Create Interactive Tour

Linux Analysis Report
skid.x86_64-20220818-1128

Overview

General Information

Sample Name:	skid.x86_64-20220818-1128
Analysis ID:	686280
MD5:	e9adcff07098778702315e9450e0d8c5
SHA1:	8dfe947c98b3fae9a1cb8130eff7aff00dc51fe7
SHA256:	6ac3754ed57f4286681295abf6f23d0ccc535f7fcdb49ec74d746f521cde1990
Infos:

Detection

Moobot

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Moobot

Machine Learning detection for sample

Sets full permissions to files and/or directories

Yara signature match

Sample has stripped symbol table

Executes the "mkdir" command used to create folders

Sample tries to set the executable flag

Executes the "chmod" command used to modify permissions

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Executes the "rm" command used to delete files or directories

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	686280
Start date and time:	2022-08-18 13:36:39 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	skid.x86_64-20220818-1128
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal72.troj.linX86_64-20220818-1128@0/0@1/0

Runtime Messages

Command:	/tmp/skid.x86_64-20220818-1128
PID:	6232
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	qazwsxedc
Standard Error:

Process Tree

system is lnxubuntu20

skid.x86_64-20220818-1128 (PID: 6232, Parent: 6125, MD5: e9adcff07098778702315e9450e0d8c5) Arguments: /tmp/skid.x86_64-20220818-1128

skid.x86_64-20220818-1128 New Fork (PID: 6233, Parent: 6232)

skid.x86_64-20220818-1128 New Fork (PID: 6234, Parent: 6232)

sh (PID: 6234, Parent: 6232, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/skid.x86_64-20220818-1128 bin/systemd; chmod 777 bin/systemd"

sh New Fork (PID: 6235, Parent: 6234)

rm (PID: 6235, Parent: 6234, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf bin/systemd

sh New Fork (PID: 6236, Parent: 6234)

mkdir (PID: 6236, Parent: 6234, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir bin

sh New Fork (PID: 6237, Parent: 6234)

mv (PID: 6237, Parent: 6234, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/skid.x86_64-20220818-1128 bin/systemd

sh New Fork (PID: 6238, Parent: 6234)

chmod (PID: 6238, Parent: 6234, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 bin/systemd

skid.x86_64-20220818-1128 New Fork (PID: 6239, Parent: 6232)

skid.x86_64-20220818-1128 New Fork (PID: 6240, Parent: 6239)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
skid.x86_64-20220818-1128	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xeafe:$s1: LCOGQGPTGP 0xe95f:$s3: CFOKLKQVPCVMP 0xe947:$s4: QWRGPTKQMP 0xe8dd:$s5: HWCLVGAJ
skid.x86_64-20220818-1128	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
skid.x86_64-20220818-1128	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdd08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdda8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdde4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
skid.x86_64-20220818-1128	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9ecc:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
skid.x86_64-20220818-1128	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa6bb:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
skid.x86_64-20220818-1128	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x7cf2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x7e2c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
skid.x86_64-20220818-1128	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xd13e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
skid.x86_64-20220818-1128	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa27b:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
skid.x86_64-20220818-1128	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x9812:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
skid.x86_64-20220818-1128	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa546:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
skid.x86_64-20220818-1128	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x9a0b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
skid.x86_64-20220818-1128	Linux_Trojan_Mirai_1e0c5ce0	unknown	unknown	0xae8:$a: 4C 24 54 31 F6 41 B8 04 00 00 00 BA 03 00 00 00 C7 44 24 54 01 00
skid.x86_64-20220818-1128	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x34a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
skid.x86_64-20220818-1128	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x4e5f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
skid.x86_64-20220818-1128	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0xe8d1:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
skid.x86_64-20220818-1128	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x44d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
skid.x86_64-20220818-1128	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x3672:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 12 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xeafe:$s1: LCOGQGPTGP 0xe95f:$s3: CFOKLKQVPCVMP 0xe947:$s4: QWRGPTKQMP 0xe8dd:$s5: HWCLVGAJ
6240.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdd08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdda8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdde4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9ecc:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa6bb:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x7cf2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x7e2c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xd13e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa27b:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x9812:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa546:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x9a0b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_1e0c5ce0	unknown	unknown	0xae8:$a: 4C 24 54 31 F6 41 B8 04 00 00 00 BA 03 00 00 00 C7 44 24 54 01 00
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x34a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x4e5f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0xe8d1:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x44d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6240.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x3672:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xeafe:$s1: LCOGQGPTGP 0xe95f:$s3: CFOKLKQVPCVMP 0xe947:$s4: QWRGPTKQMP 0xe8dd:$s5: HWCLVGAJ
6239.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdd08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdda8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdde4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9ecc:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa6bb:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x7cf2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x7e2c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xd13e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa27b:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x9812:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa546:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x9a0b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_1e0c5ce0	unknown	unknown	0xae8:$a: 4C 24 54 31 F6 41 B8 04 00 00 00 BA 03 00 00 00 C7 44 24 54 01 00
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x34a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x4e5f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0xe8d1:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x44d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6239.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x3672:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xeafe:$s1: LCOGQGPTGP 0xe95f:$s3: CFOKLKQVPCVMP 0xe947:$s4: QWRGPTKQMP 0xe8dd:$s5: HWCLVGAJ
6232.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xdd08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdd94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdda8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdde4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xddf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x9ecc:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xa6bb:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x7cf2:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x7e2c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xd13e:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xa27b:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x9812:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xa546:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x9a0b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_1e0c5ce0	unknown	unknown	0xae8:$a: 4C 24 54 31 F6 41 B8 04 00 00 00 BA 03 00 00 00 C7 44 24 54 01 00
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x34a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x4e5f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0xe8d1:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x44d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6232.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x3672:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Process Memory Space: skid.x86_64-20220818-1128 PID: 6232	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: skid.x86_64-20220818-1128 PID: 6232	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x509:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x51d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x531:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x545:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x559:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x581:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x595:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x621:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x635:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x649:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x65d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: skid.x86_64-20220818-1128 PID: 6239	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xad6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xafe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: skid.x86_64-20220818-1128 PID: 6240	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: skid.x86_64-20220818-1128 PID: 6240	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x509:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x51d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x531:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x545:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x559:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x56d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x581:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x595:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x621:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x635:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x649:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x65d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 51 entries

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: skid.x86_64-20220818-1128

Virustotal: Detection: 46%

Perma Link

Machine Learning detection for sample

Source: skid.x86_64-20220818-1128

Joe Sandbox ML: detected

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 208.19.130.80:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 154.154.133.198:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 74.229.128.108:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 107.204.92.31:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 160.29.235.43:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 152.17.172.183:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 212.41.81.194:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 128.50.110.206:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 196.166.211.213:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 104.202.158.38:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 209.62.53.238:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 47.170.201.21:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 197.63.75.172:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 54.77.211.82:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 181.60.235.188:2323
Source: global traffic	TCP traffic: 192.168.2.23:19226 -> 133.102.156.126:2323

Source: /tmp/skid.x86_64-20220818-1128 (PID: 6232)

Socket: 0.0.0.0::1230

Jump to behavior

Source: unknown

DNS traffic detected: queries for: cnc.condinet.cf

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 1.251.189.87
Source: unknown	TCP traffic detected without corresponding DNS query: 208.19.130.80
Source: unknown	TCP traffic detected without corresponding DNS query: 104.145.252.74
Source: unknown	TCP traffic detected without corresponding DNS query: 84.113.99.192
Source: unknown	TCP traffic detected without corresponding DNS query: 57.31.72.180
Source: unknown	TCP traffic detected without corresponding DNS query: 154.154.133.198
Source: unknown	TCP traffic detected without corresponding DNS query: 120.192.237.121
Source: unknown	TCP traffic detected without corresponding DNS query: 120.164.68.164
Source: unknown	TCP traffic detected without corresponding DNS query: 135.118.61.80
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.156.26
Source: unknown	TCP traffic detected without corresponding DNS query: 198.224.225.24
Source: unknown	TCP traffic detected without corresponding DNS query: 92.242.181.113
Source: unknown	TCP traffic detected without corresponding DNS query: 74.229.128.108
Source: unknown	TCP traffic detected without corresponding DNS query: 137.118.86.13
Source: unknown	TCP traffic detected without corresponding DNS query: 150.234.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 1.253.13.255
Source: unknown	TCP traffic detected without corresponding DNS query: 160.185.224.83
Source: unknown	TCP traffic detected without corresponding DNS query: 172.230.43.41
Source: unknown	TCP traffic detected without corresponding DNS query: 200.160.40.247
Source: unknown	TCP traffic detected without corresponding DNS query: 79.14.102.18
Source: unknown	TCP traffic detected without corresponding DNS query: 136.15.125.242
Source: unknown	TCP traffic detected without corresponding DNS query: 149.214.102.178
Source: unknown	TCP traffic detected without corresponding DNS query: 148.31.109.214
Source: unknown	TCP traffic detected without corresponding DNS query: 115.85.222.164
Source: unknown	TCP traffic detected without corresponding DNS query: 140.61.216.148
Source: unknown	TCP traffic detected without corresponding DNS query: 202.95.241.63
Source: unknown	TCP traffic detected without corresponding DNS query: 176.168.24.84
Source: unknown	TCP traffic detected without corresponding DNS query: 129.221.227.19
Source: unknown	TCP traffic detected without corresponding DNS query: 191.217.156.215
Source: unknown	TCP traffic detected without corresponding DNS query: 25.215.7.65
Source: unknown	TCP traffic detected without corresponding DNS query: 107.204.92.31
Source: unknown	TCP traffic detected without corresponding DNS query: 156.218.146.110
Source: unknown	TCP traffic detected without corresponding DNS query: 157.114.24.146
Source: unknown	TCP traffic detected without corresponding DNS query: 199.173.15.78
Source: unknown	TCP traffic detected without corresponding DNS query: 43.64.82.112
Source: unknown	TCP traffic detected without corresponding DNS query: 148.243.54.138
Source: unknown	TCP traffic detected without corresponding DNS query: 128.242.251.12
Source: unknown	TCP traffic detected without corresponding DNS query: 62.45.232.119
Source: unknown	TCP traffic detected without corresponding DNS query: 134.89.129.60
Source: unknown	TCP traffic detected without corresponding DNS query: 63.91.191.212
Source: unknown	TCP traffic detected without corresponding DNS query: 106.83.108.115
Source: unknown	TCP traffic detected without corresponding DNS query: 79.190.131.2
Source: unknown	TCP traffic detected without corresponding DNS query: 145.72.100.58
Source: unknown	TCP traffic detected without corresponding DNS query: 163.139.123.209
Source: unknown	TCP traffic detected without corresponding DNS query: 223.56.154.248
Source: unknown	TCP traffic detected without corresponding DNS query: 160.29.235.43
Source: unknown	TCP traffic detected without corresponding DNS query: 202.188.75.114
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.136.44
Source: unknown	TCP traffic detected without corresponding DNS query: 145.231.162.107
Source: unknown	TCP traffic detected without corresponding DNS query: 134.238.86.201

System Summary

Malicious sample detected (through community Yara rule)

Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: Process Memory Space: skid.x86_64-20220818-1128 PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: skid.x86_64-20220818-1128 PID: 6239, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: skid.x86_64-20220818-1128 PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 reference_sample = 5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b, id = 1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: skid.x86_64-20220818-1128, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 reference_sample = 5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b, id = 1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 reference_sample = 5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b, id = 1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_1e0c5ce0 reference_sample = 5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b, id = 1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: Process Memory Space: skid.x86_64-20220818-1128 PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: skid.x86_64-20220818-1128 PID: 6239, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: skid.x86_64-20220818-1128 PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	SIGKILL sent: pid: 6239, result: successful			Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	SIGKILL sent: pid: 6240, result: successful			Jump to behavior

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/proc//proc/%d/maps/usr/lib/systemd/systemd/usr/bin/usr/sbin/usr/lib/var/lib/var/spool/tmp/Sofiasshdbashhttpdtelnetddropbearencoder/var/run//mnt/root/var/tmp/boot/.(deleted)/home/usr/libexec/openssh/sftp-server/bin/busybox/bin/watchdog/bin/systemdrm -rf && mkdir ; > && mv ; chmod 777 3f

Source: classification engine

Classification label: mal72.troj.linX86_64-20220818-1128@0/0@1/0

Persistence and Installation Behavior

Sets full permissions to files and/or directories

Source: /bin/sh (PID: 6238)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/systemd

Jump to behavior

Source: /bin/sh (PID: 6236)

Mkdir executable: /usr/bin/mkdir -> mkdir bin

Jump to behavior

Source: /usr/bin/chmod (PID: 6238)

File: /tmp/bin/systemd (bits: - usr: rwx grp: rwx all: rwx)

Jump to behavior

Source: /bin/sh (PID: 6238)

Chmod executable: /usr/bin/chmod -> chmod 777 bin/systemd

Jump to behavior

Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/skid.x86_64-20220818-1128 (PID: 6233)	File opened: /proc/114/maps	Jump to behavior

Source: /tmp/skid.x86_64-20220818-1128 (PID: 6234)

Shell command executed: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/skid.x86_64-20220818-1128 bin/systemd; chmod 777 bin/systemd"

Jump to behavior

Source: /bin/sh (PID: 6235)

Rm executable: /usr/bin/rm -> rm -rf bin/systemd

Jump to behavior

Stealing of Sensitive Information

Yara detected Moobot

Source: Yara match	File source: skid.x86_64-20220818-1128, type: SAMPLE
Source: Yara match	File source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: skid.x86_64-20220818-1128 PID: 6232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skid.x86_64-20220818-1128 PID: 6240, type: MEMORYSTR

Remote Access Functionality

Yara detected Moobot

Source: Yara match	File source: skid.x86_64-20220818-1128, type: SAMPLE
Source: Yara match	File source: 6240.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6239.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: skid.x86_64-20220818-1128 PID: 6232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: skid.x86_64-20220818-1128 PID: 6240, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	Path Interception	Path Interception	2 File and Directory Permissions Modification	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Scripting	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
skid.x86_64-20220818-1128	46%	Virustotal		Browse
skid.x86_64-20220818-1128	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
cnc.condinet.cf	0%	Virustotal		Browse

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cnc.condinet.cf	141.98.6.110	true	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
148.31.109.214	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
115.85.222.164	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
105.70.79.30	unknown	Morocco	36884	MAROCCONNECTMA	false
104.145.252.74	unknown	United States	23254	CARR-INTERNETUS	false
58.108.168.250	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
105.133.191.240	unknown	Morocco	6713	IAM-ASMA	false
45.80.23.230	unknown	Romania	199417	SERVERBASECH	false
183.123.21.14	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
47.170.201.21	unknown	United States	5650	FRONTIER-FRTRUS	false
62.45.232.119	unknown	Netherlands	15435	KABELFOONDELTAFiberNederlandNL	false
202.51.101.224	unknown	Indonesia	17995	SOLUSINET-AS-IDPTiForteGlobalInternetID	false
210.133.139.218	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
66.195.37.16	unknown	United States	3549	LVLT-3549US	false
79.190.131.2	unknown	Poland	5617	TPNETPL	false
163.139.123.209	unknown	Japan	2519	VECTANTARTERIANetworksCorporationJP	false
1.251.189.87	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
153.92.236.16	unknown	France	200484	SENDINBLUE-ASNFR	false
82.108.49.216	unknown	United Kingdom	4589	EASYNETEasynetGlobalServicesEU	false
2.29.10.9	unknown	United Kingdom	12576	EELtdGB	false
148.243.54.138	unknown	Mexico	6503	AxtelSABdeCVMX	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
84.113.99.192	unknown	Austria	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false
135.239.185.48	unknown	United States	10455	LUCENT-CIOUS	false
198.224.225.24	unknown	United States	6167	CELLCO-PARTUS	false
161.158.15.123	unknown	Netherlands	36351	SOFTLAYERUS	false
84.210.50.95	unknown	Norway	41164	GET-NOGETNorwayNO	false
160.29.235.43	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
114.237.215.50	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
116.220.190.123	unknown	Japan	9824	JTCL-JP-ASJupiterTelecommunicationCoLtdJP	false
54.77.211.82	unknown	United States	16509	AMAZON-02US	false
191.217.156.215	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
193.145.196.225	unknown	Spain	766	REDIRISRedIRISAutonomousSystemES	false
134.89.129.60	unknown	United States	14706	MBARI-MAINUS	false
202.188.75.114	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
156.170.107.214	unknown	Egypt	36992	ETISALAT-MISREG	false
152.17.172.183	unknown	United States	40245	WAKE-FOREST-UNIVERSITYUS	false
88.166.238.213	unknown	France	12322	PROXADFR	false
157.114.24.146	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
48.237.243.144	unknown	United States	2686	ATGS-MMD-ASUS	false
20.42.156.26	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.59.177.226	unknown	United States	5511	OPENTRANSITFR	false
104.202.158.38	unknown	United States	18978	ENZUINC-US	false
174.160.63.5	unknown	United States	7922	COMCAST-7922US	false
92.242.181.113	unknown	Poland	210081	WISNIOWSKI-PL	false
74.229.128.108	unknown	United States	7018	ATT-INTERNET4US	false
63.91.191.212	unknown	United States	10584	TRADEWEBUS	false
143.220.253.237	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
123.206.28.15	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
43.64.82.112	unknown	Japan	4249	LILLY-ASUS	false
113.89.242.228	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
197.138.255.77	unknown	Kenya	36914	KENET-ASKE	false
145.230.178.235	unknown	Germany	12663	VODAFONE-GROUPIT	false
83.115.139.158	unknown	France	3215	FranceTelecom-OrangeFR	false
213.177.141.86	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
134.238.86.201	unknown	United States	16761	FEDMOG-ASN-01US	false
115.82.226.126	unknown	Taiwan; Republic of China (ROC)	24158	TAIWANMOBILE-ASTaiwanMobileCoLtdTW	false
137.118.86.13	unknown	United States	14368	BRAZOS-INTERNETUS	false
112.111.200.156	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
121.88.226.46	unknown	Korea Republic of	10036	CNM-AS-KRDLIVEKR	false
107.204.92.31	unknown	United States	7018	ATT-INTERNET4US	false
34.122.4.99	unknown	United States	15169	GOOGLEUS	false
135.16.28.55	unknown	United States	54614	CIKTELECOM-CABLECA	false
177.212.205.207	unknown	Brazil	26599	TELEFONICABRASILSABR	false
139.178.164.9	unknown	Netherlands	714	APPLE-ENGINEERINGUS	false
150.234.173.11	unknown	United States	122	UPMC-AS122US	false
176.168.24.84	unknown	France	5410	BOUYGTEL-ISPFR	false
25.215.7.65	unknown	United Kingdom	7922	COMCAST-7922US	false
129.198.156.183	unknown	United States	385	AFCONC-BLOCK1-ASUS	false
161.114.207.133	unknown	United States	71	HP-INTERNET-ASUS	false
202.95.241.63	unknown	China	17894	APMI-AS-APAyalaPortMakatiIncDataCenterOperatorPH	false
217.77.156.100	unknown	Netherlands	12902	LUNANL	false
128.50.110.206	unknown	United States	11293	UCOP-ASNUS	false
66.224.150.235	unknown	United States	7385	ALLSTREAMUS	false
120.97.70.27	unknown	Taiwan; Republic of China (ROC)	17716	NTU-TWNationalTaiwanUniversityTW	false
57.31.72.180	unknown	Belgium	2686	ATGS-MMD-ASUS	false
209.127.248.254	unknown	Canada	27163	INTERACTIVE-BROKERS-CORPUS	false
213.98.68.86	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
221.124.22.161	unknown	Hong Kong	18116	HGC-AS-APHGCGlobalCommunicationsLimitedHK	false
2.240.210.131	unknown	Germany	6805	TDDE-ASN1DE	false
157.233.100.177	unknown	United States	20001	TWC-20001-PACWESTUS	false
13.145.3.28	unknown	United States	7018	ATT-INTERNET4US	false
129.60.58.97	unknown	Japan	37918	ECL-INETNipponTelegraphandTelephoneCorporationJP	false
206.103.162.120	unknown	United States	6423	EASYSTREET-ONLINEUS	false
199.173.15.78	unknown	United States	701	UUNETUS	false
34.42.187.194	unknown	United States	2686	ATGS-MMD-ASUS	false
20.246.77.7	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.9.107.100	unknown	Syrian Arab Republic	29256	INT-PDN-STE-ASSTEPDNInternalASSY	false
146.175.19.198	unknown	Belgium	2611	BELNETBE	false
223.56.154.248	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
197.63.75.172	unknown	Egypt	8452	TE-ASTE-ASEG	false
109.132.142.161	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
1.253.13.255	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
129.221.227.19	unknown	United States	24126	UNISYS-AP-UI-AS-APUnisysAsiaPacIntranetAccesstoInterne	false
54.114.191.16	unknown	United States	16509	AMAZON-02US	false
181.60.235.188	unknown	Colombia	10620	TelmexColombiaSACO	false
120.164.68.164	unknown	Indonesia	4761	INDOSAT-INP-APINDOSATInternetNetworkProviderID	false
120.144.5.64	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
126.124.182.182	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
198.12.4.116	unknown	United States	18819	ENTERGY-CORP-US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
91.189.91.43	skid.arm6-20220818-1128	Get hash	malicious	Browse
	SecuriteInfo.com.Linux.Mirai.6522.24453.11671	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKD.34055387.13146.14816	Get hash	malicious	Browse
	gLs8G52sCI	Get hash	malicious	Browse
	PiIeIFvP87	Get hash	malicious	Browse
	Ed2mIcm3tU	Get hash	malicious	Browse
	6B5nNanZZj	Get hash	malicious	Browse
	c86ci2N8Tj	Get hash	malicious	Browse
	bPYFBbP5GJ	Get hash	malicious	Browse
	DuDD5n5td5	Get hash	malicious	Browse
	TytNMcxJIw	Get hash	malicious	Browse
	5Yd4ywr80p	Get hash	malicious	Browse
	yakuza.arm5-20220817-2047	Get hash	malicious	Browse
	yakuza.arm6-20220817-2047	Get hash	malicious	Browse
	yakuza.x86-20220817-2047	Get hash	malicious	Browse
	yakuza.arm7-20220817-2047	Get hash	malicious	Browse
	LEKbhvaccz	Get hash	malicious	Browse
	c7JV1jqz0c	Get hash	malicious	Browse
	M8PweSzf2w	Get hash	malicious	Browse
	Gs3U6zsz1U	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
cnc.condinet.cf	skid.x86-20220818-1128	Get hash	malicious	Browse	141.98.6.110
	skid.x86_64-20220815-1818	Get hash	malicious	Browse	141.98.6.110
	skid.x86-20220815-1818	Get hash	malicious	Browse	141.98.6.110
	skid.arm7-20220815-1818	Get hash	malicious	Browse	141.98.6.110
	skid.mips-20220815-1818	Get hash	malicious	Browse	141.98.6.110
	skid.mpsl-20220815-1818	Get hash	malicious	Browse	141.98.6.110
	skid.arm-20220815-1818	Get hash	malicious	Browse	141.98.6.110
	skid.x86_64-20220815-1256	Get hash	malicious	Browse	141.98.6.110
	skid.x86-20220815-1256	Get hash	malicious	Browse	141.98.6.110
	skid.arm7-20220815-1256	Get hash	malicious	Browse	141.98.6.110
	skid.mips-20220815-1256	Get hash	malicious	Browse	141.98.6.110
	skid.mpsl-20220815-1257	Get hash	malicious	Browse	141.98.6.110
	skid.arm-20220815-1257	Get hash	malicious	Browse	141.98.6.110
	zJ9wENKpYi	Get hash	malicious	Browse	141.98.6.110
	SAicZFhHM6	Get hash	malicious	Browse	141.98.6.110
	bupmbobeg8	Get hash	malicious	Browse	141.98.6.110
	izOgcbSh47	Get hash	malicious	Browse	141.98.6.110
	y2cQTPRijR	Get hash	malicious	Browse	141.98.6.110
	qdcsYb87VE	Get hash	malicious	Browse	141.98.6.110
	skid.arm7	Get hash	malicious	Browse	141.98.6.110

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CompaniaDominicanadeTelefonosSADO	rf6NT3iJPf	Get hash	malicious	Browse	148.37.165.66
	ohHTpaqhhA	Get hash	malicious	Browse	148.27.34.136
	lL6LrPDiwb	Get hash	malicious	Browse	148.35.35.89
	4irWstY0T7	Get hash	malicious	Browse	148.16.65.220
	UxIukBScfX	Get hash	malicious	Browse	148.45.91.59
	Ib3F4SjsqR	Get hash	malicious	Browse	150.10.170.125
	SecuriteInfo.com.Linux.Siggen.9999.11071.28797	Get hash	malicious	Browse	66.98.91.59
	mipsel-20220816-1116	Get hash	malicious	Browse	152.69.141.1
	i686-20220816-1117	Get hash	malicious	Browse	148.33.83.97
	kG7ktScD2l	Get hash	malicious	Browse	148.18.97.6
	A0E2C62C90C6C425BFD56FEF3D1E04530A1B0FD0DBF69.exe	Get hash	malicious	Browse	186.6.41.113
	gyJkjCb7fG	Get hash	malicious	Browse	148.182.44.20
	WGtyocaInj	Get hash	malicious	Browse	148.130.95.188
	6cCa7jPh9x	Get hash	malicious	Browse	190.80.166.186
	Q0ckwyWEJ4	Get hash	malicious	Browse	148.128.79.206
	axP7RwrvyO	Get hash	malicious	Browse	148.45.80.113
	SecuriteInfo.com.Trojan.Linux.Generic.265194.31321.14271	Get hash	malicious	Browse	150.75.198.213
	KujrQYA5BI	Get hash	malicious	Browse	150.72.126.217
	ncJmBOetwD	Get hash	malicious	Browse	150.25.201.142
	Dze3X1EzuD	Get hash	malicious	Browse	148.26.55.110
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	skid.x86-20220818-1128	Get hash	malicious	Browse	123.13.62.192
	Xbze1p9z30.docx	Get hash	malicious	Browse	123.190.113.45
	Xbze1p9z30.docx	Get hash	malicious	Browse	123.190.113.45
	657mgzkci5	Get hash	malicious	Browse	218.24.195.125
	4xUFxuWYKt	Get hash	malicious	Browse	117.8.190.226
	rf6NT3iJPf	Get hash	malicious	Browse	180.95.252.41
	lfYru0uB7i	Get hash	malicious	Browse	27.202.109.191
	micIUMDDI8	Get hash	malicious	Browse	119.185.72.157
	GFGKMctmKH	Get hash	malicious	Browse	124.94.203.27
	ohHTpaqhhA	Get hash	malicious	Browse	218.27.12.52
	lL6LrPDiwb	Get hash	malicious	Browse	116.162.210.225
	KVQPI3Fehq	Get hash	malicious	Browse	221.214.135.68
	a84pe0qmNp	Get hash	malicious	Browse	122.96.240.209
	4irWstY0T7	Get hash	malicious	Browse	58.243.187.5
	IDTkPkfSPq	Get hash	malicious	Browse	171.120.172.204
	UxIukBScfX	Get hash	malicious	Browse	221.199.90.136
	j9C3Ja5YQy	Get hash	malicious	Browse	221.215.154.94
	Ib3F4SjsqR	Get hash	malicious	Browse	113.202.227.49
	by0RJi2Iv5	Get hash	malicious	Browse	122.157.158.92
	NO8AMUK31l	Get hash	malicious	Browse	218.61.57.103

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.1220588210266085
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	skid.x86_64-20220818-1128
File size:	71488
MD5:	e9adcff07098778702315e9450e0d8c5
SHA1:	8dfe947c98b3fae9a1cb8130eff7aff00dc51fe7
SHA256:	6ac3754ed57f4286681295abf6f23d0ccc535f7fcdb49ec74d746f521cde1990
SHA512:	3a2483047857f93292090fae36419b1d5845b8ae3fa3d67334668c8c57910bcb9618630e949087c4b70e1ece7359631d1c17d9300805117d73f68752106d6fce
SSDEEP:	1536:4Ii+W6WhPekkTZiWJkFnzDo2NCtN3nm9cDZfm+JQaw:9i+nWpdCZ/QzDo+23n4yZO+JQaw
TLSH:	65630807F94181FDC08AC1741A5ABE3ADC3275FD1328F2A663E4FB362D5AD221E1AD45
File Content Preview:	.ELF..............>.......@.....@...................@.8...@.......................@.......@...............................................Q.......Q............../..............Q.td....................................................H...._........H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	70848
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0xd716	0x0	0x6	AX	16
.fini	PROGBITS	0x40d816	0xd816	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x40d840	0xd840	0x2950	0x0	0x2	A	32
.ctors	PROGBITS	0x511000	0x11000	0x10	0x0	0x3	WA	8
.dtors	PROGBITS	0x511010	0x11010	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x511040	0x11040	0x440	0x0	0x3	WA	32
.bss	NOBITS	0x511480	0x11480	0x2b08	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x11480	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x10190	0x10190	6.4072	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x11000	0x511000	0x511000	0x480	0x2f88	2.2117	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 167
• 2323 undefined
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)
• 23 (Telnet)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 18, 2022 13:37:25.817823887 CEST	19226	23	192.168.2.23	1.251.189.87
Aug 18, 2022 13:37:25.817826986 CEST	19226	2323	192.168.2.23	208.19.130.80
Aug 18, 2022 13:37:25.817856073 CEST	19226	23	192.168.2.23	84.210.50.95
Aug 18, 2022 13:37:25.817864895 CEST	19226	23	192.168.2.23	104.145.252.74
Aug 18, 2022 13:37:25.817868948 CEST	19226	23	192.168.2.23	84.113.99.192
Aug 18, 2022 13:37:25.817868948 CEST	19226	23	192.168.2.23	57.31.72.180
Aug 18, 2022 13:37:25.817873001 CEST	19226	2323	192.168.2.23	154.154.133.198
Aug 18, 2022 13:37:25.817876101 CEST	19226	23	192.168.2.23	120.192.237.121
Aug 18, 2022 13:37:25.817879915 CEST	19226	23	192.168.2.23	120.164.68.164
Aug 18, 2022 13:37:25.817888021 CEST	19226	23	192.168.2.23	135.118.61.80
Aug 18, 2022 13:37:25.817893982 CEST	19226	23	192.168.2.23	20.42.156.26
Aug 18, 2022 13:37:25.817892075 CEST	19226	23	192.168.2.23	198.224.225.24
Aug 18, 2022 13:37:25.817935944 CEST	19226	23	192.168.2.23	92.242.181.113
Aug 18, 2022 13:37:25.817939997 CEST	19226	2323	192.168.2.23	74.229.128.108
Aug 18, 2022 13:37:25.817945004 CEST	19226	23	192.168.2.23	137.118.86.13
Aug 18, 2022 13:37:25.817954063 CEST	19226	23	192.168.2.23	150.234.173.11
Aug 18, 2022 13:37:25.817961931 CEST	19226	23	192.168.2.23	1.253.13.255
Aug 18, 2022 13:37:25.817971945 CEST	19226	23	192.168.2.23	160.185.224.83
Aug 18, 2022 13:37:25.817981958 CEST	19226	23	192.168.2.23	172.230.43.41
Aug 18, 2022 13:37:25.817984104 CEST	19226	23	192.168.2.23	200.160.40.247
Aug 18, 2022 13:37:25.817986012 CEST	19226	23	192.168.2.23	79.14.102.18
Aug 18, 2022 13:37:25.817987919 CEST	19226	23	192.168.2.23	136.15.125.242
Aug 18, 2022 13:37:25.817991018 CEST	19226	23	192.168.2.23	149.214.102.178
Aug 18, 2022 13:37:25.817992926 CEST	19226	23	192.168.2.23	148.31.109.214
Aug 18, 2022 13:37:25.817992926 CEST	19226	23	192.168.2.23	115.85.222.164
Aug 18, 2022 13:37:25.817997932 CEST	19226	23	192.168.2.23	140.61.216.148
Aug 18, 2022 13:37:25.817998886 CEST	19226	23	192.168.2.23	202.95.241.63
Aug 18, 2022 13:37:25.818002939 CEST	19226	23	192.168.2.23	176.168.24.84
Aug 18, 2022 13:37:25.818007946 CEST	19226	23	192.168.2.23	129.221.227.19
Aug 18, 2022 13:37:25.818012953 CEST	19226	23	192.168.2.23	191.217.156.215
Aug 18, 2022 13:37:25.818011999 CEST	19226	23	192.168.2.23	25.215.7.65
Aug 18, 2022 13:37:25.818017006 CEST	19226	2323	192.168.2.23	107.204.92.31
Aug 18, 2022 13:37:25.818020105 CEST	19226	23	192.168.2.23	156.218.146.110
Aug 18, 2022 13:37:25.818027973 CEST	19226	23	192.168.2.23	157.114.24.146
Aug 18, 2022 13:37:25.818031073 CEST	19226	23	192.168.2.23	199.173.15.78
Aug 18, 2022 13:37:25.818032026 CEST	19226	23	192.168.2.23	43.64.82.112
Aug 18, 2022 13:37:25.818037987 CEST	19226	23	192.168.2.23	148.243.54.138
Aug 18, 2022 13:37:25.818042040 CEST	19226	23	192.168.2.23	128.242.251.12
Aug 18, 2022 13:37:25.818052053 CEST	19226	23	192.168.2.23	62.45.232.119
Aug 18, 2022 13:37:25.818053961 CEST	19226	23	192.168.2.23	134.89.129.60
Aug 18, 2022 13:37:25.818054914 CEST	19226	23	192.168.2.23	63.91.191.212
Aug 18, 2022 13:37:25.818058014 CEST	19226	23	192.168.2.23	106.83.108.115
Aug 18, 2022 13:37:25.818058968 CEST	19226	23	192.168.2.23	79.190.131.2
Aug 18, 2022 13:37:25.818058968 CEST	19226	23	192.168.2.23	145.72.100.58
Aug 18, 2022 13:37:25.818059921 CEST	19226	23	192.168.2.23	163.139.123.209
Aug 18, 2022 13:37:25.818059921 CEST	19226	23	192.168.2.23	223.56.154.248
Aug 18, 2022 13:37:25.818064928 CEST	19226	2323	192.168.2.23	160.29.235.43
Aug 18, 2022 13:37:25.818072081 CEST	19226	23	192.168.2.23	202.188.75.114
Aug 18, 2022 13:37:25.818073988 CEST	19226	23	192.168.2.23	172.245.136.44
Aug 18, 2022 13:37:25.818077087 CEST	19226	23	192.168.2.23	145.231.162.107
Aug 18, 2022 13:37:25.818079948 CEST	19226	23	192.168.2.23	134.238.86.201
Aug 18, 2022 13:37:25.818083048 CEST	19226	23	192.168.2.23	125.236.99.178
Aug 18, 2022 13:37:25.818084955 CEST	19226	23	192.168.2.23	112.111.200.156
Aug 18, 2022 13:37:25.818088055 CEST	19226	2323	192.168.2.23	152.17.172.183
Aug 18, 2022 13:37:25.818090916 CEST	19226	2323	192.168.2.23	212.41.81.194
Aug 18, 2022 13:37:25.818094015 CEST	19226	23	192.168.2.23	113.89.242.228
Aug 18, 2022 13:37:25.818097115 CEST	19226	23	192.168.2.23	145.230.178.235
Aug 18, 2022 13:37:25.818099022 CEST	19226	23	192.168.2.23	99.92.36.49
Aug 18, 2022 13:37:25.818103075 CEST	19226	23	192.168.2.23	85.27.106.51
Aug 18, 2022 13:37:25.818104982 CEST	19226	23	192.168.2.23	31.9.107.100
Aug 18, 2022 13:37:25.818106890 CEST	19226	23	192.168.2.23	27.155.140.183
Aug 18, 2022 13:37:25.818109989 CEST	19226	23	192.168.2.23	143.220.253.237
Aug 18, 2022 13:37:25.818111897 CEST	19226	23	192.168.2.23	34.20.208.145
Aug 18, 2022 13:37:25.818114996 CEST	19226	23	192.168.2.23	103.124.22.125
Aug 18, 2022 13:37:25.818118095 CEST	19226	23	192.168.2.23	105.70.79.30
Aug 18, 2022 13:37:25.818120003 CEST	19226	23	192.168.2.23	216.184.159.215
Aug 18, 2022 13:37:25.818124056 CEST	19226	23	192.168.2.23	179.78.248.19
Aug 18, 2022 13:37:25.818125963 CEST	19226	23	192.168.2.23	47.83.111.26
Aug 18, 2022 13:37:25.818128109 CEST	19226	23	192.168.2.23	180.171.110.49
Aug 18, 2022 13:37:25.818130970 CEST	19226	2323	192.168.2.23	128.50.110.206
Aug 18, 2022 13:37:25.818134069 CEST	19226	23	192.168.2.23	45.80.23.230
Aug 18, 2022 13:37:25.818135977 CEST	19226	23	192.168.2.23	139.178.164.9
Aug 18, 2022 13:37:25.818137884 CEST	19226	23	192.168.2.23	48.86.66.193
Aug 18, 2022 13:37:25.818140030 CEST	19226	23	192.168.2.23	41.23.113.191
Aug 18, 2022 13:37:25.818142891 CEST	19226	2323	192.168.2.23	196.166.211.213
Aug 18, 2022 13:37:25.818146944 CEST	19226	2323	192.168.2.23	104.202.158.38
Aug 18, 2022 13:37:25.818149090 CEST	19226	23	192.168.2.23	88.166.238.213
Aug 18, 2022 13:37:25.818150997 CEST	19226	23	192.168.2.23	115.82.226.126
Aug 18, 2022 13:37:25.818152905 CEST	19226	23	192.168.2.23	129.171.15.119
Aug 18, 2022 13:37:25.818156004 CEST	19226	23	192.168.2.23	183.123.21.14
Aug 18, 2022 13:37:25.818156958 CEST	19226	23	192.168.2.23	135.239.185.48
Aug 18, 2022 13:37:25.818161011 CEST	19226	23	192.168.2.23	34.122.4.99
Aug 18, 2022 13:37:25.818161964 CEST	19226	23	192.168.2.23	58.108.168.250
Aug 18, 2022 13:37:25.818165064 CEST	19226	23	192.168.2.23	126.124.182.182
Aug 18, 2022 13:37:25.818167925 CEST	19226	23	192.168.2.23	82.108.49.216
Aug 18, 2022 13:37:25.818170071 CEST	19226	23	192.168.2.23	66.224.150.235
Aug 18, 2022 13:37:25.818173885 CEST	19226	23	192.168.2.23	78.135.91.110
Aug 18, 2022 13:37:25.818176031 CEST	19226	23	192.168.2.23	145.171.213.95
Aug 18, 2022 13:37:25.818177938 CEST	19226	23	192.168.2.23	150.17.182.36
Aug 18, 2022 13:37:25.818178892 CEST	19226	23	192.168.2.23	221.124.22.161
Aug 18, 2022 13:37:25.818180084 CEST	19226	23	192.168.2.23	146.175.19.198
Aug 18, 2022 13:37:25.818185091 CEST	19226	23	192.168.2.23	20.246.77.7
Aug 18, 2022 13:37:25.818186998 CEST	19226	23	192.168.2.23	43.221.10.124
Aug 18, 2022 13:37:25.818190098 CEST	19226	23	192.168.2.23	174.160.63.5
Aug 18, 2022 13:37:25.818192005 CEST	19226	23	192.168.2.23	194.184.162.87
Aug 18, 2022 13:37:25.818193913 CEST	19226	23	192.168.2.23	205.170.187.30
Aug 18, 2022 13:37:25.818197966 CEST	19226	23	192.168.2.23	217.77.156.100
Aug 18, 2022 13:37:25.818201065 CEST	19226	23	192.168.2.23	156.170.107.214
Aug 18, 2022 13:37:25.818202019 CEST	19226	23	192.168.2.23	34.42.187.194
Aug 18, 2022 13:37:25.818205118 CEST	19226	23	192.168.2.23	53.183.242.65
Aug 18, 2022 13:37:25.818207979 CEST	19226	23	192.168.2.23	114.237.215.50
Aug 18, 2022 13:37:25.818211079 CEST	19226	23	192.168.2.23	193.145.196.225
Aug 18, 2022 13:37:25.818214893 CEST	19226	23	192.168.2.23	105.133.191.240
Aug 18, 2022 13:37:25.818217039 CEST	19226	23	192.168.2.23	43.42.51.249
Aug 18, 2022 13:37:25.818218946 CEST	19226	23	192.168.2.23	198.12.4.116
Aug 18, 2022 13:37:25.818222046 CEST	19226	23	192.168.2.23	96.229.91.204
Aug 18, 2022 13:37:25.818224907 CEST	19226	23	192.168.2.23	48.237.243.144
Aug 18, 2022 13:37:25.818226099 CEST	19226	2323	192.168.2.23	209.62.53.238
Aug 18, 2022 13:37:25.818228006 CEST	19226	23	192.168.2.23	135.16.28.55
Aug 18, 2022 13:37:25.818231106 CEST	19226	23	192.168.2.23	134.148.61.28
Aug 18, 2022 13:37:25.818233013 CEST	19226	23	192.168.2.23	66.19.5.2
Aug 18, 2022 13:37:25.818236113 CEST	19226	23	192.168.2.23	166.209.26.217
Aug 18, 2022 13:37:25.818237066 CEST	19226	23	192.168.2.23	83.115.139.158
Aug 18, 2022 13:37:25.818239927 CEST	19226	23	192.168.2.23	161.158.15.123
Aug 18, 2022 13:37:25.818242073 CEST	19226	23	192.168.2.23	109.54.2.187
Aug 18, 2022 13:37:25.818243980 CEST	19226	23	192.168.2.23	210.133.139.218
Aug 18, 2022 13:37:25.818248034 CEST	19226	23	192.168.2.23	218.20.181.197
Aug 18, 2022 13:37:25.818248987 CEST	19226	23	192.168.2.23	213.98.68.86
Aug 18, 2022 13:37:25.818253040 CEST	19226	23	192.168.2.23	129.198.156.183
Aug 18, 2022 13:37:25.818253994 CEST	19226	23	192.168.2.23	116.220.190.123
Aug 18, 2022 13:37:25.818257093 CEST	19226	23	192.168.2.23	54.213.204.112
Aug 18, 2022 13:37:25.818259954 CEST	19226	2323	192.168.2.23	47.170.201.21
Aug 18, 2022 13:37:25.818262100 CEST	19226	23	192.168.2.23	206.103.162.120
Aug 18, 2022 13:37:25.818264961 CEST	19226	23	192.168.2.23	75.199.7.29
Aug 18, 2022 13:37:25.818268061 CEST	19226	23	192.168.2.23	86.204.150.122
Aug 18, 2022 13:37:25.818269014 CEST	19226	23	192.168.2.23	209.127.248.254
Aug 18, 2022 13:37:25.818273067 CEST	19226	23	192.168.2.23	177.212.205.207
Aug 18, 2022 13:37:25.818275928 CEST	19226	23	192.168.2.23	54.114.191.16
Aug 18, 2022 13:37:25.818276882 CEST	19226	23	192.168.2.23	63.218.10.52
Aug 18, 2022 13:37:25.818279028 CEST	19226	23	192.168.2.23	213.177.141.86
Aug 18, 2022 13:37:25.818279982 CEST	19226	2323	192.168.2.23	197.63.75.172
Aug 18, 2022 13:37:25.818288088 CEST	19226	23	192.168.2.23	13.145.3.28
Aug 18, 2022 13:37:25.818289995 CEST	19226	23	192.168.2.23	197.138.255.77
Aug 18, 2022 13:37:25.818293095 CEST	19226	23	192.168.2.23	120.97.70.27
Aug 18, 2022 13:37:25.818295002 CEST	19226	2323	192.168.2.23	54.77.211.82
Aug 18, 2022 13:37:25.818295956 CEST	19226	23	192.168.2.23	109.132.142.161
Aug 18, 2022 13:37:25.818298101 CEST	19226	2323	192.168.2.23	181.60.235.188
Aug 18, 2022 13:37:25.818300009 CEST	19226	23	192.168.2.23	157.233.100.177
Aug 18, 2022 13:37:25.818305016 CEST	19226	23	192.168.2.23	191.141.6.152
Aug 18, 2022 13:37:25.818305969 CEST	19226	23	192.168.2.23	201.35.239.237
Aug 18, 2022 13:37:25.818306923 CEST	19226	23	192.168.2.23	23.135.70.84
Aug 18, 2022 13:37:25.818310022 CEST	19226	23	192.168.2.23	2.29.10.9
Aug 18, 2022 13:37:25.818311930 CEST	19226	23	192.168.2.23	2.240.210.131
Aug 18, 2022 13:37:25.818312883 CEST	19226	23	192.168.2.23	120.144.5.64
Aug 18, 2022 13:37:25.818320990 CEST	19226	23	192.168.2.23	89.36.84.208
Aug 18, 2022 13:37:25.818322897 CEST	19226	23	192.168.2.23	216.27.235.211
Aug 18, 2022 13:37:25.818329096 CEST	19226	23	192.168.2.23	66.195.37.16
Aug 18, 2022 13:37:25.818331957 CEST	19226	23	192.168.2.23	196.62.122.222
Aug 18, 2022 13:37:25.818334103 CEST	19226	23	192.168.2.23	153.92.236.16
Aug 18, 2022 13:37:25.818341017 CEST	19226	23	192.168.2.23	204.59.177.226
Aug 18, 2022 13:37:25.818342924 CEST	19226	23	192.168.2.23	123.206.28.15
Aug 18, 2022 13:37:25.818348885 CEST	19226	23	192.168.2.23	216.19.182.206
Aug 18, 2022 13:37:25.818351984 CEST	19226	23	192.168.2.23	161.114.207.133
Aug 18, 2022 13:37:25.818360090 CEST	19226	2323	192.168.2.23	133.102.156.126
Aug 18, 2022 13:37:25.818367004 CEST	19226	23	192.168.2.23	121.88.226.46
Aug 18, 2022 13:37:25.818372965 CEST	19226	23	192.168.2.23	89.127.38.165
Aug 18, 2022 13:37:25.818381071 CEST	19226	23	192.168.2.23	60.222.30.251
Aug 18, 2022 13:37:25.818387032 CEST	19226	23	192.168.2.23	202.51.101.224
Aug 18, 2022 13:37:25.818394899 CEST	19226	23	192.168.2.23	129.60.58.97
Aug 18, 2022 13:37:25.818402052 CEST	19226	23	192.168.2.23	136.220.226.243
Aug 18, 2022 13:37:26.006537914 CEST	23	19226	205.170.187.30	192.168.2.23
Aug 18, 2022 13:37:26.012392998 CEST	23	19226	104.145.252.74	192.168.2.23
Aug 18, 2022 13:37:26.012469053 CEST	19226	23	192.168.2.23	104.145.252.74
Aug 18, 2022 13:37:26.051337004 CEST	23	19226	200.160.40.247	192.168.2.23
Aug 18, 2022 13:37:26.155843019 CEST	42836	443	192.168.2.23	91.189.91.43
Aug 18, 2022 13:37:26.923803091 CEST	42516	80	192.168.2.23	109.202.202.202
Aug 18, 2022 13:37:40.747102022 CEST	43928	443	192.168.2.23	91.189.91.42
Aug 18, 2022 13:37:53.034486055 CEST	42836	443	192.168.2.23	91.189.91.43
Aug 18, 2022 13:37:57.130131960 CEST	42516	80	192.168.2.23	109.202.202.202
Aug 18, 2022 13:38:21.704921007 CEST	43928	443	192.168.2.23	91.189.91.42

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 18, 2022 13:37:25.817225933 CEST	52283	53	192.168.2.23	8.8.8.8
Aug 18, 2022 13:37:26.152798891 CEST	53	52283	8.8.8.8	192.168.2.23

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 18, 2022 13:37:25.876559973 CEST	185.188.130.1	192.168.2.23	69ce	(Host unreachable)	Destination Unreachable
Aug 18, 2022 13:37:25.964517117 CEST	104.202.158.38	192.168.2.23	c6bd	(Unknown)	Destination Unreachable
Aug 18, 2022 13:37:26.153068066 CEST	192.168.2.23	8.8.8.8	d016	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 18, 2022 13:37:25.817225933 CEST	192.168.2.23	8.8.8.8	0xe68a	Standard query (0)	cnc.condinet.cf	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 18, 2022 13:37:26.152798891 CEST	8.8.8.8	192.168.2.23	0xe68a	No error (0)	cnc.condinet.cf		141.98.6.110	A (IP address)	IN (0x0001)

System Behavior

Analysis Process: skid.x86_64-20220818-1128 PID: 6232, Parent PID: 6125

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/tmp/skid.x86_64-20220818-1128
Arguments:	/tmp/skid.x86_64-20220818-1128
File size:	71488 bytes
MD5 hash:	e9adcff07098778702315e9450e0d8c5

File Activities

File Opened

Process Activities

Process Forked

Prctl Requested

Network Activities

Socket starts Listening

Chronological Activities

Analysis Process: skid.x86_64-20220818-1128 PID: 6233, Parent PID: 6232

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/tmp/skid.x86_64-20220818-1128
Arguments:	n/a
File size:	71488 bytes
MD5 hash:	e9adcff07098778702315e9450e0d8c5

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Signal sent

Chronological Activities

Analysis Process: skid.x86_64-20220818-1128 PID: 6234, Parent PID: 6232

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/tmp/skid.x86_64-20220818-1128
Arguments:	n/a
File size:	71488 bytes
MD5 hash:	e9adcff07098778702315e9450e0d8c5

Process Activities

Process Overlayed (Execve)

Chronological Activities

Analysis Process: sh PID: 6234, Parent PID: 6232

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/bin/sh
Arguments:	sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/skid.x86_64-20220818-1128 bin/systemd; chmod 777 bin/systemd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6235, Parent PID: 6234

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Execve)

Chronological Activities

Analysis Process: rm PID: 6235, Parent PID: 6234

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/usr/bin/rm
Arguments:	rm -rf bin/systemd
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: sh PID: 6236, Parent PID: 6234

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Execve)

Chronological Activities

Analysis Process: mkdir PID: 6236, Parent PID: 6234

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/usr/bin/mkdir
Arguments:	mkdir bin
File size:	88408 bytes
MD5 hash:	088c9d1df5a28ed16c726eca15964cb7

File Activities

File Opened

File Read

Directory Created

Chronological Activities

Analysis Process: sh PID: 6237, Parent PID: 6234

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Execve)

Chronological Activities

Analysis Process: mv PID: 6237, Parent PID: 6234

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/usr/bin/mv
Arguments:	mv /tmp/skid.x86_64-20220818-1128 bin/systemd
File size:	149888 bytes
MD5 hash:	504f0590fa482d4da070a702260e3716

File Activities

File Opened

File Read

File Moved

Chronological Activities

Analysis Process: sh PID: 6238, Parent PID: 6234

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Execve)

Chronological Activities

Analysis Process: chmod PID: 6238, Parent PID: 6234

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/usr/bin/chmod
Arguments:	chmod 777 bin/systemd
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: skid.x86_64-20220818-1128 PID: 6239, Parent PID: 6232

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/tmp/skid.x86_64-20220818-1128
Arguments:	n/a
File size:	71488 bytes
MD5 hash:	e9adcff07098778702315e9450e0d8c5

Process Activities

Process Forked

Chronological Activities

Analysis Process: skid.x86_64-20220818-1128 PID: 6240, Parent PID: 6239

General

Start time:	13:37:24
Start date:	18/08/2022
Path:	/tmp/skid.x86_64-20220818-1128
Arguments:	n/a
File size:	71488 bytes
MD5 hash:	e9adcff07098778702315e9450e0d8c5

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report skid.x86_64-20220818-1128

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: skid.x86_64-20220818-1128 PID: 6232, Parent PID: 6125

General

File Activities

File Opened

Process Activities

Process Forked

Prctl Requested

Network Activities

Socket starts Listening

Chronological Activities

Analysis Process: skid.x86_64-20220818-1128 PID: 6233, Parent PID: 6232

General

File Activities

File Opened

File Read

Directory Enumerated

Process Activities

Signal sent

Chronological Activities

Linux Analysis Report
skid.x86_64-20220818-1128