Source: na.elf, type: SAMPLE |
Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 5673.1.00007f59dc001000.00007f59dc013000.r-x.sdmp, type: MEMORY |
Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 5671.1.00007f59dc001000.00007f59dc013000.r-x.sdmp, type: MEMORY |
Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 5477.1.00007f59dc001000.00007f59dc013000.r-x.sdmp, type: MEMORY |
Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 5540.1.00007f59dc001000.00007f59dc013000.r-x.sdmp, type: MEMORY |
Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5540/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3122/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3117/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3114/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3631/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5655/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5656/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5657/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/914/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5539/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/917/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3134/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3375/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3132/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3095/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1745/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1866/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1588/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/884/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1982/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/765/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3246/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/767/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/800/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1906/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/802/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/803/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1748/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3420/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1482/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/490/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1480/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1755/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1875/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/2964/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3413/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1751/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1872/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/2961/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1475/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/778/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5313/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/936/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/816/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1879/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5573/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5574/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5575/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5454/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5576/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5455/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1891/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3310/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3153/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/780/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/660/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1921/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5607/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5608/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/783/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1765/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5609/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/2974/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1400/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1884/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3424/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/2972/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3147/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/2970/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1881/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3146/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3300/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5600/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1805/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1925/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1804/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5603/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5604/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5605/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3429/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5606/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5580/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5581/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5582/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5583/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5584/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5585/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5586/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5587/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3442/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3165/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3164/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3163/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3162/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/790/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3161/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/792/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5618/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/793/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/5619/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1930/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/795/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/3315/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5480) |
File opened: /proc/1411/cmdline |
Jump to behavior |
Source: na.elf, 5477.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5540.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5671.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5673.1.0000560471340000.00005604713f0000.rw-.sdmp |
Binary or memory string: !/etc/qemu-binfmt/ppc1/usr/libexec/gsd-print-notifications1/proc/109/exe |
Source: na.elf, 5673.1.0000560471340000.00005604713f0000.rw-.sdmp |
Binary or memory string: /usr/bin/vmtoolsd |
Source: na.elf, 5477.1.00007ffc67652000.00007ffc67673000.rw-.sdmp, na.elf, 5540.1.00007ffc67652000.00007ffc67673000.rw-.sdmp, na.elf, 5671.1.00007ffc67652000.00007ffc67673000.rw-.sdmp, na.elf, 5673.1.00007ffc67652000.00007ffc67673000.rw-.sdmp |
Binary or memory string: %.x86_64/usr/bin/qemu-ppc/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf |
Source: na.elf, 5477.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5540.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5671.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5673.1.0000560471340000.00005604713f0000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmtP |
Source: na.elf, 5477.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5540.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5671.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5673.1.0000560471340000.00005604713f0000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/ppc |
Source: na.elf, 5673.1.0000560471340000.00005604713f0000.rw-.sdmp |
Binary or memory string: !/proc/765/exe0!/proc/418/exe1/proc/1320/exe/ppc/ro10!/usr/bin/vmtoolsd!/proc/419/exe1/usr/libexec/gsd-printer |
Source: na.elf, 5477.1.00007ffc67652000.00007ffc67673000.rw-.sdmp, na.elf, 5540.1.00007ffc67652000.00007ffc67673000.rw-.sdmp, na.elf, 5671.1.00007ffc67652000.00007ffc67673000.rw-.sdmp, na.elf, 5673.1.00007ffc67652000.00007ffc67673000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-ppc |
Source: na.elf, 5477.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5540.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5671.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5673.1.0000560471340000.00005604713f0000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmtP@/usr/libexec/gvfs-udisks2-volume-monitorQ@ |