7a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xa2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xb6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xde:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xf2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x106:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x11a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x12e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x142:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x156:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x16a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x17e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0x192:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      5482.1.00007f943c001000.00007f943c00e000.r-x.sdmpJoeSecurity_Mirai_9Yara detected MiraiJoe Security
        5482.1.00007f943c001000.00007f943c00e000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
          5482.1.00007f943c001000.00007f943c00e000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
          • 0xbf26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xbf3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xbf4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xbf62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xbf76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xbf8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xbf9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xbfb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xbfc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xbfda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xbfee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xc002:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xc016:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xc02a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xc03e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xc052:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xc066:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xc07a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xc08e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xc0a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          • 0xc0b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
          5482.1.00007f943c001000.00007f943c00e000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
          • 0xbec6:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
          Click to see the 1 entries
          No Suricata rule has matched

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Source: xd.m68k.elfAvira: detected
          Source: xd.m68k.elfVirustotal: Detection: 60%Perma Link
          Source: xd.m68k.elfReversingLabs: Detection: 63%
          Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
          Source: unknownTCP traffic detected without corresponding DNS query: 34.243.160.129
          Source: global trafficDNS traffic detected: DNS query: daisy.ubuntu.com
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 42470
          Source: unknownNetwork traffic detected: HTTP traffic on port 42470 -> 443

          System Summary

          barindex
          Source: xd.m68k.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: xd.m68k.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
          Source: 5482.1.00007f943c00f000.00007f943c011000.rw-.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: 5482.1.00007f943c001000.00007f943c00e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: 5482.1.00007f943c001000.00007f943c00e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
          Source: Process Memory Space: xd.m68k.elf PID: 5482, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
          Source: ELF static info symbol of initial sample.symtab present: no
          Source: xd.m68k.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: xd.m68k.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
          Source: 5482.1.00007f943c00f000.00007f943c011000.rw-.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: 5482.1.00007f943c001000.00007f943c00e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: 5482.1.00007f943c001000.00007f943c00e000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
          Source: Process Memory Space: xd.m68k.elf PID: 5482, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
          Source: classification engineClassification label: mal80.troj.linELF@0/0@2/0
          Source: /usr/bin/dash (PID: 5525)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.vVupYHKVDI /tmp/tmp.zyEHtHcjbc /tmp/tmp.6rzpHe8hduJump to behavior
          Source: /usr/bin/dash (PID: 5526)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.vVupYHKVDI /tmp/tmp.zyEHtHcjbc /tmp/tmp.6rzpHe8hduJump to behavior
          Source: /tmp/xd.m68k.elf (PID: 5482)Queries kernel information via 'uname': Jump to behavior
          Source: xd.m68k.elf, 5482.1.00005555753d7000.000055557543b000.rw-.sdmpBinary or memory string: =uUU!/etc/qemu-binfmt/m68k
          Source: xd.m68k.elf, 5482.1.00007ffd39108000.00007ffd39129000.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
          Source: xd.m68k.elf, 5482.1.00005555753d7000.000055557543b000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k
          Source: xd.m68k.elf, 5482.1.00007ffd39108000.00007ffd39129000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-m68k/tmp/xd.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/xd.m68k.elf

          Stealing of Sensitive Information

          barindex
          Source: Yara matchFile source: xd.m68k.elf, type: SAMPLE
          Source: Yara matchFile source: 5482.1.00007f943c001000.00007f943c00e000.r-x.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Source: Yara matchFile source: xd.m68k.elf, type: SAMPLE
          Source: Yara matchFile source: 5482.1.00007f943c001000.00007f943c00e000.r-x.sdmp, type: MEMORY
          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
          File Deletion
          OS Credential Dumping11
          Security Software Discovery
          Remote ServicesData from Local System1
          Encrypted Channel
          Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
          Non-Application Layer Protocol
          Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
          Application Layer Protocol
          Automated ExfiltrationData Encrypted for Impact
          No configs have been found
          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Number of created Files
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1654423 Sample: xd.m68k.elf Startdate: 02/04/2025 Architecture: LINUX Score: 80 12 34.243.160.129, 42470, 443 AMAZON-02US United States 2->12 14 daisy.ubuntu.com 2->14 16 Malicious sample detected (through community Yara rule) 2->16 18 Antivirus / Scanner detection for submitted sample 2->18 20 Multi AV Scanner detection for submitted file 2->20 22 Yara detected Mirai 2->22 6 dash rm 2->6         started        8 dash rm 2->8         started        10 xd.m68k.elf 2->10         started        signatures3 process4

