Create Interactive Tour

Linux Analysis Report
gjsoX84ZOy.elf

Overview

General Information

Sample Name:	gjsoX84ZOy.elf
Original Sample Name:	b59bf2d6b87182b922918f2939b42ba7.elf
Analysis ID:	843703
MD5:	b59bf2d6b87182b922918f2939b42ba7
SHA1:	fab0ed64dc9e857e4cab31b9f13b4e9ea8bf84c7
SHA256:	0bfd6dc12e7262cf7803a9d3f28e2a35932c61224200ed152e3eff1c3dc638d5
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Sample deletes itself

Contains symbols with names commonly found in malware

Yara signature match

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Sample and/or dropped files contains symbols with suspicious names

Sample listens on a socket

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	843703
Start date and time:	2023-04-09 05:24:28 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	gjsoX84ZOy.elf
Original Sample Name:	b59bf2d6b87182b922918f2939b42ba7.elf
Detection:	MAL
Classification:	mal64.troj.evad.linELF@0/1025@60/0

Runtime Messages

Command:	/tmp/gjsoX84ZOy.elf
PID:	6220
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	unstable_is_the_history_of_universe
Standard Error:

Process Tree

system is lnxubuntu20

gjsoX84ZOy.elf (PID: 6220, Parent: 6122, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/gjsoX84ZOy.elf

gjsoX84ZOy.elf New Fork (PID: 6223, Parent: 6220)

gjsoX84ZOy.elf New Fork (PID: 6225, Parent: 6223)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
gjsoX84ZOy.elf	MAL_ARM_LNX_Mirai_Mar13_2022	Detects new ARM Mirai variant	Mehmet Ali Kerimoglu a.k.a. CYB3RMX	0x1f020:$attck1: attack.c 0x1f05e:$attck3: anti_gdb_entry 0x1f06d:$attck4: resolve_cnc_addr 0x1ffcd:$attck7: attack_get_opt_ip
gjsoX84ZOy.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Matched rule: MAL_ARM_LNX_Mirai_Mar13_2022 date = 2022-03-16, hash1 = 0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68, author = Mehmet Ali Kerimoglu a.k.a. CYB3RMX, description = Detects new ARM Mirai variant

Source: gjsoX84ZOy.elf	ReversingLabs: Detection: 35%
Source: gjsoX84ZOy.elf	Virustotal: Detection: 27%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20
Source: unknown	TCP traffic detected without corresponding DNS query: 175.30.53.20

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_ongoing
Source: ELF static info symbol of initial sample	Name: attack_parse
Source: ELF static info symbol of initial sample	Name: attack_start
Source: ELF static info symbol of initial sample	Name: attack_tcp.c
Source: ELF static info symbol of initial sample	Name: attack_tcp_ack

Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/6227/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1476/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/2208/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/1494/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/gjsoX84ZOy.elf (PID: 6225)	File opened: /proc/141/cmdline	Jump to behavior

Source: gjsoX84ZOy.elf, 6220.1.000055c02ad5b000.000055c02aeaa000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: gjsoX84ZOy.elf, 6220.1.00007ffd5c60a000.00007ffd5c62b000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/gjsoX84ZOy.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/gjsoX84ZOy.elf
Source: gjsoX84ZOy.elf, 6220.1.000055c02ad5b000.000055c02aeaa000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: gjsoX84ZOy.elf, 6220.1.00007ffd5c60a000.00007ffd5c62b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Source	Detection	Scanner	Label	Link
gjsoX84ZOy.elf	35%	ReversingLabs	Linux.Trojan.LnxMirai
gjsoX84ZOy.elf	28%	Virustotal		Browse

