Edit tour

Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1527390
MD5:	03315a01e907cc10d5f06b699a5ae938
SHA1:	663bffc724294aa972f7b0ff9f9856034c5579ab
SHA256:	bc48dd8c89abc933f063ecd04a2f3e1d713bf7c5a04e30ac8472a24ebdaa7208
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Okiru

Performs DNS queries to domains with low reputation

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527390
Start date and time:	2024-10-06 23:24:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	na.elf
Detection:	MAL
Classification:	mal92.troj.linELF@0/1025@105/0

Runtime Messages

Command:	/tmp/na.elf
PID:	5488
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

na.elf (PID: 5488, Parent: 5415, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/na.elf

na.elf New Fork (PID: 5491, Parent: 5488)

na.elf New Fork (PID: 5493, Parent: 5491)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
na.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
na.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
na.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
na.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1720c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1725c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1734c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5488.1.00007f1388017000.00007f1388031000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5488.1.00007f1388017000.00007f1388031000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5488.1.00007f1388017000.00007f1388031000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5488.1.00007f1388017000.00007f1388031000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x171bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x171f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1720c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1725c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1734c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: na.elf PID: 5488	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: na.elf PID: 5488	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5488	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: na.elf PID: 5488	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11b10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ca0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: na.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: na.elf

ReversingLabs: Detection: 65%

Source: na.elf

String: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz
Source:	DNS query: nianlun-vps.xyz

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5488.1.00007f1388017000.00007f1388031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: na.elf PID: 5488, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKtop1hbt.armtop1hbt.arm5top1hbt.arm6top1hbt.arm7top1hbt.mipstop1hbt.mpsltop1hbt.x86_64top1hbt.sh4/proc/proc/%d/cmdlinenetstatwgetcurlbusybox/bin/busybox/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ3f

Source: /tmp/na.elf (PID: 5493)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/3637/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/816/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5493)	File opened: /proc/35/cmdline	Jump to behavior

Source: na.elf, 5488.1.00007ffccbeb8000.00007ffccbed9000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5488.1.000055a9c0995000.000055a9c0ae5000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: na.elf, 5488.1.000055a9c0995000.000055a9c0ae5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: na.elf, 5488.1.00007ffccbeb8000.00007ffccbed9000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5488.1.00007f1388017000.00007f1388031000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5488, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Source	Detection	Scanner	Label	Link
na.elf	66%	ReversingLabs	Linux.Backdoor.Mirai
na.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Process:	/tmp/na.elf
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:TgBDln:TgB5
MD5:	951B267BD5360B4C3CA7BACED8A2634A
SHA1:	6BAC6446FDB84BF0060C4DA5ECB10F2C264B1F03
SHA-256:	8DD8E1A24B09832D24EDEC43CEF017CE5AAD2CB185367A22AE07A1055C70C6F8
SHA-512:	21F810040E835A5A8BE3614E8252009D92CDA9FAA2D22A34DFDDA15B07CF82171AA4B815BB6F023B2160071727CECF4FCDC09C6E3E6A5333CE11D22A010BEB10
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/na.elf.

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.968511645609119
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	na.elf
File size:	179'821 bytes
MD5:	03315a01e907cc10d5f06b699a5ae938
SHA1:	663bffc724294aa972f7b0ff9f9856034c5579ab
SHA256:	bc48dd8c89abc933f063ecd04a2f3e1d713bf7c5a04e30ac8472a24ebdaa7208
SHA512:	ca5fe04ef93cded76241e6c4254026d83adcac46afc1a07a84623424a681a9ce0d32fb463b7db3fb8c54d60106f789a780b75a8087605fe8d740864330b8426b
SSDEEP:	3072:uk/uc4NbBLbcBCkoajwdyqkk4/T/6EBp3u/hJjogM/RkWT+M:uk/MBLbEloajwdybkwRBFu/XMgM/RkWL
TLSH:	10042A46EA404B13C0D627B5F6DF42453333ABA497EB73069628ABF43F8679E4F22505
File Content Preview:	.ELF..............(.........4...........4. ...(........p............p...p................................................................V..........................................Q.td..................................-...L..................@-.,@...0....S

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5488.1.00007f1388017000.00007f1388031000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5488, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	138472
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x16fdc	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1f0cc	0x170cc	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1f0e0	0x170e0	0x21a8	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x21288	0x19288	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x212a0	0x192a0	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x29410	0x19410	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x29414	0x19414	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x29418	0x19418	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x29418	0x19418	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2941c	0x1941c	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x29420	0x19420	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x29424	0x19424	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x294e4	0x194e4	0x2f4	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x297d8	0x197d8	0x5304	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x197d8	0xea4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1a680	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1a7e0	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1aa1e	0x29df	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1d3fd	0x986	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1dd83	0x10da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1ee60	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1f19c	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1fc58	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x21482	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x21bb2	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x21bc8	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x22198	0x64d0	0x10	0x0		29	931	4
.strtab	STRTAB	0x0	0x28668	0x3805	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x192a0	0x212a0	0x212a0	0x170	0x170	4.6993	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x19410	0x19410	6.1230	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x19410	0x29410	0x29410	0x3c8	0x56cc	4.3235	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x19414	0x29414	0x29414	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 6, 2024 23:25:24.506690979 CEST	60122	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:24.513588905 CEST	53	60122	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:24.514758110 CEST	55259	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:24.524233103 CEST	53	55259	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:24.530064106 CEST	40452	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:24.537182093 CEST	53	40452	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:24.544614077 CEST	50631	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:24.550878048 CEST	53	50631	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:24.552750111 CEST	59647	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:24.559657097 CEST	53	59647	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:25.569786072 CEST	53278	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:25.576385975 CEST	53	53278	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:25.589442015 CEST	58073	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:25.596117020 CEST	53	58073	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:25.603498936 CEST	36940	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:25.610955954 CEST	53	36940	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:25.614545107 CEST	55635	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:25.622147083 CEST	53	55635	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:25.639508009 CEST	52763	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:25.646475077 CEST	53	52763	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:35.655306101 CEST	49017	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:35.662730932 CEST	53	49017	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:35.663594961 CEST	45866	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:35.670815945 CEST	53	45866	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:35.672409058 CEST	36560	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:35.678992987 CEST	53	36560	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:35.679832935 CEST	42470	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:35.686903000 CEST	53	42470	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:35.687884092 CEST	58854	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:35.695674896 CEST	53	58854	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:43.697987080 CEST	50498	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:43.705528021 CEST	53	50498	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:43.706214905 CEST	42598	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:43.713076115 CEST	53	42598	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:43.714610100 CEST	38803	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:43.720899105 CEST	53	38803	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:43.721678972 CEST	43293	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:43.728859901 CEST	53	43293	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:43.729542971 CEST	51117	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:43.736675024 CEST	53	51117	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:45.740111113 CEST	38568	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:45.746653080 CEST	53	38568	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:45.749408960 CEST	51077	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:45.756285906 CEST	53	51077	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:45.758538008 CEST	39816	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:45.765832901 CEST	53	39816	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:45.767154932 CEST	49106	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:45.773552895 CEST	53	49106	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:45.775461912 CEST	50299	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:45.781533003 CEST	53	50299	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:54.784945965 CEST	42179	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:54.792424917 CEST	53	42179	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:54.793086052 CEST	50932	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:54.799211979 CEST	53	50932	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:54.799884081 CEST	54059	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:54.806288004 CEST	53	54059	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:54.806974888 CEST	56612	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:54.813663006 CEST	53	56612	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:54.814353943 CEST	43931	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:54.820661068 CEST	53	43931	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:57.823657036 CEST	34489	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:57.977250099 CEST	53	34489	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:57.978795052 CEST	52250	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:57.985929966 CEST	53	52250	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:57.987268925 CEST	52570	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:57.994178057 CEST	53	52570	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:57.995381117 CEST	48390	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:58.002820015 CEST	53	48390	8.8.8.8	192.168.2.13
Oct 6, 2024 23:25:58.003705025 CEST	48510	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:25:58.010741949 CEST	53	48510	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:03.015232086 CEST	37481	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:03.022083044 CEST	53	37481	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:03.022770882 CEST	57217	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:03.029114962 CEST	53	57217	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:03.029721022 CEST	54834	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:03.035784960 CEST	53	54834	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:03.036385059 CEST	51945	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:03.042905092 CEST	53	51945	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:03.043615103 CEST	58901	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:03.050034046 CEST	53	58901	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:08.052490950 CEST	33061	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:08.059576035 CEST	53	33061	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:08.060209036 CEST	53135	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:08.067331076 CEST	53	53135	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:08.068001032 CEST	33630	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:08.075372934 CEST	53	33630	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:08.076179028 CEST	54790	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:08.082587957 CEST	53	54790	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:08.083472967 CEST	54055	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:08.089768887 CEST	53	54055	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:18.093502045 CEST	42524	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:18.100281954 CEST	53	42524	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:18.101619005 CEST	45340	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:18.108736038 CEST	53	45340	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:18.109935999 CEST	34807	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:18.116514921 CEST	53	34807	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:18.117676020 CEST	50749	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:18.124558926 CEST	53	50749	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:18.125781059 CEST	50324	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:18.131994963 CEST	53	50324	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:22.136609077 CEST	40946	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:22.143846035 CEST	53	40946	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:22.144948006 CEST	60399	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:22.151971102 CEST	53	60399	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:22.153196096 CEST	59689	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:22.160247087 CEST	53	59689	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:22.161050081 CEST	55884	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:22.167491913 CEST	53	55884	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:22.168294907 CEST	60878	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:22.175174952 CEST	53	60878	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:28.178675890 CEST	59029	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:28.188847065 CEST	53	59029	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:28.190320969 CEST	35570	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:28.197803020 CEST	53	35570	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:28.199074984 CEST	42620	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:28.207511902 CEST	53	42620	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:28.208710909 CEST	34035	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:28.215840101 CEST	53	34035	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:28.217195988 CEST	45621	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:28.225507975 CEST	53	45621	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:37.229775906 CEST	48576	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:37.237654924 CEST	53	48576	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:37.238929033 CEST	35919	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:37.245770931 CEST	53	35919	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:37.246843100 CEST	50362	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:37.253973007 CEST	53	50362	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:37.255198956 CEST	35956	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:37.262684107 CEST	53	35956	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:37.263933897 CEST	53440	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:37.272753000 CEST	53	53440	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:46.276838064 CEST	38026	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:46.284621000 CEST	53	38026	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:46.286000967 CEST	37305	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:46.292813063 CEST	53	37305	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:46.294110060 CEST	38910	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:46.301455021 CEST	53	38910	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:46.303069115 CEST	39666	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:46.310681105 CEST	53	39666	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:46.312437057 CEST	49067	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:46.319889069 CEST	53	49067	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:54.324383020 CEST	55102	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:54.331167936 CEST	53	55102	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:54.332730055 CEST	41874	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:54.339517117 CEST	53	41874	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:54.341002941 CEST	57236	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:54.347691059 CEST	53	57236	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:54.349136114 CEST	37394	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:54.356117964 CEST	53	37394	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:54.358036041 CEST	53901	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:54.365132093 CEST	53	53901	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:58.370039940 CEST	47063	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:58.377549887 CEST	53	47063	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:58.378820896 CEST	33806	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:58.386045933 CEST	53	33806	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:58.387095928 CEST	53889	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:58.394030094 CEST	53	53889	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:58.395095110 CEST	46639	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:58.402240038 CEST	53	46639	8.8.8.8	192.168.2.13
Oct 6, 2024 23:26:58.403340101 CEST	51051	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:26:58.410630941 CEST	53	51051	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:00.413883924 CEST	37560	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:00.421545982 CEST	53	37560	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:00.422461033 CEST	41628	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:00.429208994 CEST	53	41628	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:00.430074930 CEST	60751	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:00.436856985 CEST	53	60751	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:00.437778950 CEST	40573	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:00.444590092 CEST	53	40573	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:00.445559025 CEST	35681	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:00.452450991 CEST	53	35681	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:10.456079960 CEST	53818	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:10.499603033 CEST	53	53818	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:10.501007080 CEST	36045	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:10.508485079 CEST	53	36045	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:10.509711027 CEST	58810	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:10.517678976 CEST	53	58810	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:10.518992901 CEST	43947	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:10.527312994 CEST	53	43947	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:10.528625965 CEST	49952	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:10.566262960 CEST	53	49952	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:15.570597887 CEST	50827	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:15.577409983 CEST	53	50827	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:15.578546047 CEST	38031	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:15.585580111 CEST	53	38031	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:15.586724997 CEST	54348	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:15.594501019 CEST	53	54348	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:15.595623970 CEST	51971	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:15.602653980 CEST	53	51971	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:15.603517056 CEST	51129	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:15.610846996 CEST	53	51129	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:25.614358902 CEST	57240	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:25.626173973 CEST	53	57240	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:25.627789021 CEST	34532	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:25.664674997 CEST	53	34532	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:25.666018009 CEST	32996	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:25.674247980 CEST	53	32996	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:25.675458908 CEST	35993	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:25.682892084 CEST	53	35993	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:25.684118986 CEST	60817	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:25.691602945 CEST	53	60817	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:27.694709063 CEST	52964	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:27.712788105 CEST	53	52964	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:27.713680983 CEST	59983	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:27.721668959 CEST	53	59983	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:27.722245932 CEST	55724	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:27.730259895 CEST	53	55724	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:27.731079102 CEST	35378	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:27.738666058 CEST	53	35378	8.8.8.8	192.168.2.13
Oct 6, 2024 23:27:27.739515066 CEST	58837	53	192.168.2.13	8.8.8.8
Oct 6, 2024 23:27:27.747586012 CEST	53	58837	8.8.8.8	192.168.2.13

Start time (UTC):	21:25:23
Start date (UTC):	06/10/2024
Path:	/tmp/na.elf
Arguments:	/tmp/na.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.04qvkx (deleted)

/tmp/qemu-open.09wRLw (deleted)

/tmp/qemu-open.0FBoqx (deleted)

/tmp/qemu-open.0Of1zz (deleted)

/tmp/qemu-open.0YrvLA (deleted)

/tmp/qemu-open.0amVhx (deleted)

/tmp/qemu-open.0f9UZz (deleted)

/tmp/qemu-open.0w6gFw (deleted)

/tmp/qemu-open.0yHyGw (deleted)

/tmp/qemu-open.10upwA (deleted)

/tmp/qemu-open.1209uy (deleted)

/tmp/qemu-open.180TIy (deleted)

/tmp/qemu-open.1894qy (deleted)

/tmp/qemu-open.18AhiA (deleted)

/tmp/qemu-open.1ArD1z (deleted)

/tmp/qemu-open.1DPECz (deleted)

/tmp/qemu-open.1FSeiw (deleted)

/tmp/qemu-open.1I9uSw (deleted)

/tmp/qemu-open.1JDhOA (deleted)

/tmp/qemu-open.1M2Y3y (deleted)

/tmp/qemu-open.1ROFFA (deleted)

/tmp/qemu-open.1VkHCA (deleted)

/tmp/qemu-open.1Xkb5x (deleted)

/tmp/qemu-open.1ZRNlz (deleted)

/tmp/qemu-open.1kddfA (deleted)

/tmp/qemu-open.1xebXx (deleted)

/tmp/qemu-open.24MxKw (deleted)

/tmp/qemu-open.28c2LA (deleted)

/tmp/qemu-open.2AfiZy (deleted)

/tmp/qemu-open.2D7Y2x (deleted)

/tmp/qemu-open.2DbJfz (deleted)

Linux Analysis Report
na.elf

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre