Play interactive tour

Edit tour

Linux Analysis Report uRQVqbl0sQ

Overview

General Information

Sample Name:	uRQVqbl0sQ
Analysis ID:	519456
MD5:	b3912b6cc3cc37dedb72c478cb3b8a11
SHA1:	dcf11bf6eb7dc7cb78cc4b1155539a61946682be
SHA256:	0d6118773c685f8e28933621ea9069678136d09a361babf004229ea414aa89ab
Tags:	32elfmirairenesas
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Mirai

Uses known network protocols on non-standard ports

Yara signature match

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work

Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	519456
Start date:	10.11.2021
Start time:	19:01:48
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 35s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	uRQVqbl0sQ
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal92.troj.lin@0/0@0/0
Warnings:	Show All Report size exceeded maximum capacity and may have missing network information. TCP Packets have been reduced to 100 VT rate limit hit for: /opt/package/joesandbox/database/analysis/519456/sample/uRQVqbl0sQ

Process Tree

system is lnxubuntu20

uRQVqbl0sQ (PID: 5248, Parent: 5110, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/uRQVqbl0sQ

uRQVqbl0sQ New Fork (PID: 5250, Parent: 5248)

uRQVqbl0sQ New Fork (PID: 5251, Parent: 5248)

uRQVqbl0sQ New Fork (PID: 5252, Parent: 5248)

uRQVqbl0sQ New Fork (PID: 5256, Parent: 5252)

uRQVqbl0sQ New Fork (PID: 5257, Parent: 5252)

uRQVqbl0sQ New Fork (PID: 5258, Parent: 5252)

cleanup

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
uRQVqbl0sQ	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x11040:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x110b0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11120:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11190:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11200:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11470:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x114c4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11518:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x1156c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x115c0:$xo1: oMXKNNC\x0D\x17\x0C\x12
uRQVqbl0sQ	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x106c4:$x1: POST /cdn-cgi/ 0x10ec0:$s1: LCOGQGPTGP 0x10950:$s3: CFOKLKQVPCVMP 0x10a74:$s4: QWRGPTKQMP 0x10a44:$s5: HWCLVGAJ
uRQVqbl0sQ	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x106c4:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
uRQVqbl0sQ	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
uRQVqbl0sQ	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
5257.1.0000000021824ec1.000000001e5cec84.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x414:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x488:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x4fc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x570:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x5e4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x864:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x8bc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x914:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x96c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x9c4:$xo1: oMXKNNC\x0D\x17\x0C\x12
5248.1.0000000021824ec1.000000001e5cec84.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x414:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x488:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x4fc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x570:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x5e4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x864:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x8bc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x914:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x96c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x9c4:$xo1: oMXKNNC\x0D\x17\x0C\x12
5248.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x11040:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x110b0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11120:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11190:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11200:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11470:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x114c4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11518:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x1156c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x115c0:$xo1: oMXKNNC\x0D\x17\x0C\x12
5248.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x106c4:$x1: POST /cdn-cgi/ 0x10ec0:$s1: LCOGQGPTGP 0x10950:$s3: CFOKLKQVPCVMP 0x10a74:$s4: QWRGPTKQMP 0x10a44:$s5: HWCLVGAJ
5248.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x106c4:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5248.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5248.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5251.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x11040:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x110b0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11120:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11190:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11200:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11470:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x114c4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11518:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x1156c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x115c0:$xo1: oMXKNNC\x0D\x17\x0C\x12
5251.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x106c4:$x1: POST /cdn-cgi/ 0x10ec0:$s1: LCOGQGPTGP 0x10950:$s3: CFOKLKQVPCVMP 0x10a74:$s4: QWRGPTKQMP 0x10a44:$s5: HWCLVGAJ
5251.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x106c4:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5251.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5251.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5251.1.0000000021824ec1.000000001e5cec84.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x414:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x488:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x4fc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x570:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x5e4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x864:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x8bc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x914:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x96c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x9c4:$xo1: oMXKNNC\x0D\x17\x0C\x12
5257.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x11040:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x110b0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11120:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11190:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11200:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11470:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x114c4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11518:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x1156c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x115c0:$xo1: oMXKNNC\x0D\x17\x0C\x12
5257.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x106c4:$x1: POST /cdn-cgi/ 0x10ec0:$s1: LCOGQGPTGP 0x10950:$s3: CFOKLKQVPCVMP 0x10a74:$s4: QWRGPTKQMP 0x10a44:$s5: HWCLVGAJ
5257.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x106c4:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5257.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5257.1.000000008e3e6270.00000000577ea06f.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Click to see the 13 entries

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: uRQVqbl0sQ

Avira: detected

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 492 INFO TELNET login failed 61.236.85.105:23 -> 192.168.2.23:40684
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 67.213.246.144:23 -> 192.168.2.23:39470
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 67.213.246.144:23 -> 192.168.2.23:39470
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 67.213.246.144:23 -> 192.168.2.23:39492
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 67.213.246.144:23 -> 192.168.2.23:39492
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 61.236.85.105:23 -> 192.168.2.23:40716
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 67.213.246.144:23 -> 192.168.2.23:39508
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 67.213.246.144:23 -> 192.168.2.23:39508
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 61.236.85.105:23 -> 192.168.2.23:40738
Source: Traffic	Snort IDS: 716 INFO TELNET access 149.62.33.181:23 -> 192.168.2.23:34596
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 61.236.85.105:23 -> 192.168.2.23:40794
Source: Traffic	Snort IDS: 716 INFO TELNET access 78.30.62.247:23 -> 192.168.2.23:45350
Source: Traffic	Snort IDS: 716 INFO TELNET access 78.30.62.247:23 -> 192.168.2.23:45354
Source: Traffic	Snort IDS: 716 INFO TELNET access 78.30.62.247:23 -> 192.168.2.23:45360
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 78.30.62.247:23 -> 192.168.2.23:45360
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 78.30.62.247:23 -> 192.168.2.23:45360
Source: Traffic	Snort IDS: 716 INFO TELNET access 78.30.62.247:23 -> 192.168.2.23:45436
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 61.236.85.105:23 -> 192.168.2.23:40910
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 78.30.62.247:23 -> 192.168.2.23:45436
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 78.30.62.247:23 -> 192.168.2.23:45436
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.11.76.207:23 -> 192.168.2.23:49082
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.11.76.207:23 -> 192.168.2.23:49086
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 67.213.246.144:23 -> 192.168.2.23:39706
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 67.213.246.144:23 -> 192.168.2.23:39706
Source: Traffic	Snort IDS: 716 INFO TELNET access 78.30.62.247:23 -> 192.168.2.23:45512
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.11.76.207:23 -> 192.168.2.23:49134
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 67.213.246.144:23 -> 192.168.2.23:39754
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 67.213.246.144:23 -> 192.168.2.23:39754
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 78.30.62.247:23 -> 192.168.2.23:45512
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 78.30.62.247:23 -> 192.168.2.23:45512
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 61.236.85.105:23 -> 192.168.2.23:40978
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.11.76.207:23 -> 192.168.2.23:49140
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.11.76.207:23 -> 192.168.2.23:49144
Source: Traffic	Snort IDS: 716 INFO TELNET access 149.62.33.181:23 -> 192.168.2.23:34778
Source: Traffic	Snort IDS: 716 INFO TELNET access 78.30.62.247:23 -> 192.168.2.23:45530
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.11.76.207:23 -> 192.168.2.23:49150
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 78.30.62.247:23 -> 192.168.2.23:45530
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 78.30.62.247:23 -> 192.168.2.23:45530
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.11.76.207:23 -> 192.168.2.23:49156
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 61.236.85.105:23 -> 192.168.2.23:40998
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.11.76.207:23 -> 192.168.2.23:49168
Source: Traffic	Snort IDS: 716 INFO TELNET access 78.30.62.247:23 -> 192.168.2.23:45554
Source: Traffic	Snort IDS: 716 INFO TELNET access 78.30.62.247:23 -> 192.168.2.23:45558
Source: Traffic	Snort IDS: 716 INFO TELNET access 78.30.62.247:23 -> 192.168.2.23:45560
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.11.76.207:23 -> 192.168.2.23:49186
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 78.30.62.247:23 -> 192.168.2.23:45560
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 78.30.62.247:23 -> 192.168.2.23:45560
Source: Traffic	Snort IDS: 716 INFO TELNET access 112.11.76.207:23 -> 192.168.2.23:49194
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 61.236.85.105:23 -> 192.168.2.23:41032
Source: Traffic	Snort IDS: 716 INFO TELNET access 78.30.62.247:23 -> 192.168.2.23:45582
Source: Traffic	Snort IDS: 492 INFO TELNET login failed 61.236.85.105:23 -> 192.168.2.23:41038
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 78.30.62.247:23 -> 192.168.2.23:45582
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 78.30.62.247:23 -> 192.168.2.23:45582
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 83.1.97.96:23 -> 192.168.2.23:39360
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 83.1.97.96:23 -> 192.168.2.23:39360
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 83.1.97.96:23 -> 192.168.2.23:39364
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 83.1.97.96:23 -> 192.168.2.23:39364
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 83.1.97.96:23 -> 192.168.2.23:39368
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 83.1.97.96:23 -> 192.168.2.23:39368
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 83.1.97.96:23 -> 192.168.2.23:39370
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 83.1.97.96:23 -> 192.168.2.23:39370
Source: Traffic	Snort IDS: 716 INFO TELNET access 149.62.33.181:23 -> 192.168.2.23:34848
Source: Traffic	Snort IDS: 716 INFO TELNET access 149.62.33.181:23 -> 192.168.2.23:34890
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 114.32.113.9:23 -> 192.168.2.23:44268
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 114.32.113.9:23 -> 192.168.2.23:44268
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 212.110.2.14:23 -> 192.168.2.23:34654
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 212.110.2.14:23 -> 192.168.2.23:34654
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 178.44.228.47:23 -> 192.168.2.23:40356
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 178.44.228.47:23 -> 192.168.2.23:40356
Source: Traffic	Snort IDS: 716 INFO TELNET access 149.62.33.181:23 -> 192.168.2.23:35036
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 212.110.2.14:23 -> 192.168.2.23:34718
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 212.110.2.14:23 -> 192.168.2.23:34718
Source: Traffic	Snort IDS: 716 INFO TELNET access 213.149.219.222:23 -> 192.168.2.23:50296
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 212.110.2.14:23 -> 192.168.2.23:34732
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 212.110.2.14:23 -> 192.168.2.23:34732
Source: Traffic	Snort IDS: 1251 INFO TELNET Bad Login 212.110.2.14:23 -> 192.168.2.23:34762
Source: Traffic	Snort IDS: 718 INFO TELNET login incorrect 212.110.2.14:23 -> 192.168.2.23:34762

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51768
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51770
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51772
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51776
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51778
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51782
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51786
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51792
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51794
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51798

Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443

Source: global traffic

TCP traffic: 192.168.2.23:40320 -> 163.172.183.97:9375

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 163.172.183.97
Source: unknown	TCP traffic detected without corresponding DNS query: 41.175.114.187
Source: unknown	TCP traffic detected without corresponding DNS query: 92.121.55.1
Source: unknown	TCP traffic detected without corresponding DNS query: 45.240.225.198
Source: unknown	TCP traffic detected without corresponding DNS query: 243.32.96.9
Source: unknown	TCP traffic detected without corresponding DNS query: 181.49.232.32
Source: unknown	TCP traffic detected without corresponding DNS query: 191.64.176.161
Source: unknown	TCP traffic detected without corresponding DNS query: 118.20.171.2
Source: unknown	TCP traffic detected without corresponding DNS query: 71.105.232.154
Source: unknown	TCP traffic detected without corresponding DNS query: 66.28.35.220
Source: unknown	TCP traffic detected without corresponding DNS query: 125.50.154.90
Source: unknown	TCP traffic detected without corresponding DNS query: 44.176.173.44
Source: unknown	TCP traffic detected without corresponding DNS query: 122.232.166.192
Source: unknown	TCP traffic detected without corresponding DNS query: 194.252.133.93
Source: unknown	TCP traffic detected without corresponding DNS query: 73.114.203.42
Source: unknown	TCP traffic detected without corresponding DNS query: 82.105.141.65
Source: unknown	TCP traffic detected without corresponding DNS query: 151.104.16.3
Source: unknown	TCP traffic detected without corresponding DNS query: 154.122.144.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.18.193.92
Source: unknown	TCP traffic detected without corresponding DNS query: 133.87.253.10
Source: unknown	TCP traffic detected without corresponding DNS query: 47.90.53.222
Source: unknown	TCP traffic detected without corresponding DNS query: 32.159.29.128
Source: unknown	TCP traffic detected without corresponding DNS query: 126.192.190.83
Source: unknown	TCP traffic detected without corresponding DNS query: 173.128.115.46
Source: unknown	TCP traffic detected without corresponding DNS query: 167.127.24.63
Source: unknown	TCP traffic detected without corresponding DNS query: 195.80.84.105
Source: unknown	TCP traffic detected without corresponding DNS query: 124.89.236.214
Source: unknown	TCP traffic detected without corresponding DNS query: 48.107.96.33
Source: unknown	TCP traffic detected without corresponding DNS query: 183.132.23.88
Source: unknown	TCP traffic detected without corresponding DNS query: 60.165.240.124
Source: unknown	TCP traffic detected without corresponding DNS query: 207.187.146.250
Source: unknown	TCP traffic detected without corresponding DNS query: 162.209.241.185
Source: unknown	TCP traffic detected without corresponding DNS query: 126.164.205.54
Source: unknown	TCP traffic detected without corresponding DNS query: 177.111.58.238
Source: unknown	TCP traffic detected without corresponding DNS query: 194.90.177.206
Source: unknown	TCP traffic detected without corresponding DNS query: 14.227.101.196
Source: unknown	TCP traffic detected without corresponding DNS query: 40.226.21.253
Source: unknown	TCP traffic detected without corresponding DNS query: 73.186.118.21
Source: unknown	TCP traffic detected without corresponding DNS query: 181.156.178.46
Source: unknown	TCP traffic detected without corresponding DNS query: 141.84.154.44
Source: unknown	TCP traffic detected without corresponding DNS query: 150.233.49.113
Source: unknown	TCP traffic detected without corresponding DNS query: 252.53.171.234
Source: unknown	TCP traffic detected without corresponding DNS query: 172.212.185.89
Source: unknown	TCP traffic detected without corresponding DNS query: 98.22.228.111
Source: unknown	TCP traffic detected without corresponding DNS query: 191.179.103.79
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.190.66
Source: unknown	TCP traffic detected without corresponding DNS query: 164.250.116.194
Source: unknown	TCP traffic detected without corresponding DNS query: 17.66.197.210
Source: unknown	TCP traffic detected without corresponding DNS query: 199.21.28.148

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: uRQVqbl0sQ, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: uRQVqbl0sQ, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5248.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5248.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5251.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5251.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5257.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5257.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Source: uRQVqbl0sQ, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: uRQVqbl0sQ, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: uRQVqbl0sQ, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5257.1.0000000021824ec1.000000001e5cec84.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5248.1.0000000021824ec1.000000001e5cec84.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5248.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5248.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5248.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5251.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5251.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5251.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5251.1.0000000021824ec1.000000001e5cec84.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5257.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 5257.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5257.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/uRQVqbl0sQ (PID: 5250)	SIGKILL sent: pid: 759, result: successful
Source: /tmp/uRQVqbl0sQ (PID: 5256)	SIGKILL sent: pid: 759, result: successful

Source: classification engine

Classification label: mal92.troj.lin@0/0@0/0

Source: uRQVqbl0sQ

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/5141/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/5263/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1582/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2033/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2275/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/3088/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1612/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1579/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1699/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1335/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1698/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2028/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1334/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1576/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2302/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/3236/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2025/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2146/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/910/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/5258/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/912/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/517/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/759/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2307/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/918/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/4460/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/4461/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/4464/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/5157/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1594/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2285/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2281/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1349/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1623/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/761/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1622/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/884/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1983/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2038/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1344/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1465/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1586/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1463/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2156/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/800/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/801/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/5149/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1629/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/4458/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/4459/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1627/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1900/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/3021/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/491/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2294/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2050/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/5161/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1877/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/772/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1633/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1599/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1632/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/774/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1477/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/654/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/896/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1476/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1872/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2048/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/655/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1475/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2289/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/656/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/777/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/657/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/658/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/419/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/936/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1639/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1638/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2208/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2180/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/4482/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/4485/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1809/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/5213/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1494/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1890/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2063/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2062/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1888/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1886/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/420/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1489/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/785/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1642/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/788/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/667/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/789/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/5207/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/1648/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2191/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/4495/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2078/exe
Source: /tmp/uRQVqbl0sQ (PID: 5250)	File opened: /proc/2077/exe

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51768
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51770
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51772
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51776
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51778
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51782
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51786
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51792
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51794
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 51798

Source: /tmp/uRQVqbl0sQ (PID: 5248)

Queries kernel information via 'uname':

Source: uRQVqbl0sQ, 5248.1.000000006201dacc.00000000a8f5863d.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: uRQVqbl0sQ, 5248.1.000000006201dacc.00000000a8f5863d.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/uRQVqbl0sQSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/uRQVqbl0sQ
Source: uRQVqbl0sQ, 5248.1.000000006b334927.00000000caa04d9f.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: uRQVqbl0sQ, 5248.1.000000006b334927.00000000caa04d9f.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information:

Yara detected Mirai

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: uRQVqbl0sQ, type: SAMPLE
Source: Yara match	File source: 5248.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5251.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5257.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Mirai

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: uRQVqbl0sQ, type: SAMPLE
Source: Yara match	File source: 5248.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5251.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5257.1.000000008e3e6270.00000000577ea06f.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping1	Security Software Discovery11	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
uRQVqbl0sQ	100%	Avira	LINUX/Mirai.bonb

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
221.132.139.15	unknown	Japan	4721	JCNJupiterTelecommunicationsCoLtdJP	false
16.128.90.38	unknown	United States	unknown	unknown	false
254.17.65.139	unknown	Reserved	unknown	unknown	false
244.244.194.236	unknown	Reserved	unknown	unknown	false
212.234.251.210	unknown	France	3215	FranceTelecom-OrangeFR	false
220.232.97.168	unknown	China	9812	CNNIC-CN-COLNETOrientalCableNetworkCoLtdCN	false
198.246.6.47	unknown	United States	16489	WEBSTERUS	false
89.3.170.244	unknown	France	21502	ASN-NUMERICABLEFR	false
68.114.130.223	unknown	United States	20115	CHARTER-20115US	false
200.176.122.250	unknown	Brazil	22548	NucleodeInfeCoorddoPontoBR-NICBR	false
151.162.61.165	unknown	United States	45025	EDN-ASUA	false
185.244.103.18	unknown	Estonia	202635	SERVERFARMEE	false
119.47.138.206	unknown	Japan	7679	QTNETQTnetIncJP	false
165.112.93.230	unknown	United States	3527	NIH-NETUS	false
92.190.53.176	unknown	France	12479	UNI2-ASES	false
5.242.193.103	unknown	Sweden	1257	TELE2EU	false
104.220.195.178	unknown	United States	11404	AS-WAVE-1US	false
244.126.127.109	unknown	Reserved	unknown	unknown	false
218.57.164.61	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
195.52.156.254	unknown	Germany	12312	ECOTELDE	false
18.141.201.6	unknown	United States	16509	AMAZON-02US	false
53.21.24.250	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
207.142.148.42	unknown	United States	27229	WEBHOST-ASN1US	false
218.171.14.104	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
92.202.25.135	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
103.181.76.144	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
86.253.44.190	unknown	France	3215	FranceTelecom-OrangeFR	false
223.16.26.120	unknown	Hong Kong	18116	HGC-AS-APHGCGlobalCommunicationsLimitedHK	false
58.135.118.66	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
155.54.8.208	unknown	Spain	766	REDIRISRedIRISAutonomousSystemES	false
43.126.67.228	unknown	Japan	4249	LILLY-ASUS	false
253.40.131.78	unknown	Reserved	unknown	unknown	false
201.41.94.26	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
85.251.205.254	unknown	Spain	6739	ONO-ASCableuropa-ONOES	false
27.170.232.227	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
114.115.199.72	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
13.32.10.46	unknown	United States	7018	ATT-INTERNET4US	false
92.171.195.197	unknown	France	3215	FranceTelecom-OrangeFR	false
248.250.252.65	unknown	Reserved	unknown	unknown	false
141.11.125.3	unknown	United Kingdom	3215	FranceTelecom-OrangeFR	false
69.82.241.181	unknown	United States	6167	CELLCO-PARTUS	false
32.11.38.200	unknown	United States	8030	WORLDNET5-10US	false
48.57.70.72	unknown	United States	2686	ATGS-MMD-ASUS	false
193.163.92.214	unknown	Denmark	1935	FR-RENATER-LIMOUSINReseauRegionalLimousinEU	false
246.115.0.143	unknown	Reserved	unknown	unknown	false
146.40.33.191	unknown	United States	197938	TRAVIANGAMESDE	false
253.150.99.23	unknown	Reserved	unknown	unknown	false
75.168.160.245	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
202.45.105.247	unknown	Australia	4739	INTERNODE-ASInternodePtyLtdAU	false
35.188.107.17	unknown	United States	15169	GOOGLEUS	false
37.209.0.142	unknown	Germany	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
72.46.16.160	unknown	United States	62833	HUDSONFIBERNETUS	false
5.112.252.160	unknown	Iran (ISLAMIC Republic Of)	44244	IRANCELL-ASIR	false
139.230.139.168	unknown	Australia	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
197.96.148.24	unknown	South Africa	3741	ISZA	false
152.142.62.161	unknown	United States	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
39.162.171.8	unknown	China	24445	CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN	false
184.121.172.5	unknown	United States	7922	COMCAST-7922US	false
102.126.15.78	unknown	Sudan	36972	MTNSD	false
240.181.11.98	unknown	Reserved	unknown	unknown	false
35.32.155.175	unknown	United States	36375	UMICH-AS-5US	false
113.184.12.149	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
195.194.212.211	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
35.75.185.27	unknown	United States	16509	AMAZON-02US	false
18.53.34.31	unknown	United States	3	MIT-GATEWAYSUS	false
47.169.7.58	unknown	United States	5650	FRONTIER-FRTRUS	false
244.216.167.217	unknown	Reserved	unknown	unknown	false
220.184.151.140	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
159.71.142.201	unknown	United States	5972	DNIC-ASBLK-05800-06055US	false
159.130.98.227	unknown	Norway	25400	TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO	false
170.211.198.3	unknown	United States	21852	DISNW1US	false
220.96.250.128	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
203.6.38.83	unknown	Australia	9466	UUNET-JP-APUUNETJapanLimitedJP	false
36.228.252.69	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
105.221.136.145	unknown	South Africa	16637	MTNNS-ASZA	false
139.190.62.89	unknown	Pakistan	38547	WITRIBE-AS-APWITRIBEPAKISTANLIMITEDPK	false
76.154.169.141	unknown	United States	7922	COMCAST-7922US	false
91.176.208.16	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
147.87.33.23	unknown	Switzerland	559	SWITCHPeeringrequestspeeringswitchchEU	false
144.57.21.205	unknown	Sweden	39052	SKANSKANET-ASSE	false
41.165.255.14	unknown	South Africa	36937	Neotel-ASZA	false
42.165.178.193	unknown	China	4249	LILLY-ASUS	false
85.125.243.155	unknown	Austria	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
142.58.38.188	unknown	Canada	11105	SFU-ASCA	false
169.82.255.8	unknown	United States	37611	AfrihostZA	false
60.43.113.150	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
121.185.252.163	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
53.204.40.144	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
100.233.7.7	unknown	United States	21928	T-MOBILE-AS21928US	false
104.123.190.215	unknown	United States	1299	TELIANETTeliaCarrierEU	false
242.12.196.250	unknown	Reserved	unknown	unknown	false
241.155.135.243	unknown	Reserved	unknown	unknown	false
102.139.101.79	unknown	Cote D'ivoire	36974	AFNET-ASCI	false
104.238.62.56	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	false
125.123.119.138	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
93.171.194.111	unknown	Czech Republic	61308	PVONET-ASRU	false
206.201.134.194	unknown	United States	17158	DATTO-BOSUS	false
181.106.193.94	unknown	Argentina	7303	TelecomArgentinaSAAR	false
70.86.14.48	unknown	United States	36351	SOFTLAYERUS	false
105.213.73.143	unknown	South Africa	16637	MTNNS-ASZA	false

Runtime Messages

Command:	/tmp/uRQVqbl0sQ
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	luciferisback ~un~stable~
Standard Error:

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
165.112.93.230	hoho.arm	Get hash	malicious	Browse
185.244.103.18	KXM253rCpW	Get hash	malicious	Browse
195.52.156.254	wZ6O9wSQ4e	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
JCNJupiterTelecommunicationsCoLtdJP	p9rySh9WA4	Get hash	malicious	Browse	122.255.155.156
	8VANaS473t	Get hash	malicious	Browse	118.86.253.0
	anWxzNav9N	Get hash	malicious	Browse	111.90.2.168
	Xs0PMn85CN	Get hash	malicious	Browse	111.90.2.141
	iSdOB1UKQv	Get hash	malicious	Browse	221.132.139.43
	MMpysQ37RU	Get hash	malicious	Browse	112.137.96.139
	b3astmode.x86	Get hash	malicious	Browse	202.72.65.51
	94VG.x86	Get hash	malicious	Browse	110.93.55.88
	H8aSSMrsHO	Get hash	malicious	Browse	202.72.77.40
	x86	Get hash	malicious	Browse	114.134.127.190
	aTgXpPzFPV	Get hash	malicious	Browse	114.142.142.160
	sora.arm	Get hash	malicious	Browse	122.255.155.129
	jew.arm7	Get hash	malicious	Browse	202.72.65.63
	index_2021-09-30-12_54	Get hash	malicious	Browse	111.90.2.180
	b2wx6oZNsC	Get hash	malicious	Browse	203.89.37.217
	l88za3KqVX	Get hash	malicious	Browse	118.83.139.163
	sora.x86	Get hash	malicious	Browse	118.87.216.235
	k3dBuYbiCS	Get hash	malicious	Browse	118.87.246.111
	7b388AC1Fw	Get hash	malicious	Browse	111.90.108.145
	jew.arm7	Get hash	malicious	Browse	116.70.152.2
FranceTelecom-OrangeFR	QXFOZ3Cshc	Get hash	malicious	Browse	90.11.32.62
	sora.arm	Get hash	malicious	Browse	90.33.89.227
	lDawzTbABc	Get hash	malicious	Browse	90.18.247.113
	DVHEnaPp2d	Get hash	malicious	Browse	81.251.145.37
	HwcNrhNfZg	Get hash	malicious	Browse	83.195.96.126
	0LuSWzDmJG	Get hash	malicious	Browse	81.55.21.90
	cdglTQfNsE	Get hash	malicious	Browse	90.41.229.243
	arm7	Get hash	malicious	Browse	141.194.211.199
	x86	Get hash	malicious	Browse	62.161.114.230
	KKveTTgaAAsecNNaaaa.arm	Get hash	malicious	Browse	193.252.45.45
	arm6	Get hash	malicious	Browse	86.201.52.84
	qgxgn5fQU1	Get hash	malicious	Browse	81.51.92.80
	BS0Dxmu2go	Get hash	malicious	Browse	90.123.158.171
	LAQh74RNEl	Get hash	malicious	Browse	86.214.221.128
	Kz2SeJpaxw	Get hash	malicious	Browse	86.210.41.166
	O4aHLhCviL	Get hash	malicious	Browse	195.6.118.226
	RrK5IgZ6gZ	Get hash	malicious	Browse	90.1.88.136
	BKyU0T5xcw	Get hash	malicious	Browse	86.252.106.139
	skonwRkAlJ	Get hash	malicious	Browse	109.212.215.140
	jyTZMJKPD2	Get hash	malicious	Browse	81.255.86.112

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.6966877269303895
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	uRQVqbl0sQ
File size:	74740
MD5:	b3912b6cc3cc37dedb72c478cb3b8a11
SHA1:	dcf11bf6eb7dc7cb78cc4b1155539a61946682be
SHA256:	0d6118773c685f8e28933621ea9069678136d09a361babf004229ea414aa89ab
SHA512:	85eae79e85dea4c78201fc872e98cb09b2c3f2be16de08ccf39387304dfeeb4135bbeb02dce1c8f54a54448c753d2c4b59c373cf18e1a01f598e44137a27e525
SSDEEP:	1536:XasfEz/gLltKgh5KcJfX6Ll0TAs3Y5m2CVaoYCBd2:XVIYL+yKcJil00+2MVaoY7
File Content Preview:	.ELF.....................@.4...d"......4. ...(...............@...@...................... ... B.. B.$...............Q.td............................././"O.n........#.@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	74340
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x105c0	0x0	0x6	AX	32
.fini	PROGBITS	0x4106a0	0x106a0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x4106c4	0x106c4	0x12cc	0x0	0x2	A	4
.ctors	PROGBITS	0x422000	0x12000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x422008	0x12008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x422014	0x12014	0x210	0x0	0x3	WA	4
.bss	NOBITS	0x422224	0x12224	0x4d8	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x12224	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x11990	0x11990	4.7253	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x12000	0x422000	0x422000	0x224	0x6fc	1.7004	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 10, 2021 19:02:35.841573000 CET	42516	80	192.168.2.23	109.202.202.202
Nov 10, 2021 19:02:36.268923998 CET	40320	9375	192.168.2.23	163.172.183.97
Nov 10, 2021 19:02:36.275229931 CET	2681	23	192.168.2.23	41.175.114.187
Nov 10, 2021 19:02:36.275242090 CET	2681	23	192.168.2.23	92.121.55.1
Nov 10, 2021 19:02:36.275361061 CET	2681	23	192.168.2.23	45.240.225.198
Nov 10, 2021 19:02:36.275372028 CET	2681	23	192.168.2.23	243.32.96.9
Nov 10, 2021 19:02:36.275382042 CET	2681	23	192.168.2.23	181.49.232.32
Nov 10, 2021 19:02:36.275383949 CET	2681	23	192.168.2.23	191.64.176.161
Nov 10, 2021 19:02:36.275388956 CET	2681	23	192.168.2.23	118.20.171.2
Nov 10, 2021 19:02:36.275412083 CET	2681	23	192.168.2.23	71.105.232.154
Nov 10, 2021 19:02:36.275413990 CET	2681	23	192.168.2.23	66.28.35.220
Nov 10, 2021 19:02:36.275443077 CET	2681	23	192.168.2.23	125.50.154.90
Nov 10, 2021 19:02:36.275451899 CET	2681	23	192.168.2.23	44.176.173.44
Nov 10, 2021 19:02:36.275485039 CET	2681	23	192.168.2.23	122.232.166.192
Nov 10, 2021 19:02:36.275489092 CET	2681	23	192.168.2.23	194.252.133.93
Nov 10, 2021 19:02:36.275492907 CET	2681	23	192.168.2.23	73.114.203.42
Nov 10, 2021 19:02:36.275500059 CET	2681	23	192.168.2.23	82.105.141.65
Nov 10, 2021 19:02:36.275502920 CET	2681	23	192.168.2.23	151.104.16.3
Nov 10, 2021 19:02:36.275573969 CET	2681	23	192.168.2.23	154.122.144.32
Nov 10, 2021 19:02:36.275595903 CET	2681	23	192.168.2.23	20.18.193.92
Nov 10, 2021 19:02:36.275630951 CET	2681	23	192.168.2.23	133.87.253.10
Nov 10, 2021 19:02:36.275640011 CET	2681	23	192.168.2.23	47.90.53.222
Nov 10, 2021 19:02:36.275640965 CET	2681	23	192.168.2.23	32.159.29.128
Nov 10, 2021 19:02:36.275649071 CET	2681	23	192.168.2.23	126.192.190.83
Nov 10, 2021 19:02:36.275652885 CET	2681	23	192.168.2.23	173.128.115.46
Nov 10, 2021 19:02:36.275656939 CET	2681	23	192.168.2.23	167.127.24.63
Nov 10, 2021 19:02:36.275661945 CET	2681	23	192.168.2.23	195.80.84.105
Nov 10, 2021 19:02:36.275665998 CET	2681	23	192.168.2.23	124.89.236.214
Nov 10, 2021 19:02:36.275671005 CET	2681	23	192.168.2.23	48.107.96.33
Nov 10, 2021 19:02:36.275671959 CET	2681	23	192.168.2.23	183.132.23.88
Nov 10, 2021 19:02:36.275679111 CET	2681	23	192.168.2.23	60.165.240.124
Nov 10, 2021 19:02:36.275697947 CET	2681	23	192.168.2.23	207.187.146.250
Nov 10, 2021 19:02:36.275796890 CET	2681	23	192.168.2.23	162.209.241.185
Nov 10, 2021 19:02:36.275804043 CET	2681	23	192.168.2.23	126.164.205.54
Nov 10, 2021 19:02:36.275823116 CET	2681	23	192.168.2.23	177.111.58.238
Nov 10, 2021 19:02:36.275834084 CET	2681	23	192.168.2.23	194.90.177.206
Nov 10, 2021 19:02:36.275840044 CET	2681	23	192.168.2.23	14.227.101.196
Nov 10, 2021 19:02:36.275859118 CET	2681	23	192.168.2.23	40.226.21.253
Nov 10, 2021 19:02:36.275871992 CET	2681	23	192.168.2.23	73.186.118.21
Nov 10, 2021 19:02:36.275876045 CET	2681	23	192.168.2.23	181.156.178.46
Nov 10, 2021 19:02:36.275883913 CET	2681	23	192.168.2.23	141.84.154.44
Nov 10, 2021 19:02:36.276002884 CET	2681	23	192.168.2.23	150.233.49.113
Nov 10, 2021 19:02:36.276017904 CET	2681	23	192.168.2.23	252.53.171.234
Nov 10, 2021 19:02:36.276036978 CET	2681	23	192.168.2.23	172.212.185.89
Nov 10, 2021 19:02:36.276041031 CET	2681	23	192.168.2.23	98.22.228.111
Nov 10, 2021 19:02:36.276051044 CET	2681	23	192.168.2.23	191.179.103.79
Nov 10, 2021 19:02:36.276057005 CET	2681	23	192.168.2.23	17.248.190.66
Nov 10, 2021 19:02:36.276118040 CET	2681	23	192.168.2.23	164.250.116.194
Nov 10, 2021 19:02:36.276139021 CET	2681	23	192.168.2.23	17.66.197.210
Nov 10, 2021 19:02:36.276177883 CET	2681	23	192.168.2.23	199.21.28.148
Nov 10, 2021 19:02:36.276210070 CET	2681	23	192.168.2.23	204.166.28.204
Nov 10, 2021 19:02:36.276216984 CET	2681	23	192.168.2.23	71.197.244.5
Nov 10, 2021 19:02:36.276283026 CET	2681	23	192.168.2.23	150.97.139.213
Nov 10, 2021 19:02:36.276289940 CET	2681	23	192.168.2.23	252.77.242.145
Nov 10, 2021 19:02:36.276312113 CET	2681	23	192.168.2.23	27.4.51.69
Nov 10, 2021 19:02:36.276319027 CET	2681	23	192.168.2.23	48.101.173.8
Nov 10, 2021 19:02:36.276324987 CET	2681	23	192.168.2.23	124.129.62.169
Nov 10, 2021 19:02:36.276335955 CET	2681	23	192.168.2.23	159.130.98.227
Nov 10, 2021 19:02:36.276336908 CET	2681	23	192.168.2.23	197.196.131.149
Nov 10, 2021 19:02:36.276345015 CET	2681	23	192.168.2.23	41.83.248.201
Nov 10, 2021 19:02:36.276345015 CET	2681	23	192.168.2.23	88.58.46.107
Nov 10, 2021 19:02:36.276374102 CET	2681	23	192.168.2.23	74.103.48.116
Nov 10, 2021 19:02:36.276410103 CET	2681	23	192.168.2.23	59.34.94.17
Nov 10, 2021 19:02:36.276416063 CET	2681	23	192.168.2.23	189.136.174.35
Nov 10, 2021 19:02:36.276479959 CET	2681	23	192.168.2.23	198.143.36.4
Nov 10, 2021 19:02:36.276546955 CET	2681	23	192.168.2.23	244.64.227.230
Nov 10, 2021 19:02:36.276552916 CET	2681	23	192.168.2.23	172.87.207.137
Nov 10, 2021 19:02:36.276556015 CET	2681	23	192.168.2.23	145.61.170.80
Nov 10, 2021 19:02:36.276561022 CET	2681	23	192.168.2.23	111.176.56.167
Nov 10, 2021 19:02:36.276561022 CET	2681	23	192.168.2.23	117.140.183.20
Nov 10, 2021 19:02:36.276562929 CET	2681	23	192.168.2.23	201.248.170.169
Nov 10, 2021 19:02:36.276644945 CET	2681	23	192.168.2.23	106.96.240.121
Nov 10, 2021 19:02:36.276647091 CET	2681	23	192.168.2.23	218.136.98.160
Nov 10, 2021 19:02:36.276654005 CET	2681	23	192.168.2.23	121.250.68.179
Nov 10, 2021 19:02:36.276706934 CET	2681	23	192.168.2.23	74.3.100.161
Nov 10, 2021 19:02:36.276706934 CET	2681	23	192.168.2.23	87.79.104.189
Nov 10, 2021 19:02:36.276706934 CET	2681	23	192.168.2.23	58.46.234.223
Nov 10, 2021 19:02:36.276710987 CET	2681	23	192.168.2.23	201.176.59.237
Nov 10, 2021 19:02:36.276716948 CET	2681	23	192.168.2.23	212.31.31.203
Nov 10, 2021 19:02:36.276778936 CET	2681	23	192.168.2.23	70.52.98.145
Nov 10, 2021 19:02:36.276779890 CET	2681	23	192.168.2.23	114.89.86.81
Nov 10, 2021 19:02:36.276789904 CET	2681	23	192.168.2.23	93.74.139.70
Nov 10, 2021 19:02:36.276803017 CET	2681	23	192.168.2.23	178.129.80.184
Nov 10, 2021 19:02:36.276813984 CET	2681	23	192.168.2.23	250.207.253.238
Nov 10, 2021 19:02:36.276817083 CET	2681	23	192.168.2.23	241.207.29.162
Nov 10, 2021 19:02:36.276818991 CET	2681	23	192.168.2.23	66.124.127.129
Nov 10, 2021 19:02:36.276818991 CET	2681	23	192.168.2.23	32.111.111.154
Nov 10, 2021 19:02:36.276823044 CET	2681	23	192.168.2.23	93.155.236.182
Nov 10, 2021 19:02:36.276840925 CET	2681	23	192.168.2.23	187.165.204.163
Nov 10, 2021 19:02:36.276842117 CET	2681	23	192.168.2.23	116.179.204.67
Nov 10, 2021 19:02:36.276843071 CET	2681	23	192.168.2.23	68.41.121.172
Nov 10, 2021 19:02:36.276887894 CET	2681	23	192.168.2.23	20.137.234.9
Nov 10, 2021 19:02:36.276906967 CET	2681	23	192.168.2.23	168.63.58.165
Nov 10, 2021 19:02:36.276911020 CET	2681	23	192.168.2.23	36.73.212.53
Nov 10, 2021 19:02:36.276913881 CET	2681	23	192.168.2.23	184.77.76.113
Nov 10, 2021 19:02:36.276931047 CET	2681	23	192.168.2.23	69.26.189.39
Nov 10, 2021 19:02:36.276998997 CET	2681	23	192.168.2.23	120.70.20.139
Nov 10, 2021 19:02:36.285013914 CET	2681	23	192.168.2.23	212.55.222.206
Nov 10, 2021 19:02:36.285053968 CET	2681	23	192.168.2.23	210.211.63.72
Nov 10, 2021 19:02:36.285058975 CET	2681	23	192.168.2.23	223.229.147.111

System Behavior

Analysis Process: uRQVqbl0sQ PID: 5248 Parent PID: 5110

General

Start time:	19:02:35
Start date:	10/11/2021
Path:	/tmp/uRQVqbl0sQ
Arguments:	/tmp/uRQVqbl0sQ
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: uRQVqbl0sQ PID: 5250 Parent PID: 5248

General

Start time:	19:02:35
Start date:	10/11/2021
Path:	/tmp/uRQVqbl0sQ
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: uRQVqbl0sQ PID: 5251 Parent PID: 5248

General

Start time:	19:02:35
Start date:	10/11/2021
Path:	/tmp/uRQVqbl0sQ
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: uRQVqbl0sQ PID: 5252 Parent PID: 5248

General

Start time:	19:02:35
Start date:	10/11/2021
Path:	/tmp/uRQVqbl0sQ
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: uRQVqbl0sQ PID: 5256 Parent PID: 5252

General

Start time:	19:02:35
Start date:	10/11/2021
Path:	/tmp/uRQVqbl0sQ
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: uRQVqbl0sQ PID: 5257 Parent PID: 5252

General

Start time:	19:02:35
Start date:	10/11/2021
Path:	/tmp/uRQVqbl0sQ
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Analysis Process: uRQVqbl0sQ PID: 5258 Parent PID: 5252

General

Start time:	19:02:35
Start date:	10/11/2021
Path:	/tmp/uRQVqbl0sQ
Arguments:	n/a
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Linux Analysis Report uRQVqbl0sQ

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Process Tree

Yara Overview

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Jbx Signature Overview

AV Detection:

Networking:

System Summary:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

Runtime Messages

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: uRQVqbl0sQ PID: 5248 Parent PID: 5110

General

Analysis Process: uRQVqbl0sQ PID: 5250 Parent PID: 5248

General

Analysis Process: uRQVqbl0sQ PID: 5251 Parent PID: 5248

General

Analysis Process: uRQVqbl0sQ PID: 5252 Parent PID: 5248

General

Analysis Process: uRQVqbl0sQ PID: 5256 Parent PID: 5252

General

Analysis Process: uRQVqbl0sQ PID: 5257 Parent PID: 5252

General

Analysis Process: uRQVqbl0sQ PID: 5258 Parent PID: 5252

General