IP	Domain	Country	ASN	ASN Name	Malicious
175.30.53.20	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
175.30.53.20	skwXrj6q72.elf	Get hash	malicious	Unknown	Browse
	VqY324s7TO.elf	Get hash	malicious	Unknown	Browse
	1v1A4KluJp.elf	Get hash	malicious	Unknown	Browse
	fI2JqkDmZj.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	mUHdQA2jx4.elf	Get hash	malicious	Mirai	Browse
	bEERAy2ndo.elf	Get hash	malicious	Unknown	Browse
	fwesAGuDXW.elf	Get hash	malicious	Unknown	Browse
	6twRth92l2.elf	Get hash	malicious	Unknown	Browse
	NNrM3bFsRh.elf	Get hash	malicious	Unknown	Browse
	skwXrj6q72.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	6X1TKj3l6a.elf	Get hash	malicious	Mirai	Browse
	OihgLMKrgw.elf	Get hash	malicious	Unknown	Browse
	VqY324s7TO.elf	Get hash	malicious	Unknown	Browse
	qaseCMqiuX.elf	Get hash	malicious	Unknown	Browse
	1v1A4KluJp.elf	Get hash	malicious	Unknown	Browse
	9ZcgGyJ1OM.elf	Get hash	malicious	Mirai	Browse
	pcSz3OTPYD.elf	Get hash	malicious	Unknown	Browse
	ih44HzLp3c.elf	Get hash	malicious	Moobot	Browse
	fI2JqkDmZj.elf	Get hash	malicious	Unknown	Browse
	ePpQF34d0C.elf	Get hash	malicious	Unknown	Browse
	hQVAkw7MD4.elf	Get hash	malicious	Unknown	Browse
	sXdPVMGm43.elf	Get hash	malicious	Mirai	Browse
	nqGr6Yfhbk.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	mUHdQA2jx4.elf	Get hash	malicious	Mirai	Browse
	JtFbO2RoJC.elf	Get hash	malicious	Unknown	Browse
	bEERAy2ndo.elf	Get hash	malicious	Unknown	Browse
	fwesAGuDXW.elf	Get hash	malicious	Unknown	Browse
	6twRth92l2.elf	Get hash	malicious	Unknown	Browse
	NNrM3bFsRh.elf	Get hash	malicious	Unknown	Browse
	skwXrj6q72.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	6X1TKj3l6a.elf	Get hash	malicious	Mirai	Browse
	OihgLMKrgw.elf	Get hash	malicious	Unknown	Browse
	VqY324s7TO.elf	Get hash	malicious	Unknown	Browse
	qaseCMqiuX.elf	Get hash	malicious	Unknown	Browse
	1v1A4KluJp.elf	Get hash	malicious	Unknown	Browse
	9ZcgGyJ1OM.elf	Get hash	malicious	Mirai	Browse
	pcSz3OTPYD.elf	Get hash	malicious	Unknown	Browse
	ih44HzLp3c.elf	Get hash	malicious	Moobot	Browse
	fI2JqkDmZj.elf	Get hash	malicious	Unknown	Browse
	ePpQF34d0C.elf	Get hash	malicious	Unknown	Browse
	hQVAkw7MD4.elf	Get hash	malicious	Unknown	Browse
	sXdPVMGm43.elf	Get hash	malicious	Mirai	Browse

Process:	/tmp/gjsoX84ZOy.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:TgMWKt2ln:TgMWKEl
MD5:	4802E7B58EEE4A116C9F8B2454647A52
SHA1:	8538621227B865C873E2EC5CF1A2E9C7E4A18C5D
SHA-256:	21285682FC9438D8F102507023E8F6EEF3E3E783F5B4AB236FE478F6BD03BC0B
SHA-512:	C38C076A148B1359A0401175B628B98080C7225208D8C0FBA0886A642C2265A758229FF422AA327FF137C21C0A8DB51A3A48E712517485654CD18CCFCA4D44B1
Malicious:	false
Reputation:	low
Preview:	/tmp/gjsoX84ZOy.elf.

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.9191294781774495
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	gjsoX84ZOy.elf
File size:	137251
MD5:	b59bf2d6b87182b922918f2939b42ba7
SHA1:	fab0ed64dc9e857e4cab31b9f13b4e9ea8bf84c7
SHA256:	0bfd6dc12e7262cf7803a9d3f28e2a35932c61224200ed152e3eff1c3dc638d5
SHA512:	c4d40ca1a0127cd9f3de1cc5a339a87941665c361930bd191001f47fd01b6d8cf1407d4403f3f76fd7b71bad776a81c1dfbb2edc80110ab07c38e3df2abd9e53
SSDEEP:	3072:22YYn+j6necra+FAKYoF1PtlN37cJzy4gM/9wWbE8F:LYYn+enRra+FAKYovPFwJzy3M/9wWY8F
TLSH:	E4D32A56EB418A13C4D61776BADF424533239B5493DB73069928BFF43F827AE0E23606
File Content Preview:	.ELF..............(.........4...........4. ...(........p.,...............................................................0...0...0......\2...............0...0...0..................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x11a44	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x19b34	0x11b34	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x19b48	0x11b48	0x1188	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1acd0	0x12cd0	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1ace8	0x12ce8	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x23000	0x13000	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x23004	0x13004	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x23004	0x13004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x23008	0x13008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2300c	0x1300c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x23010	0x13010	0xac	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x230bc	0x130bc	0x208	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x232c4	0x132c4	0x2f98	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x132c4	0xb68	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x13e30	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x13f70	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x14183	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x161c6	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x168a8	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x17720	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x179d8	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x182a2	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x19431	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x19989	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1999f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x19f40	0x5020	0x10	0x0		28	730	4
.strtab	STRTAB	0x0	0x1ef60	0x28c3	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x12ce8	0x1ace8	0x1ace8	0x118	0x118	4.4214	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x12e00	0x12e00	6.0824	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x13000	0x23000	0x23000	0x2c4	0x325c	3.9335	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x13004	0x23004	0x23004	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 9, 2023 05:25:12.095940113 CEST	38338	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:13.105784893 CEST	38338	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:14.577730894 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 9, 2023 05:25:15.121939898 CEST	38338	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:15.345712900 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 9, 2023 05:25:19.189492941 CEST	38338	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:23.265626907 CEST	38340	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:24.273188114 CEST	38340	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:26.289074898 CEST	38340	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:29.424911976 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 9, 2023 05:25:30.448875904 CEST	38340	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:34.433420897 CEST	38342	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:35.440577030 CEST	38342	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:37.456466913 CEST	38342	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:41.716330051 CEST	38342	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:41.716330051 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 9, 2023 05:25:45.613291025 CEST	38344	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:45.808216095 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 9, 2023 05:25:46.640059948 CEST	38344	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:48.655911922 CEST	38344	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:52.719733000 CEST	38344	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:56.795676947 CEST	38346	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:57.807527065 CEST	38346	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:25:59.823353052 CEST	38346	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:03.983125925 CEST	38346	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:07.958823919 CEST	38348	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:08.974952936 CEST	38348	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:10.382812023 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 9, 2023 05:26:10.990772009 CEST	38348	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:15.250529051 CEST	38348	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:19.127727985 CEST	38350	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:20.142354012 CEST	38350	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:22.158144951 CEST	38350	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:26.253972054 CEST	38350	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:30.286747932 CEST	38352	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:31.309672117 CEST	38352	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:33.325545073 CEST	38352	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:37.517350912 CEST	38352	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:41.461810112 CEST	38354	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:42.477068901 CEST	38354	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:44.492975950 CEST	38354	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:48.524748087 CEST	38354	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:52.617095947 CEST	38356	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:53.644534111 CEST	38356	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:55.660403967 CEST	38356	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:26:59.788167953 CEST	38356	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:27:03.782383919 CEST	38358	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:27:04.811928988 CEST	38358	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:27:06.827778101 CEST	38358	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:27:11.051553965 CEST	38358	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:27:14.957285881 CEST	38360	23	192.168.2.23	175.30.53.20
Apr 9, 2023 05:27:15.979289055 CEST	38360	23	192.168.2.23	175.30.53.20