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand
          SourceDetectionScannerLabelLink
          xd.m68k.elf60%VirustotalBrowse
          xd.m68k.elf64%ReversingLabsLinux.Backdoor.Mirai
          xd.m68k.elf100%AviraLINUX/Mirai.bonb
          No Antivirus matches
          No Antivirus matches
          No Antivirus matches

          Download Network PCAP: filteredfull

          NameIPActiveMaliciousAntivirus DetectionReputation
          daisy.ubuntu.com
          162.213.35.25
          truefalse
            high
            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs
            IPDomainCountryFlagASNASN NameMalicious
            34.243.160.129
            unknownUnited States
            16509AMAZON-02USfalse
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            34.243.160.129vejfa5.elfGet hashmaliciousUnknownBrowse
              FederalAgent.arm.elfGet hashmaliciousMiraiBrowse
                na.elfGet hashmaliciousPrometeiBrowse
                  na.elfGet hashmaliciousPrometeiBrowse
                    Execution.i586.elfGet hashmaliciousGafgyt, MiraiBrowse
                      sshd.elfGet hashmaliciousUnknownBrowse
                        na.elfGet hashmaliciousPrometeiBrowse
                          boatnet.arm5.elfGet hashmaliciousMiraiBrowse
                            na.elfGet hashmaliciousPrometeiBrowse
                              na.elfGet hashmaliciousPrometeiBrowse
                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                daisy.ubuntu.comxd.ppc.elfGet hashmaliciousMiraiBrowse
                                • 162.213.35.25
                                xd.i686.elfGet hashmaliciousMiraiBrowse
                                • 162.213.35.24
                                xd.arm6.elfGet hashmaliciousMiraiBrowse
                                • 162.213.35.24
                                xd.arc.elfGet hashmaliciousMiraiBrowse
                                • 162.213.35.24
                                mpsl.elfGet hashmaliciousUnknownBrowse
                                • 162.213.35.24
                                sh4.elfGet hashmaliciousUnknownBrowse
                                • 162.213.35.24
                                s-h.4-.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                • 162.213.35.24
                                x-8.6-.Sakura.elfGet hashmaliciousGafgyt, MiraiBrowse
                                • 162.213.35.24
                                arm.elfGet hashmaliciousMiraiBrowse
                                • 162.213.35.25
                                FBI.arm.elfGet hashmaliciousGafgyt, MiraiBrowse
                                • 162.213.35.24
                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                AMAZON-02USxd.arm5.elfGet hashmaliciousMiraiBrowse
                                • 34.254.182.186
                                yuioiuy.txt.ps1Get hashmaliciousUnknownBrowse
                                • 108.139.47.92
                                xd.ppc.elfGet hashmaliciousMiraiBrowse
                                • 18.138.41.48
                                https://maxenerwellness.com/Get hashmaliciousUnknownBrowse
                                • 13.127.204.192
                                cfr4.txt.ps1Get hashmaliciousUnknownBrowse
                                • 108.139.47.33
                                xd.i686.elfGet hashmaliciousMiraiBrowse
                                • 13.216.220.162
                                xd.sh4.elfGet hashmaliciousMiraiBrowse
                                • 18.148.60.32
                                xd.spc.elfGet hashmaliciousMiraiBrowse
                                • 34.217.111.235
                                xd.i486.elfGet hashmaliciousMiraiBrowse
                                • 44.243.245.97
                                xd.x86_64.elfGet hashmaliciousMiraiBrowse
                                • 18.217.152.110
                                No context
                                No context
                                No created / dropped files found
                                File type:ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
                                Entropy (8bit):6.412201983297108
                                TrID:
                                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                File name:xd.m68k.elf
                                File size:54'440 bytes
                                MD5:53047fd604b4acbb942156b0cdf5ca4f
                                SHA1:16acfabd92e2ce386bef3e8223db7ffab469bbad
                                SHA256:52bfde2e002519b8f475c1d7e1c8e26e00163b027ad868aae3dea4b8e0544a18
                                SHA512:5ec699e24d64ec7a6dc5a290fed2f8605a2e3a2d385b43f7f11354ad15267cb199591001c9ebed9b9da8c223a436b2f17baec663c3365ffe2c57223472f8d253
                                SSDEEP:768:MkOLoQZYrQGL6HakaGRP2Yso6SR09peXVQ7u4RKM7/13Hm+f1pr9gzv0e7/:/OpYQc6Hakam+YZqQVQ7R7/BGg1pqz5
                                TLSH:9F332999B4012E3CE9D748F950768F0AAE112391A193060B63BBFE973D33255FE55C8C
                                File Content Preview:.ELF...........................4.........4. ...(...........4...4...4.............................................................................. ............................... .................................dt.Q............................/lib/ld-uCl

                                ELF header

                                Class:ELF32
                                Data:2's complement, big endian
                                Version:1 (current)
                                Machine:MC68000
                                Version Number:0x1
                                Type:EXEC (Executable file)
                                OS/ABI:UNIX - System V
                                ABI Version:0
                                Entry Point Address:0x80000e1c
                                Flags:0x0
                                ELF Header Size:52
                                Program Header Offset:52
                                Program Header Size:32
                                Number of Program Headers:6
                                Section Header Offset:53720
                                Section Header Size:40
                                Number of Section Headers:18
                                Header String Table Index:17
                                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                NULL0x00x00x00x00x0000
                                .interpPROGBITS0x800000f40xf40x140x00x2A001
                                .hashHASH0x800001080x1080x1700x40x2A304
                                .dynsymDYNSYM0x800002780x2780x3500x100x2A414
                                .dynstrSTRTAB0x800005c80x5c80x18f0x00x2A001
                                .rela.pltRELA0x800007580x7580x2400xc0x2A374
                                .initPROGBITS0x800009980x9980x140x00x6AX002
                                .pltPROGBITS0x800009ac0x9ac0x3d40x140x6AX004
                                .textPROGBITS0x80000d800xd800xae660x00x6AX004
                                .finiPROGBITS0x8000bbe60xbbe60xe0x00x6AX002
                                .rodataPROGBITS0x8000bbf40xbbf40x13c40x00x2A002
                                .ctorsPROGBITS0x8000efbc0xcfbc0x80x00x3WA004
                                .dtorsPROGBITS0x8000efc40xcfc40x80x00x3WA004
                                .dynamicDYNAMIC0x8000efd00xcfd00xb00x80x3WA404
                                .gotPROGBITS0x8000f0800xd0800xcc0x40x3WA004
                                .dataPROGBITS0x8000f14c0xd14c0x180x00x3WA004
                                .bssNOBITS0x8000f1640xd1640x3180x00x3WA004
                                .shstrtabSTRTAB0x00xd1640x740x00x0001
                                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                PHDR0x340x800000340x800000340xc00xc02.29820x5R E0x4
                                INTERP0xf40x800000f40x800000f40x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
                                LOAD0x00x800000000x800000000xcfb80xcfb86.45910x5R E0x2000.interp .hash .dynsym .dynstr .rela.plt .init .plt .text .fini .rodata
                                LOAD0xcfbc0x8000efbc0x8000efbc0x1a80x4c03.44430x6RW 0x2000.ctors .dtors .dynamic .got .data .bss
                                DYNAMIC0xcfd00x8000efd00x8000efd00xb00xb02.03170x6RW 0x4.dynamic
                                GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
                                TypeMetaValueTag
                                DT_NEEDEDsharedliblibc.so.00x1
                                DT_INITvalue0x800009980xc
                                DT_FINIvalue0x8000bbe60xd
                                DT_HASHvalue0x800001080x4
                                DT_STRTABvalue0x800005c80x5
                                DT_SYMTABvalue0x800002780x6
                                DT_STRSZbytes3990xa
                                DT_SYMENTbytes160xb
                                DT_DEBUGvalue0x00x15
                                DT_PLTGOTvalue0x8000f0800x3
                                DT_PLTRELSZbytes5760x2
                                DT_PLTRELpltrelDT_RELA0x14
                                DT_JMPRELvalue0x800007580x17
                                DT_RELAvalue0x800007580x7
                                DT_RELASZbytes00x8
                                DT_RELAENTbytes120x9
                                DT_NULLvalue0x00x0
                                NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                                .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                __bss_start.dynsym0x8000f1640NOTYPE<unknown>DEFAULTSHN_ABS
                                __errno_location.dynsym0x80000c9026FUNC<unknown>DEFAULTSHN_UNDEF
                                __uClibc_main.dynsym0x80000c18464FUNC<unknown>DEFAULTSHN_UNDEF
                                _edata.dynsym0x8000f1640NOTYPE<unknown>DEFAULTSHN_ABS
                                _end.dynsym0x8000f47c0NOTYPE<unknown>DEFAULTSHN_ABS
                                _start.dynsym0x80000e1c0FUNC<unknown>DEFAULT8
                                atoi.dynsym0x80000cb828FUNC<unknown>DEFAULTSHN_UNDEF
                                bind.dynsym0x80000b3c48FUNC<unknown>DEFAULTSHN_UNDEF
                                calloc.dynsym0x80000b00118FUNC<unknown>DEFAULTSHN_UNDEF
                                clock.dynsym0x80000ce076FUNC<unknown>DEFAULTSHN_UNDEF
                                close.dynsym0x80000d3060FUNC<unknown>DEFAULTSHN_UNDEF
                                closedir.dynsym0x80000d08208FUNC<unknown>DEFAULTSHN_UNDEF
                                connect.dynsym0x800009e848FUNC<unknown>DEFAULTSHN_UNDEF
                                exit.dynsym0x80000ca4136FUNC<unknown>DEFAULTSHN_UNDEF
                                fcntl.dynsym0x80000d1c188FUNC<unknown>DEFAULTSHN_UNDEF
                                fork.dynsym0x80000c0456FUNC<unknown>DEFAULTSHN_UNDEF
                                free.dynsym0x80000d4448FUNC<unknown>DEFAULTSHN_UNDEF
                                getpid.dynsym0x80000a2456FUNC<unknown>DEFAULTSHN_UNDEF
                                getppid.dynsym0x80000c4056FUNC<unknown>DEFAULTSHN_UNDEF
                                getsockname.dynsym0x80000d6c50FUNC<unknown>DEFAULTSHN_UNDEF
                                getsockopt.dynsym0x80000c7c66FUNC<unknown>DEFAULTSHN_UNDEF
                                inet_addr.dynsym0x80000b5048FUNC<unknown>DEFAULTSHN_UNDEF
                                ioctl.dynsym0x800009c0130FUNC<unknown>DEFAULTSHN_UNDEF
                                kill.dynsym0x80000b2824FUNC<unknown>DEFAULTSHN_UNDEF
                                listen.dynsym0x80000bf042FUNC<unknown>DEFAULTSHN_UNDEF
                                malloc.dynsym0x80000a60184FUNC<unknown>DEFAULTSHN_UNDEF
                                memcpy.dynsym0x80000a38244FUNC<unknown>DEFAULTSHN_UNDEF
                                memmove.dynsym0x80000a10292FUNC<unknown>DEFAULTSHN_UNDEF
                                memset.dynsym0x80000c2c310FUNC<unknown>DEFAULTSHN_UNDEF
                                open.dynsym0x80000ccc82FUNC<unknown>DEFAULTSHN_UNDEF
                                opendir.dynsym0x80000c68350FUNC<unknown>DEFAULTSHN_UNDEF
                                rand.dynsym0x80000b7814FUNC<unknown>DEFAULTSHN_UNDEF
                                read.dynsym0x80000ba084FUNC<unknown>DEFAULTSHN_UNDEF
                                readdir.dynsym0x80000ac4304FUNC<unknown>DEFAULTSHN_UNDEF
                                readlink.dynsym0x80000a4c84FUNC<unknown>DEFAULTSHN_UNDEF
                                realloc.dynsym0x80000bdc422FUNC<unknown>DEFAULTSHN_UNDEF
                                recv.dynsym0x800009d456FUNC<unknown>DEFAULTSHN_UNDEF
                                recvfrom.dynsym0x80000a8872FUNC<unknown>DEFAULTSHN_UNDEF
                                select.dynsym0x80000ab0100FUNC<unknown>DEFAULTSHN_UNDEF
                                send.dynsym0x80000aec56FUNC<unknown>DEFAULTSHN_UNDEF
                                sendto.dynsym0x80000bc870FUNC<unknown>DEFAULTSHN_UNDEF
                                setsid.dynsym0x80000cf456FUNC<unknown>DEFAULTSHN_UNDEF
                                setsockopt.dynsym0x80000b6464FUNC<unknown>DEFAULTSHN_UNDEF
                                sigaddset.dynsym0x80000ad870FUNC<unknown>DEFAULTSHN_UNDEF
                                sigemptyset.dynsym0x800009fc60FUNC<unknown>DEFAULTSHN_UNDEF
                                signal.dynsym0x80000b8c252FUNC<unknown>DEFAULTSHN_UNDEF
                                sigprocmask.dynsym0x80000d58160FUNC<unknown>DEFAULTSHN_UNDEF
                                sleep.dynsym0x80000a74558FUNC<unknown>DEFAULTSHN_UNDEF
                                socket.dynsym0x80000a9c50FUNC<unknown>DEFAULTSHN_UNDEF
                                time.dynsym0x80000c5462FUNC<unknown>DEFAULTSHN_UNDEF
                                unlink.dynsym0x80000bb462FUNC<unknown>DEFAULTSHN_UNDEF
                                write.dynsym0x80000b1484FUNC<unknown>DEFAULTSHN_UNDEF

                                Download Network PCAP: filteredfull

                                • Total Packets: 4
                                • 443 (HTTPS)
                                • 53 (DNS)
                                TimestampSource PortDest PortSource IPDest IP
                                Apr 2, 2025 11:08:20.380686045 CEST42470443192.168.2.1434.243.160.129
                                Apr 2, 2025 11:08:47.524615049 CEST42470443192.168.2.1434.243.160.129
                                Apr 2, 2025 11:08:47.751898050 CEST4434247034.243.160.129192.168.2.14
                                TimestampSource PortDest PortSource IPDest IP
                                Apr 2, 2025 11:10:55.029478073 CEST4366153192.168.2.148.8.8.8
                                Apr 2, 2025 11:10:55.029552937 CEST3549153192.168.2.148.8.8.8
                                Apr 2, 2025 11:10:55.121014118 CEST53354918.8.8.8192.168.2.14
                                Apr 2, 2025 11:10:55.153630972 CEST53436618.8.8.8192.168.2.14
                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                Apr 2, 2025 11:10:55.029478073 CEST192.168.2.148.8.8.80x1ab4Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                Apr 2, 2025 11:10:55.029552937 CEST192.168.2.148.8.8.80xc260Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                Apr 2, 2025 11:10:55.153630972 CEST8.8.8.8192.168.2.140x1ab4No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                                Apr 2, 2025 11:10:55.153630972 CEST8.8.8.8192.168.2.140x1ab4No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false

                                System Behavior

                                Start time (UTC):09:08:10
                                Start date (UTC):02/04/2025
                                Path:/tmp/xd.m68k.elf
                                Arguments:/tmp/xd.m68k.elf
                                File size:4463432 bytes
                                MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                Start time (UTC):09:08:47
                                Start date (UTC):02/04/2025
                                Path:/usr/bin/dash
                                Arguments:-
                                File size:129816 bytes
                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                Start time (UTC):09:08:47
                                Start date (UTC):02/04/2025
                                Path:/usr/bin/rm
                                Arguments:rm -f /tmp/tmp.vVupYHKVDI /tmp/tmp.zyEHtHcjbc /tmp/tmp.6rzpHe8hdu
                                File size:72056 bytes
                                MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                Start time (UTC):09:08:47
                                Start date (UTC):02/04/2025
                                Path:/usr/bin/dash
                                Arguments:-
                                File size:129816 bytes
                                MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                Start time (UTC):09:08:47
                                Start date (UTC):02/04/2025
                                Path:/usr/bin/rm
                                Arguments:rm -f /tmp/tmp.vVupYHKVDI /tmp/tmp.zyEHtHcjbc /tmp/tmp.6rzpHe8hdu
                                File size:72056 bytes
                                MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b