Source: na.elf, type: SAMPLE | Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 5673.1.00007f59dc001000.00007f59dc013000.r-x.sdmp, type: MEMORY | Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 5671.1.00007f59dc001000.00007f59dc013000.r-x.sdmp, type: MEMORY | Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 5477.1.00007f59dc001000.00007f59dc013000.r-x.sdmp, type: MEMORY | Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: 5540.1.00007f59dc001000.00007f59dc013000.r-x.sdmp, type: MEMORY | Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5540/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3122/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3117/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3114/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3631/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5655/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5656/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5657/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/914/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5539/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/917/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3134/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3375/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3132/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3095/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1745/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1866/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1588/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/884/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1982/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/765/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3246/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/767/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/800/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1906/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/802/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/803/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1748/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3420/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1482/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/490/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1480/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1755/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1875/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/2964/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3413/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1751/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1872/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/2961/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1475/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/778/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5313/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/936/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/816/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1879/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5573/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5574/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5575/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5454/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5576/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5455/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1891/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3310/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3153/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/780/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/660/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1921/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5607/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5608/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/783/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1765/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5609/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/2974/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1400/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1884/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3424/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/2972/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3147/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/2970/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1881/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3146/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3300/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5600/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1805/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1925/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1804/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5603/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5604/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5605/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3429/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5606/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5580/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5581/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5582/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5583/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5584/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5585/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5586/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5587/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3442/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3165/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3164/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3163/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3162/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/790/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3161/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/792/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5618/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/793/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/5619/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1930/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/795/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/3315/cmdline | Jump to behavior |
Source: /tmp/na.elf (PID: 5480) | File opened: /proc/1411/cmdline | Jump to behavior |
Source: na.elf, 5477.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5540.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5671.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5673.1.0000560471340000.00005604713f0000.rw-.sdmp | Binary or memory string: !/etc/qemu-binfmt/ppc1/usr/libexec/gsd-print-notifications1/proc/109/exe |
Source: na.elf, 5673.1.0000560471340000.00005604713f0000.rw-.sdmp | Binary or memory string: /usr/bin/vmtoolsd |
Source: na.elf, 5477.1.00007ffc67652000.00007ffc67673000.rw-.sdmp, na.elf, 5540.1.00007ffc67652000.00007ffc67673000.rw-.sdmp, na.elf, 5671.1.00007ffc67652000.00007ffc67673000.rw-.sdmp, na.elf, 5673.1.00007ffc67652000.00007ffc67673000.rw-.sdmp | Binary or memory string: %.x86_64/usr/bin/qemu-ppc/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf |
Source: na.elf, 5477.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5540.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5671.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5673.1.0000560471340000.00005604713f0000.rw-.sdmp | Binary or memory string: /etc/qemu-binfmtP |
Source: na.elf, 5477.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5540.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5671.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5673.1.0000560471340000.00005604713f0000.rw-.sdmp | Binary or memory string: /etc/qemu-binfmt/ppc |
Source: na.elf, 5673.1.0000560471340000.00005604713f0000.rw-.sdmp | Binary or memory string: !/proc/765/exe0!/proc/418/exe1/proc/1320/exe/ppc/ro10!/usr/bin/vmtoolsd!/proc/419/exe1/usr/libexec/gsd-printer |
Source: na.elf, 5477.1.00007ffc67652000.00007ffc67673000.rw-.sdmp, na.elf, 5540.1.00007ffc67652000.00007ffc67673000.rw-.sdmp, na.elf, 5671.1.00007ffc67652000.00007ffc67673000.rw-.sdmp, na.elf, 5673.1.00007ffc67652000.00007ffc67673000.rw-.sdmp | Binary or memory string: /usr/bin/qemu-ppc |
Source: na.elf, 5477.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5540.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5671.1.0000560471340000.00005604713f0000.rw-.sdmp, na.elf, 5673.1.0000560471340000.00005604713f0000.rw-.sdmp | Binary or memory string: /etc/qemu-binfmtP@/usr/libexec/gvfs-udisks2-volume-monitorQ@ |