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 9, 2023 05:25:11.947498083 CEST	56078	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:11.977502108 CEST	53	56078	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:11.977968931 CEST	52432	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:12.007510900 CEST	53	52432	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:12.008083105 CEST	56425	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:12.044379950 CEST	53	56425	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:12.044555902 CEST	36901	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:12.073705912 CEST	53	36901	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:12.073971033 CEST	42799	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:12.095319986 CEST	53	42799	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:23.106245995 CEST	57755	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:23.133739948 CEST	53	57755	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:23.133954048 CEST	57879	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:23.161699057 CEST	53	57879	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:23.161942005 CEST	54777	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:23.198537111 CEST	53	54777	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:23.198748112 CEST	54859	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:23.235692024 CEST	53	54859	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:23.235846043 CEST	44320	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:23.265439034 CEST	53	44320	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:34.272866964 CEST	51642	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:34.306286097 CEST	53	51642	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:34.306463957 CEST	37699	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:34.333741903 CEST	53	37699	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:34.333911896 CEST	33216	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:34.370346069 CEST	53	33216	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:34.370512962 CEST	59345	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:34.406017065 CEST	53	59345	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:34.406187057 CEST	57495	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:34.433252096 CEST	53	57495	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:45.440298080 CEST	48511	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:45.477756977 CEST	53	48511	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:45.478028059 CEST	51147	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:45.508191109 CEST	53	51147	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:45.508450985 CEST	57373	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:45.544730902 CEST	53	57373	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:45.544985056 CEST	57775	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:45.582075119 CEST	53	57775	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:45.582284927 CEST	47486	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:45.613090992 CEST	53	47486	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:56.619910955 CEST	52593	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:56.649646044 CEST	53	52593	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:56.649925947 CEST	42625	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:56.685725927 CEST	53	42625	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:56.686026096 CEST	60429	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:56.725493908 CEST	53	60429	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:56.725742102 CEST	59616	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:56.765175104 CEST	53	59616	8.8.8.8	192.168.2.23
Apr 9, 2023 05:25:56.765423059 CEST	52289	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:25:56.795428991 CEST	53	52289	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:07.799227953 CEST	48976	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:07.826867104 CEST	53	48976	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:07.827099085 CEST	36680	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:07.848743916 CEST	53	36680	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:07.848987103 CEST	60777	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:07.886010885 CEST	53	60777	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:07.886248112 CEST	46050	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:07.922795057 CEST	53	46050	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:07.923062086 CEST	48673	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:07.958596945 CEST	53	48673	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:18.966603041 CEST	51975	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:19.004183054 CEST	53	51975	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:19.004416943 CEST	43952	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:19.031846046 CEST	53	43952	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:19.032059908 CEST	53233	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:19.068175077 CEST	53	53233	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:19.068377972 CEST	33072	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:19.097695112 CEST	53	33072	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:19.097974062 CEST	52447	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:19.127517939 CEST	53	52447	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:30.133944035 CEST	34741	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:30.161339998 CEST	53	34741	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:30.161823034 CEST	54750	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:30.189316034 CEST	53	54750	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:30.189440012 CEST	37112	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:30.219896078 CEST	53	37112	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:30.220025063 CEST	34927	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:30.249413013 CEST	53	34927	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:30.249526024 CEST	34660	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:30.286582947 CEST	53	34660	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:41.293318033 CEST	59859	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:41.320698977 CEST	53	59859	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:41.320892096 CEST	52386	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:41.348153114 CEST	53	52386	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:41.348315954 CEST	53542	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:41.385385036 CEST	53	53542	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:41.385584116 CEST	40261	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:41.422049999 CEST	53	40261	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:41.422239065 CEST	35068	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:41.461601019 CEST	53	35068	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:52.468839884 CEST	60528	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:52.505264044 CEST	53	60528	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:52.505511999 CEST	53062	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:52.533315897 CEST	53	53062	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:52.533535957 CEST	44208	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:52.561142921 CEST	53	44208	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:52.561331987 CEST	47126	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:52.588768005 CEST	53	47126	8.8.8.8	192.168.2.23
Apr 9, 2023 05:26:52.588987112 CEST	53463	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:26:52.616889954 CEST	53	53463	8.8.8.8	192.168.2.23
Apr 9, 2023 05:27:03.626933098 CEST	53077	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:27:03.656671047 CEST	53	53077	8.8.8.8	192.168.2.23
Apr 9, 2023 05:27:03.656977892 CEST	56504	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:27:03.678910017 CEST	53	56504	8.8.8.8	192.168.2.23
Apr 9, 2023 05:27:03.679141045 CEST	37420	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:27:03.708837986 CEST	53	37420	8.8.8.8	192.168.2.23
Apr 9, 2023 05:27:03.709095955 CEST	50976	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:27:03.745378971 CEST	53	50976	8.8.8.8	192.168.2.23
Apr 9, 2023 05:27:03.745621920 CEST	48793	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:27:03.782145977 CEST	53	48793	8.8.8.8	192.168.2.23
Apr 9, 2023 05:27:14.792191029 CEST	57419	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:27:14.820101023 CEST	53	57419	8.8.8.8	192.168.2.23
Apr 9, 2023 05:27:14.820363998 CEST	42536	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:27:14.856816053 CEST	53	42536	8.8.8.8	192.168.2.23
Apr 9, 2023 05:27:14.857003927 CEST	55726	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:27:14.888664007 CEST	53	55726	8.8.8.8	192.168.2.23
Apr 9, 2023 05:27:14.888863087 CEST	53260	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:27:14.926373005 CEST	53	53260	8.8.8.8	192.168.2.23
Apr 9, 2023 05:27:14.926590919 CEST	52576	53	192.168.2.23	8.8.8.8
Apr 9, 2023 05:27:14.957113981 CEST	53	52576	8.8.8.8	192.168.2.23

