Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Linux Analysis Report yH3AxCHT3I

Overview

General Information

Sample Name:yH3AxCHT3I
Analysis ID:544729
MD5:9065d02c3a51d27d6a930d838fa9d700
SHA1:cdd354cd859054955116cc0476884ed3b77b4c93
SHA256:0054cf56d6a4ef6e38ccaaf189be5f9a2e94781c8234ed52bec896fbc525d511
Tags:32armelfmirai
Infos:

Detection

Mirai
Score:84
Range:0 - 100
Whitelisted:false

Signatures

Malicious sample detected (through community Yara rule)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected Mirai
Multi AV Scanner detection for submitted file
Sample is packed with UPX
Sample contains only a LOAD segment without any section mappings
Yara signature match
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures
All HTTP servers contacted by the sample do not answer. Likely the sample is an old dropper which does no longer work
Static ELF header machine description suggests that the sample might not execute correctly on this machine

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:544729
Start date:24.12.2021
Start time:01:47:05
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 5m 32s
Hypervisor based Inspection enabled:false
Report type:light
Sample file name:yH3AxCHT3I
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Detection:MAL
Classification:mal84.troj.evad.lin@0/2@0/0
Warnings:
Show All
  • Report size exceeded maximum capacity and may have missing network information.
  • TCP Packets have been reduced to 100

Process Tree

  • system is lnxubuntu20
  • yH3AxCHT3I (PID: 5224, Parent: 5115, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/yH3AxCHT3I
  • systemd New Fork (PID: 5261, Parent: 1)
  • sshd (PID: 5261, Parent: 1, MD5: dbca7a6bbf7bf57fedac243d4b2cb340) Arguments: /usr/sbin/sshd -t
  • systemd New Fork (PID: 5262, Parent: 1)
  • sshd (PID: 5262, Parent: 1, MD5: dbca7a6bbf7bf57fedac243d4b2cb340) Arguments: /usr/sbin/sshd -D
  • cleanup

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
5224.1.0000000007c53d73.000000006a7c51ae.rw-.sdmpSUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
  • 0x1414:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1488:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x14fc:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1570:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x15e4:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1864:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x18bc:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1914:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x196c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x19c4:$xo1: oMXKNNC\x0D\x17\x0C\x12
5233.1.00000000f26ed677.000000008ccd47ee.r-x.sdmpSUSP_XORed_MozillaDetects suspicious XORed keyword - Mozilla/5.0Florian Roth
  • 0x103cc:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1043c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x104ac:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1051c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1058c:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x107fc:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x10850:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x108a4:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x108f8:$xo1: oMXKNNC\x0D\x17\x0C\x12
  • 0x1094c:$xo1: oMXKNNC\x0D\x17\x0C\x12
5233.1.00000000f26ed677.000000008ccd47ee.r-x.sdmpMirai_Botnet_MalwareDetects Mirai Botnet MalwareFlorian Roth
  • 0xfd84:$x1: POST /cdn-cgi/
  • 0x1024c:$s1: LCOGQGPTGP
5233.1.00000000f26ed677.000000008ccd47ee.r-x.sdmpMAL_ELF_LNX_Mirai_Oct10_2Detects ELF malware Mirai relatedFlorian Roth
  • 0xfd84:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5233.1.00000000f26ed677.000000008ccd47ee.r-x.sdmpJoeSecurity_Mirai_5Yara detected MiraiJoe Security
    Click to see the 19 entries

    Jbx Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Multi AV Scanner detection for submitted fileShow sources
    Source: yH3AxCHT3IVirustotal: Detection: 28%Perma Link
    Source: yH3AxCHT3IReversingLabs: Detection: 37%

    Networking:

    barindex
    Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
    Source: TrafficSnort IDS: 716 INFO TELNET access 66.165.160.102:23 -> 192.168.2.23:50482
    Source: TrafficSnort IDS: 716 INFO TELNET access 66.165.160.102:23 -> 192.168.2.23:50492
    Source: TrafficSnort IDS: 716 INFO TELNET access 66.165.160.102:23 -> 192.168.2.23:50508
    Source: TrafficSnort IDS: 716 INFO TELNET access 66.165.160.102:23 -> 192.168.2.23:50510
    Source: TrafficSnort IDS: 716 INFO TELNET access 66.165.160.102:23 -> 192.168.2.23:50512
    Source: TrafficSnort IDS: 716 INFO TELNET access 66.165.160.102:23 -> 192.168.2.23:50514
    Source: TrafficSnort IDS: 716 INFO TELNET access 66.165.160.102:23 -> 192.168.2.23:50516
    Source: TrafficSnort IDS: 716 INFO TELNET access 70.185.13.104:23 -> 192.168.2.23:38294
    Source: TrafficSnort IDS: 716 INFO TELNET access 45.225.194.59:23 -> 192.168.2.23:54128
    Source: TrafficSnort IDS: 716 INFO TELNET access 70.185.13.104:23 -> 192.168.2.23:38298
    Source: TrafficSnort IDS: 716 INFO TELNET access 70.185.13.104:23 -> 192.168.2.23:38322
    Source: TrafficSnort IDS: 716 INFO TELNET access 70.185.13.104:23 -> 192.168.2.23:38324
    Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
    Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
    Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
    Source: global trafficTCP traffic: 192.168.2.23:41864 -> 205.185.117.54:9506
    Source: /tmp/yH3AxCHT3I (PID: 5227)Socket: 0.0.0.0::23
    Source: /tmp/yH3AxCHT3I (PID: 5227)Socket: 0.0.0.0::0
    Source: /tmp/yH3AxCHT3I (PID: 5227)Socket: 0.0.0.0::80
    Source: /tmp/yH3AxCHT3I (PID: 5227)Socket: 0.0.0.0::81
    Source: /tmp/yH3AxCHT3I (PID: 5227)Socket: 0.0.0.0::8443
    Source: /tmp/yH3AxCHT3I (PID: 5227)Socket: 0.0.0.0::9009
    Source: /tmp/yH3AxCHT3I (PID: 5233)Socket: 0.0.0.0::0
    Source: /tmp/yH3AxCHT3I (PID: 5233)Socket: 0.0.0.0::22
    Source: /tmp/yH3AxCHT3I (PID: 5233)Socket: 0.0.0.0::80
    Source: /tmp/yH3AxCHT3I (PID: 5233)Socket: 0.0.0.0::81
    Source: /tmp/yH3AxCHT3I (PID: 5233)Socket: 0.0.0.0::8443
    Source: /tmp/yH3AxCHT3I (PID: 5233)Socket: 0.0.0.0::9009
    Source: /usr/sbin/sshd (PID: 5262)Socket: [::]::22
    Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443
    Source: unknownTCP traffic detected without corresponding DNS query: 205.185.117.54
    Source: unknownTCP traffic detected without corresponding DNS query: 37.197.57.223
    Source: unknownTCP traffic detected without corresponding DNS query: 165.17.108.36
    Source: unknownTCP traffic detected without corresponding DNS query: 146.67.240.76
    Source: unknownTCP traffic detected without corresponding DNS query: 122.95.11.36
    Source: unknownTCP traffic detected without corresponding DNS query: 203.241.48.6
    Source: unknownTCP traffic detected without corresponding DNS query: 186.46.113.223
    Source: unknownTCP traffic detected without corresponding DNS query: 139.146.108.104
    Source: unknownTCP traffic detected without corresponding DNS query: 213.117.204.125
    Source: unknownTCP traffic detected without corresponding DNS query: 92.235.184.66
    Source: unknownTCP traffic detected without corresponding DNS query: 147.220.89.165
    Source: unknownTCP traffic detected without corresponding DNS query: 209.68.4.108
    Source: unknownTCP traffic detected without corresponding DNS query: 105.171.216.251
    Source: unknownTCP traffic detected without corresponding DNS query: 109.82.7.187
    Source: unknownTCP traffic detected without corresponding DNS query: 243.68.151.96
    Source: unknownTCP traffic detected without corresponding DNS query: 82.78.9.239
    Source: unknownTCP traffic detected without corresponding DNS query: 130.189.8.110
    Source: unknownTCP traffic detected without corresponding DNS query: 217.66.233.112
    Source: unknownTCP traffic detected without corresponding DNS query: 196.189.195.211
    Source: unknownTCP traffic detected without corresponding DNS query: 176.247.247.146
    Source: unknownTCP traffic detected without corresponding DNS query: 170.241.248.158
    Source: unknownTCP traffic detected without corresponding DNS query: 122.169.217.90
    Source: unknownTCP traffic detected without corresponding DNS query: 102.232.26.181
    Source: unknownTCP traffic detected without corresponding DNS query: 4.136.252.225
    Source: unknownTCP traffic detected without corresponding DNS query: 255.155.254.87
    Source: unknownTCP traffic detected without corresponding DNS query: 122.200.62.168
    Source: unknownTCP traffic detected without corresponding DNS query: 186.39.186.6
    Source: unknownTCP traffic detected without corresponding DNS query: 9.152.71.217
    Source: unknownTCP traffic detected without corresponding DNS query: 182.57.187.147
    Source: unknownTCP traffic detected without corresponding DNS query: 211.157.177.175
    Source: unknownTCP traffic detected without corresponding DNS query: 145.194.88.235
    Source: unknownTCP traffic detected without corresponding DNS query: 242.107.16.195
    Source: unknownTCP traffic detected without corresponding DNS query: 118.119.254.194
    Source: unknownTCP traffic detected without corresponding DNS query: 212.20.146.7
    Source: unknownTCP traffic detected without corresponding DNS query: 98.52.19.251
    Source: unknownTCP traffic detected without corresponding DNS query: 74.201.21.110
    Source: unknownTCP traffic detected without corresponding DNS query: 251.2.30.159
    Source: unknownTCP traffic detected without corresponding DNS query: 104.178.87.45
    Source: unknownTCP traffic detected without corresponding DNS query: 103.106.31.112
    Source: unknownTCP traffic detected without corresponding DNS query: 14.165.174.33
    Source: unknownTCP traffic detected without corresponding DNS query: 166.173.235.36
    Source: unknownTCP traffic detected without corresponding DNS query: 207.99.53.171
    Source: unknownTCP traffic detected without corresponding DNS query: 190.249.136.26
    Source: unknownTCP traffic detected without corresponding DNS query: 4.153.48.106
    Source: unknownTCP traffic detected without corresponding DNS query: 86.218.200.23
    Source: unknownTCP traffic detected without corresponding DNS query: 35.33.254.199
    Source: unknownTCP traffic detected without corresponding DNS query: 156.198.90.232
    Source: unknownTCP traffic detected without corresponding DNS query: 117.5.249.162
    Source: unknownTCP traffic detected without corresponding DNS query: 253.151.113.223
    Source: unknownTCP traffic detected without corresponding DNS query: 179.62.107.173
    Source: yH3AxCHT3IString found in binary or memory: http://upx.sf.net

    System Summary:

    barindex
    Malicious sample detected (through community Yara rule)Show sources
    Source: 5233.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
    Source: 5233.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
    Source: 5224.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
    Source: 5224.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
    Source: 5228.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
    Source: 5228.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
    Source: 5234.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
    Source: 5234.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: Detects ELF malware Mirai related Author: Florian Roth
    Source: LOAD without section mappingsProgram segment: 0x8000
    Source: 5224.1.0000000007c53d73.000000006a7c51ae.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5233.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5233.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
    Source: 5233.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
    Source: 5224.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5224.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
    Source: 5224.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
    Source: 5228.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5228.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
    Source: 5228.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
    Source: 5234.1.0000000007c53d73.000000006a7c51ae.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5228.1.0000000007c53d73.000000006a7c51ae.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5233.1.0000000007c53d73.000000006a7c51ae.rw-.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5234.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
    Source: 5234.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
    Source: 5234.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORYMatched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
    Source: /tmp/yH3AxCHT3I (PID: 5227)SIGKILL sent: pid: 5233, result: successful
    Source: /tmp/yH3AxCHT3I (PID: 5227)SIGKILL sent: pid: 759, result: successful
    Source: /tmp/yH3AxCHT3I (PID: 5233)SIGKILL sent: pid: 936, result: successful
    Source: classification engineClassification label: mal84.troj.evad.lin@0/2@0/0

    Data Obfuscation:

    barindex
    Sample is packed with UPXShow sources
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/491/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/793/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/772/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/796/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/774/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/797/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/777/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/799/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/658/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/912/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/759/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/936/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/918/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/1/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/761/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/785/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/884/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/720/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/721/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/788/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/789/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/800/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/801/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/847/fd
    Source: /tmp/yH3AxCHT3I (PID: 5233)File opened: /proc/904/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/5262/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/5262/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/5141/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2033/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2033/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2033/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1582/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1582/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1582/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2275/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2275/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2275/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/3088/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/5260/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1612/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1612/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1612/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1579/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1579/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1579/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1699/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1699/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1699/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1335/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1335/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1335/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1698/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1698/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1698/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2028/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2028/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2028/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1334/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1334/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1334/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1576/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1576/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1576/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2302/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2302/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2302/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/3236/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/3236/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/3236/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2025/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2025/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2025/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2146/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2146/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2146/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/5258/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/910/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/5259/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/912/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/912/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/912/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/759/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/759/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/759/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/517/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2307/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2307/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2307/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/918/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/918/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/918/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/5152/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/5036/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/5036/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/5036/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1594/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1594/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/1594/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2285/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2285/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2285/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2281/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2281/fd
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/2281/exe
    Source: /tmp/yH3AxCHT3I (PID: 5227)File opened: /proc/5150/exe
    Source: /tmp/yH3AxCHT3I (PID: 5224)Queries kernel information via 'uname':
    Source: yH3AxCHT3I, 5224.1.000000007dcb2981.0000000062e7062f.rw-.sdmp, yH3AxCHT3I, 5228.1.000000007dcb2981.0000000062e7062f.rw-.sdmp, yH3AxCHT3I, 5233.1.000000007dcb2981.0000000062e7062f.rw-.sdmp, yH3AxCHT3I, 5234.1.000000007dcb2981.0000000062e7062f.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/yH3AxCHT3ISUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yH3AxCHT3I
    Source: yH3AxCHT3I, 5224.1.0000000014637705.0000000081fedbd8.rw-.sdmp, yH3AxCHT3I, 5228.1.0000000014637705.0000000081fedbd8.rw-.sdmp, yH3AxCHT3I, 5233.1.0000000014637705.0000000081fedbd8.rw-.sdmp, yH3AxCHT3I, 5234.1.0000000014637705.0000000081fedbd8.rw-.sdmpBinary or memory string: W#V!/etc/qemu-binfmt/arm
    Source: yH3AxCHT3I, 5224.1.0000000014637705.0000000081fedbd8.rw-.sdmp, yH3AxCHT3I, 5228.1.0000000014637705.0000000081fedbd8.rw-.sdmp, yH3AxCHT3I, 5233.1.0000000014637705.0000000081fedbd8.rw-.sdmp, yH3AxCHT3I, 5234.1.0000000014637705.0000000081fedbd8.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
    Source: yH3AxCHT3I, 5224.1.000000007dcb2981.0000000062e7062f.rw-.sdmp, yH3AxCHT3I, 5228.1.000000007dcb2981.0000000062e7062f.rw-.sdmp, yH3AxCHT3I, 5233.1.000000007dcb2981.0000000062e7062f.rw-.sdmp, yH3AxCHT3I, 5234.1.000000007dcb2981.0000000062e7062f.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

    Stealing of Sensitive Information:

    barindex
    Yara detected MiraiShow sources
    Source: Yara matchFile source: 5233.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5224.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5228.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5234.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORY

    Remote Access Functionality:

    barindex
    Yara detected MiraiShow sources
    Source: Yara matchFile source: 5233.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5224.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5228.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORY
    Source: Yara matchFile source: 5234.1.00000000f26ed677.000000008ccd47ee.r-x.sdmp, type: MEMORY

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionObfuscated Files or Information1OS Credential Dumping1Security Software Discovery11Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

    Malware Configuration

    No configs have been found

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 544729 Sample: yH3AxCHT3I Startdate: 24/12/2021 Architecture: LINUX Score: 84 26 105.168.77.108, 23 unitel-ASAO Angola 2->26 28 156.94.210.118 WAL-MARTUS United States 2->28 30 98 other IPs or domains 2->30 32 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->32 34 Malicious sample detected (through community Yara rule) 2->34 36 Multi AV Scanner detection for submitted file 2->36 38 2 other signatures 2->38 8 yH3AxCHT3I 2->8         started        10 systemd sshd 2->10         started        12 systemd sshd 2->12         started        signatures3 process4 process5 14 yH3AxCHT3I 8->14         started        16 yH3AxCHT3I 8->16         started        18 yH3AxCHT3I 8->18         started        process6 20 yH3AxCHT3I 14->20         started        22 yH3AxCHT3I 14->22         started        24 yH3AxCHT3I 14->24         started       

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    yH3AxCHT3I28%VirustotalBrowse
    yH3AxCHT3I37%ReversingLabsLinux.Trojan.Mirai

    Dropped Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    No Antivirus matches

    Domains and IPs

    Contacted Domains

    No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://upx.sf.netyH3AxCHT3Ifalse
      		high

      Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public

      IPDomainCountryFlagASNASN NameMalicious
      81.141.55.38
      		unknownUnited Kingdom
      		6871PLUSNETUKInternetServiceProviderGBfalse
      163.53.56.189
      		unknownChina
      		56005FASTIDCZhengzhouFastidcTechnologyCoLtdCNfalse
      184.27.0.99
      		unknownUnited States
      		16625AKAMAI-ASUSfalse
      41.140.93.155
      		unknownMorocco
      		36903MT-MPLSMAfalse
      60.3.49.65
      		unknownChina
      		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      41.211.25.148
      		unknownGhana
      		35091TELEDATA-ASTeledataGhanaILfalse
      37.14.40.204
      		unknownSpain
      		12479UNI2-ASESfalse
      248.18.198.212
      		unknownReserved
      		unknownunknownfalse
      77.70.221.252
      		unknownNorway
      		5377MARLINK-EMEANOfalse
      109.59.137.164
      		unknownSweden
      		44034HI3GSEfalse
      125.142.230.126
      		unknownKorea Republic of
      		4766KIXS-AS-KRKoreaTelecomKRfalse
      13.145.202.198
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      170.192.212.123
      		unknownUnited States
      		11685HNBCOL-ASUSfalse
      166.29.182.20
      		unknownUnited States
      		206CSC-IGN-AMERUSfalse
      66.224.112.73
      		unknownUnited States
      		7385ALLSTREAMUSfalse
      9.40.103.0
      		unknownUnited States
      		3356LEVEL3USfalse
      106.72.195.169
      		unknownJapan2516KDDIKDDICORPORATIONJPfalse
      44.40.175.57
      		unknownUnited States
      		20473AS-CHOOPAUSfalse
      123.87.18.133
      		unknownChina
      		9394CTTNETChinaTieTongTelecommunicationsCorporationCNfalse
      40.197.171.2
      		unknownUnited States
      		4249LILLY-ASUSfalse
      114.5.205.188
      		unknownIndonesia
      		4761INDOSAT-INP-APINDOSATInternetNetworkProviderIDfalse
      211.163.111.102
      		unknownChina
      		4847CNIX-APChinaNetworksInter-ExchangeCNfalse
      45.75.160.232
      		unknownUnited Kingdom
      		49425DIGITAL-REALTY-UKGBfalse
      200.199.40.172
      		unknownBrazil
      		7738TelemarNorteLesteSABRfalse
      58.237.168.215
      		unknownKorea Republic of
      		9318SKB-ASSKBroadbandCoLtdKRfalse
      123.108.189.204
      		unknownKorea Republic of
      		10175HCNKUMHO-AS-KRKumhoCableKRfalse
      155.250.111.153
      		unknownGermany
      		13167MERCK-KGAADarmstadtGermanyDEfalse
      34.109.90.207
      		unknownUnited States
      		15169GOOGLEUSfalse
      178.81.128.60
      		unknownSaudi Arabia
      		35819MOBILY-ASEtihadEtisalatCompanyMobilySAfalse
      209.122.96.77
      		unknownUnited States
      		6079RCN-ASUSfalse
      5.24.137.60
      		unknownTurkey
      		16135TURKCELL-ASTurkcellASTRfalse
      63.148.160.65
      		unknownUnited States
      		209CENTURYLINK-US-LEGACY-QWESTUSfalse
      249.223.115.142
      		unknownReserved
      		unknownunknownfalse
      68.201.64.64
      		unknownUnited States
      		11427TWC-11427-TEXASUSfalse
      58.199.186.139
      		unknownChina
      		4538ERX-CERNET-BKBChinaEducationandResearchNetworkCenterfalse
      200.152.150.49
      		unknownBrazil
      		28590DirectnetPrestacaodeServicosLtdaBRfalse
      207.144.199.204
      		unknownUnited States
      		22646HARCOM1USfalse
      118.170.22.249
      		unknownTaiwan; Republic of China (ROC)
      		3462HINETDataCommunicationBusinessGroupTWfalse
      115.52.204.84
      		unknownChina
      		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
      79.141.10.235
      		unknownFrance
      		25540ALPHALINK-ASFRfalse
      114.60.198.77
      		unknownChina
      		9812CNNIC-CN-COLNETOrientalCableNetworkCoLtdCNfalse
      177.145.138.208
      		unknownBrazil
      		26599TELEFONICABRASILSABRfalse
      32.185.230.113
      		unknownUnited States
      		20057ATT-MOBILITY-LLC-AS20057USfalse
      113.55.196.3
      		unknownChina
      		4538ERX-CERNET-BKBChinaEducationandResearchNetworkCenterfalse
      18.140.158.93
      		unknownUnited States
      		16509AMAZON-02USfalse
      68.42.99.162
      		unknownUnited States
      		7922COMCAST-7922USfalse
      189.174.41.83
      		unknownMexico
      		8151UninetSAdeCVMXfalse
      9.11.181.108
      		unknownUnited States
      		3356LEVEL3USfalse
      220.221.242.63
      		unknownJapan4713OCNNTTCommunicationsCorporationJPfalse
      79.57.118.183
      		unknownItaly
      		3269ASN-IBSNAZITfalse
      72.52.137.100
      		unknownUnited States
      		32244LIQUIDWEBUSfalse
      100.248.229.26
      		unknownUnited States
      		21928T-MOBILE-AS21928USfalse
      31.102.195.59
      		unknownUnited Kingdom
      		12576EELtdGBfalse
      173.223.114.161
      		unknownUnited States
      		16625AKAMAI-ASUSfalse
      35.122.244.156
      		unknownUnited States
      		237MERIT-AS-14USfalse
      193.13.86.3
      		unknownSweden
      		1257TELE2EUfalse
      177.165.238.214
      		unknownBrazil
      		26615TIMSABRfalse
      101.162.4.142
      		unknownAustralia
      		1221ASN-TELSTRATelstraCorporationLtdAUfalse
      121.188.110.123
      		unknownKorea Republic of
      		4766KIXS-AS-KRKoreaTelecomKRfalse
      75.75.74.187
      		unknownUnited States
      		7922COMCAST-7922USfalse
      5.130.84.210
      		unknownRussian Federation
      		31200NTKIPv6customersRUfalse
      255.210.145.196
      		unknownReserved
      		unknownunknownfalse
      184.101.8.131
      		unknownUnited States
      		209CENTURYLINK-US-LEGACY-QWESTUSfalse
      37.79.117.209
      		unknownRussian Federation
      		12389ROSTELECOM-ASRUfalse
      68.109.108.216
      		unknownUnited States
      		22773ASN-CXA-ALL-CCI-22773-RDCUSfalse
      75.127.194.9
      		unknownUnited States
      		6128CABLE-NET-1USfalse
      99.34.80.250
      		unknownUnited States
      		7018ATT-INTERNET4USfalse
      200.122.108.186
      		unknownArgentina
      		10481TelecomArgentinaSAARfalse
      165.243.24.41
      		unknownKorea Republic of
      		4668LGNET-AS-KRLGCNSKRfalse
      105.168.77.108
      		unknownAngola
      		37119unitel-ASAOfalse
      171.248.31.10
      		unknownViet Nam
      		7552VIETEL-AS-APViettelGroupVNfalse
      94.239.156.8
      		unknownFrance
      		5410BOUYGTEL-ISPFRfalse
      92.186.173.40
      		unknownFrance
      		12479UNI2-ASESfalse
      242.94.217.63
      		unknownReserved
      		unknownunknownfalse
      83.7.185.173
      		unknownPoland
      		5617TPNETPLfalse
      20.161.36.36
      		unknownUnited States
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
      88.53.30.66
      		unknownItaly
      		3269ASN-IBSNAZITfalse
      105.154.88.139
      		unknownMorocco
      		36903MT-MPLSMAfalse
      189.76.171.77
      		unknownBrazil
      		28358INTERTELCOTELECOMUNICACOESMULTIMIDIALTDABRfalse
      100.128.95.133
      		unknownUnited States
      		21928T-MOBILE-AS21928USfalse
      218.239.129.52
      		unknownKorea Republic of
      		9318SKB-ASSKBroadbandCoLtdKRfalse
      83.211.190.35
      		unknownItaly
      		15589ASN-CLOUDITALIAITfalse
      38.237.254.194
      		unknownUnited States
      		174COGENT-174USfalse
      66.251.214.57
      		unknownUnited States
      		18624CITYOFWILSONNCUSfalse
      39.198.18.103
      		unknownIndonesia
      		23693TELKOMSEL-ASN-IDPTTelekomunikasiSelularIDfalse
      197.109.134.51
      		unknownSouth Africa
      		37168CELL-CZAfalse
      117.63.65.234
      		unknownChina
      		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
      82.1.18.205
      		unknownUnited Kingdom
      		5089NTLGBfalse
      173.79.81.100
      		unknownUnited States
      		701UUNETUSfalse
      201.180.141.26
      		unknownArgentina
      		22927TelefonicadeArgentinaARfalse
      156.94.210.118
      		unknownUnited States
      		10695WAL-MARTUSfalse
      94.82.238.146
      		unknownItaly
      		3269ASN-IBSNAZITfalse
      17.139.38.27
      		unknownUnited States
      		714APPLE-ENGINEERINGUSfalse
      141.237.226.38
      		unknownGreece
      		3329HOL-GRAthensGreeceGRfalse
      154.47.211.221
      		unknownUnited States
      		174COGENT-174USfalse
      159.245.168.149
      		unknownEuropean Union
      		29899GEISINGERUSfalse
      101.211.73.148
      		unknownIndia
      		58519CHINATELECOM-CTCLOUDCloudComputingCorporationCNfalse
      40.94.195.122
      		unknownUnited States
      		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
      113.157.0.65
      		unknownJapan2516KDDIKDDICORPORATIONJPfalse
      188.151.72.64
      		unknownNorway
      		39651COMHEM-SWEDENSEfalse


      Runtime Messages

      Command:/tmp/yH3AxCHT3I
      Exit Code:0
      Exit Code Info:
      Killed:False
      Standard Output:
      lzrd cock fest'/proc/'/exe
      Standard Error:

      Joe Sandbox View / Context

      IPs

      No context

      Domains

      No context

      ASN

      No context

      JA3 Fingerprints

      No context

      Dropped Files

      No context

      Created / dropped Files

      /proc/5262/oom_score_adj
      Process:/usr/sbin/sshd
      File Type:ASCII text
      Category:dropped
      Size (bytes):6
      Entropy (8bit):1.7924812503605778
      Encrypted:false
      SSDEEP:3:ptn:Dn
      MD5:CBF282CC55ED0792C33D10003D1F760A
      SHA1:007DD8BD75468E6B7ABA4285E9B267202C7EAEED
      SHA-256:FCDBAB99FCC0F4409E5F9D7D6FC497780288B4C441698126BB62832412774D22
      SHA-512:4643A8675D213C7DA35CC0C2BFB3B6F20324F9C48AEA7BA79F470615698C9A0CEFDA45CAA1957FC29110EE746BC8458AB8AB1E43EB513912A5E1E8858812CC00
      Malicious:false
      Reputation:high, very likely benign file
      Preview: -1000.
      /run/sshd.pid
      Process:/usr/sbin/sshd
      File Type:ASCII text
      Category:dropped
      Size (bytes):5
      Entropy (8bit):1.9219280948873623
      Encrypted:false
      SSDEEP:3:CL:CL
      MD5:E106DF5C7ADCDDF2A3C9B1E5C78112A2
      SHA1:53E55A4072F9624175A43F956606B439CBE28772
      SHA-256:66A2BED186C11E9F5C0CBF32D971D14325F871E209C6821160871175722A43D0
      SHA-512:B9EA0BC991203AD49366990596FDF035447600B1155BAD741F7C797C20C0D4E30D06F0E06AE59C4B01FD115F9E5E6B345A155BE01112D384FCF72D7B153F2EAF
      Malicious:false
      Reputation:moderate, very likely benign file
      Preview: 5262.

      Static File Info

      General

      File type:ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
      Entropy (8bit):7.9512483718866385
      TrID:
      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
      File name:yH3AxCHT3I
      File size:29944
      MD5:9065d02c3a51d27d6a930d838fa9d700
      SHA1:cdd354cd859054955116cc0476884ed3b77b4c93
      SHA256:0054cf56d6a4ef6e38ccaaf189be5f9a2e94781c8234ed52bec896fbc525d511
      SHA512:bd03ea2796cef23906b5675454344b78cfc297cc10cc4648ae65391e72ff5d2766e3c480056aea1be81328d416f27295a14bc0e9eb2ca9a72055381a73778f8a
      SSDEEP:384:++pBNm5t8706u9jtiyM0hYQEmIyzc/bgDB290RUWFZd/f25K2j0U+7+ThymdGUoo:BA4uBc0THcq21qZdhfU+7Is3UozE
      File Content Preview:.ELF...a..........(.....X...4...........4. ...(......................t...t..............L...L...L...................Q.td............................s.y.UPX!........D...D.......R..........?.E.h;.}...^..........f*..J.%.",.....n7..Io.Z....'.....5.1...#....n.

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, little endian
      Version:1 (current)
      Machine:ARM
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:ARM - ABI
      ABI Version:0
      Entry Point Address:0xe258
      Flags:0x202
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:0
      Section Header Size:40
      Number of Section Headers:0
      Header String Table Index:0

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x80000x80000x74070x74073.99800x5R E0x8000
      LOAD0x164c0x2164c0x2164c0x00x00.00000x6RW 0x8000
      GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

      Network Behavior

      Network Port Distribution

      TCP Packets

      TimestampSource PortDest PortSource IPDest IP
      Dec 24, 2021 01:47:49.047724009 CET418649506192.168.2.23205.185.117.54
      Dec 24, 2021 01:47:49.054020882 CET5605323192.168.2.2337.197.57.223
      Dec 24, 2021 01:47:49.054230928 CET5605323192.168.2.23165.17.108.36
      Dec 24, 2021 01:47:49.054235935 CET5605323192.168.2.23146.67.240.76
      Dec 24, 2021 01:47:49.054234028 CET5605323192.168.2.23122.95.11.36
      Dec 24, 2021 01:47:49.054236889 CET5605323192.168.2.23203.241.48.6
      Dec 24, 2021 01:47:49.054245949 CET5605323192.168.2.23186.46.113.223
      Dec 24, 2021 01:47:49.054253101 CET5605323192.168.2.23139.146.108.104
      Dec 24, 2021 01:47:49.054255962 CET5605323192.168.2.23213.117.204.125
      Dec 24, 2021 01:47:49.054261923 CET5605323192.168.2.2392.235.184.66
      Dec 24, 2021 01:47:49.054267883 CET5605323192.168.2.23147.220.89.165
      Dec 24, 2021 01:47:49.054270983 CET5605323192.168.2.23209.68.4.108
      Dec 24, 2021 01:47:49.054279089 CET5605323192.168.2.23241.2.210.228
      Dec 24, 2021 01:47:49.054280996 CET5605323192.168.2.23105.171.216.251
      Dec 24, 2021 01:47:49.054286003 CET5605323192.168.2.23109.82.7.187
      Dec 24, 2021 01:47:49.054286957 CET5605323192.168.2.23243.68.151.96
      Dec 24, 2021 01:47:49.054289103 CET5605323192.168.2.2382.78.9.239
      Dec 24, 2021 01:47:49.054295063 CET5605323192.168.2.23210.8.186.89
      Dec 24, 2021 01:47:49.054301977 CET5605323192.168.2.23130.189.8.110
      Dec 24, 2021 01:47:49.054306984 CET5605323192.168.2.23217.66.233.112
      Dec 24, 2021 01:47:49.054306984 CET5605323192.168.2.23196.189.195.211
      Dec 24, 2021 01:47:49.054310083 CET5605323192.168.2.23176.247.247.146
      Dec 24, 2021 01:47:49.054321051 CET5605323192.168.2.23170.241.248.158
      Dec 24, 2021 01:47:49.054322004 CET5605323192.168.2.23122.169.217.90
      Dec 24, 2021 01:47:49.054328918 CET5605323192.168.2.23102.232.26.181
      Dec 24, 2021 01:47:49.054332018 CET5605323192.168.2.234.136.252.225
      Dec 24, 2021 01:47:49.054333925 CET5605323192.168.2.23255.155.254.87
      Dec 24, 2021 01:47:49.054338932 CET5605323192.168.2.23122.200.62.168
      Dec 24, 2021 01:47:49.054338932 CET5605323192.168.2.23186.39.186.6
      Dec 24, 2021 01:47:49.054342985 CET5605323192.168.2.239.152.71.217
      Dec 24, 2021 01:47:49.054352045 CET5605323192.168.2.23182.57.187.147
      Dec 24, 2021 01:47:49.054356098 CET5605323192.168.2.23211.157.177.175
      Dec 24, 2021 01:47:49.054358959 CET5605323192.168.2.23145.194.88.235
      Dec 24, 2021 01:47:49.054363012 CET5605323192.168.2.23242.107.16.195
      Dec 24, 2021 01:47:49.054363966 CET5605323192.168.2.23118.119.254.194
      Dec 24, 2021 01:47:49.054364920 CET5605323192.168.2.23212.20.146.7
      Dec 24, 2021 01:47:49.054367065 CET5605323192.168.2.2398.52.19.251
      Dec 24, 2021 01:47:49.054369926 CET5605323192.168.2.2374.201.21.110
      Dec 24, 2021 01:47:49.054373980 CET5605323192.168.2.23251.2.30.159
      Dec 24, 2021 01:47:49.054377079 CET5605323192.168.2.23104.178.87.45
      Dec 24, 2021 01:47:49.054377079 CET5605323192.168.2.23103.106.31.112
      Dec 24, 2021 01:47:49.054378033 CET5605323192.168.2.2314.165.174.33
      Dec 24, 2021 01:47:49.054385900 CET5605323192.168.2.23166.173.235.36
      Dec 24, 2021 01:47:49.054389954 CET5605323192.168.2.23207.99.53.171
      Dec 24, 2021 01:47:49.054392099 CET5605323192.168.2.23190.249.136.26
      Dec 24, 2021 01:47:49.054392099 CET5605323192.168.2.234.153.48.106
      Dec 24, 2021 01:47:49.054394007 CET5605323192.168.2.2386.218.200.23
      Dec 24, 2021 01:47:49.054397106 CET5605323192.168.2.2335.33.254.199
      Dec 24, 2021 01:47:49.054397106 CET5605323192.168.2.23156.198.90.232
      Dec 24, 2021 01:47:49.054403067 CET5605323192.168.2.23117.5.249.162
      Dec 24, 2021 01:47:49.054416895 CET5605323192.168.2.23253.151.113.223
      Dec 24, 2021 01:47:49.054419994 CET5605323192.168.2.23179.62.107.173
      Dec 24, 2021 01:47:49.054425001 CET5605323192.168.2.2387.196.245.139
      Dec 24, 2021 01:47:49.054428101 CET5605323192.168.2.239.152.171.99
      Dec 24, 2021 01:47:49.054435015 CET5605323192.168.2.23117.163.18.242
      Dec 24, 2021 01:47:49.054435968 CET5605323192.168.2.2357.68.36.150
      Dec 24, 2021 01:47:49.054440022 CET5605323192.168.2.23117.114.112.10
      Dec 24, 2021 01:47:49.054445982 CET5605323192.168.2.23241.43.201.104
      Dec 24, 2021 01:47:49.054445982 CET5605323192.168.2.23103.137.125.42
      Dec 24, 2021 01:47:49.054446936 CET5605323192.168.2.23202.191.78.163
      Dec 24, 2021 01:47:49.054449081 CET5605323192.168.2.2360.24.239.130
      Dec 24, 2021 01:47:49.054450035 CET5605323192.168.2.2345.172.132.132
      Dec 24, 2021 01:47:49.054455996 CET5605323192.168.2.23187.32.121.155
      Dec 24, 2021 01:47:49.054461956 CET5605323192.168.2.2344.14.50.83
      Dec 24, 2021 01:47:49.054462910 CET5605323192.168.2.2340.158.56.206
      Dec 24, 2021 01:47:49.054466963 CET5605323192.168.2.2332.92.239.202
      Dec 24, 2021 01:47:49.054469109 CET5605323192.168.2.23167.239.17.255
      Dec 24, 2021 01:47:49.054471016 CET5605323192.168.2.23157.4.195.3
      Dec 24, 2021 01:47:49.054475069 CET5605323192.168.2.2358.239.145.191
      Dec 24, 2021 01:47:49.054482937 CET5605323192.168.2.23240.106.4.163
      Dec 24, 2021 01:47:49.054486990 CET5605323192.168.2.2316.243.75.76
      Dec 24, 2021 01:47:49.054491043 CET5605323192.168.2.2394.148.108.98
      Dec 24, 2021 01:47:49.054497004 CET5605323192.168.2.23170.42.36.117
      Dec 24, 2021 01:47:49.054505110 CET5605323192.168.2.23221.112.52.216
      Dec 24, 2021 01:47:49.054511070 CET5605323192.168.2.23174.132.191.232
      Dec 24, 2021 01:47:49.054513931 CET5605323192.168.2.23184.61.17.126
      Dec 24, 2021 01:47:49.054517031 CET5605323192.168.2.23108.25.47.151
      Dec 24, 2021 01:47:49.054522038 CET5605323192.168.2.2346.158.19.223
      Dec 24, 2021 01:47:49.054527998 CET5605323192.168.2.2377.102.88.100
      Dec 24, 2021 01:47:49.054554939 CET5605323192.168.2.23207.135.119.15
      Dec 24, 2021 01:47:49.054558039 CET5605323192.168.2.23128.243.148.88
      Dec 24, 2021 01:47:49.054583073 CET5605323192.168.2.238.178.84.19
      Dec 24, 2021 01:47:49.054575920 CET5605323192.168.2.23241.127.125.136
      Dec 24, 2021 01:47:49.054593086 CET5605323192.168.2.2378.228.5.185
      Dec 24, 2021 01:47:49.054598093 CET5605323192.168.2.23254.159.136.223
      Dec 24, 2021 01:47:49.054604053 CET5605323192.168.2.23241.167.164.222
      Dec 24, 2021 01:47:49.054606915 CET5605323192.168.2.2312.217.105.62
      Dec 24, 2021 01:47:49.054620981 CET5605323192.168.2.23173.216.21.37
      Dec 24, 2021 01:47:49.054622889 CET5605323192.168.2.2361.141.191.158
      Dec 24, 2021 01:47:49.054630041 CET5605323192.168.2.23211.203.66.96
      Dec 24, 2021 01:47:49.054636002 CET5605323192.168.2.2331.180.95.206
      Dec 24, 2021 01:47:49.054636002 CET5605323192.168.2.23244.152.93.54
      Dec 24, 2021 01:47:49.054655075 CET5605323192.168.2.2389.236.73.249
      Dec 24, 2021 01:47:49.054677010 CET5605323192.168.2.238.102.59.210
      Dec 24, 2021 01:47:49.054680109 CET5605323192.168.2.2371.255.135.220
      Dec 24, 2021 01:47:49.054687023 CET5605323192.168.2.23175.115.110.208
      Dec 24, 2021 01:47:49.054692984 CET5605323192.168.2.2338.160.43.37
      Dec 24, 2021 01:47:49.054696083 CET5605323192.168.2.23242.92.215.18
      Dec 24, 2021 01:47:49.054698944 CET5605323192.168.2.23156.102.59.239
      Dec 24, 2021 01:47:49.054702997 CET5605323192.168.2.238.123.229.110

      System Behavior

      Analysis Process: yH3AxCHT3I PID: 5224 Parent PID: 5115

      General

      Start time:01:47:47
      Start date:24/12/2021
      Path:/tmp/yH3AxCHT3I
      Arguments:/tmp/yH3AxCHT3I
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      Analysis Process: yH3AxCHT3I PID: 5227 Parent PID: 5224

      General

      Start time:01:47:48
      Start date:24/12/2021
      Path:/tmp/yH3AxCHT3I
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      Analysis Process: yH3AxCHT3I PID: 5228 Parent PID: 5224

      General

      Start time:01:47:48
      Start date:24/12/2021
      Path:/tmp/yH3AxCHT3I
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      Analysis Process: yH3AxCHT3I PID: 5229 Parent PID: 5224

      General

      Start time:01:47:48
      Start date:24/12/2021
      Path:/tmp/yH3AxCHT3I
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      Analysis Process: yH3AxCHT3I PID: 5233 Parent PID: 5229

      General

      Start time:01:47:48
      Start date:24/12/2021
      Path:/tmp/yH3AxCHT3I
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      Analysis Process: yH3AxCHT3I PID: 5234 Parent PID: 5229

      General

      Start time:01:47:48
      Start date:24/12/2021
      Path:/tmp/yH3AxCHT3I
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      Analysis Process: yH3AxCHT3I PID: 5237 Parent PID: 5229

      General

      Start time:01:47:48
      Start date:24/12/2021
      Path:/tmp/yH3AxCHT3I
      Arguments:n/a
      File size:4956856 bytes
      MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

      Analysis Process: systemd PID: 5261 Parent PID: 1

      General

      Start time:01:47:57
      Start date:24/12/2021
      Path:/usr/lib/systemd/systemd
      Arguments:n/a
      File size:1620224 bytes
      MD5 hash:9b2bec7092a40488108543f9334aab75

      Analysis Process: sshd PID: 5261 Parent PID: 1

      General

      Start time:01:47:57
      Start date:24/12/2021
      Path:/usr/sbin/sshd
      Arguments:/usr/sbin/sshd -t
      File size:876328 bytes
      MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340

      Analysis Process: systemd PID: 5262 Parent PID: 1

      General

      Start time:01:47:57
      Start date:24/12/2021
      Path:/usr/lib/systemd/systemd
      Arguments:n/a
      File size:1620224 bytes
      MD5 hash:9b2bec7092a40488108543f9334aab75

      Analysis Process: sshd PID: 5262 Parent PID: 1

      General

      Start time:01:47:57
      Start date:24/12/2021
      Path:/usr/sbin/sshd
      Arguments:/usr/sbin/sshd -D
      File size:876328 bytes
      MD5 hash:dbca7a6bbf7bf57fedac243d4b2cb340