Start time:	05:25:11
Start date:	09/04/2023
Path:	/tmp/gjsoX84ZOy.elf
Arguments:	/tmp/gjsoX84ZOy.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report gjsoX84ZOy.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00panW (deleted)

/tmp/qemu-open.035wwT (deleted)

/tmp/qemu-open.06YGzW (deleted)

/tmp/qemu-open.09MtWS (deleted)

/tmp/qemu-open.0AJXaS (deleted)

/tmp/qemu-open.0FpzpT (deleted)

/tmp/qemu-open.0H5dpT (deleted)

/tmp/qemu-open.0MDe8V (deleted)

/tmp/qemu-open.0WrY2T (deleted)

/tmp/qemu-open.0dfZeT (deleted)

/tmp/qemu-open.0jvRoS (deleted)

/tmp/qemu-open.0lgKtT (deleted)

/tmp/qemu-open.0nM9YV (deleted)

/tmp/qemu-open.0oIG9S (deleted)

/tmp/qemu-open.0rnn9S (deleted)

/tmp/qemu-open.0xG1SU (deleted)

/tmp/qemu-open.10SUeU (deleted)

/tmp/qemu-open.1LnsvV (deleted)

/tmp/qemu-open.1OgBIS (deleted)

/tmp/qemu-open.1UbvuU (deleted)

/tmp/qemu-open.1WQueT (deleted)

/tmp/qemu-open.1XcS4U (deleted)

/tmp/qemu-open.1XxzVT (deleted)

/tmp/qemu-open.1aoEiT (deleted)

/tmp/qemu-open.1eTv2V (deleted)

/tmp/qemu-open.1hqD3R (deleted)

/tmp/qemu-open.1lPxNV (deleted)

/tmp/qemu-open.1pKxpV (deleted)

/tmp/qemu-open.1ur6aV (deleted)

/tmp/qemu-open.20rIdS (deleted)

/tmp/qemu-open.22NJ3U (deleted)

Linux Analysis Report
gjsoX84ZOy.elf

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre