Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
dmips.elf

Overview

General Information

Sample name:dmips.elf
Analysis ID:1542860
MD5:18bb54f58aa90cc5d48968a0bf7970e1
SHA1:a4a833f63c054d223daf36bb0b492fe5c7093d03
SHA256:8398866a812765361d7e523bb66e7961f0c6fd191a42265d5c85b083fc993ea7
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected Mirai
Enumerates processes within the "proc" file system
Sample has stripped symbol table
Sample listens on a socket
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:41.0.0 Charoite
Analysis ID:1542860
Start date and time:2024-10-26 19:20:09 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 9m 27s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:dmips.elf
Detection:MAL
Classification:mal64.troj.linELF@0/0@0/0

Warnings

  • Connection to analysis system has been lost, crash info: Unknown
  • Skipping network analysis since amount of network traffic is too extensive
  • VT rate limit hit for: dmips.elf

Runtime Messages

Command:/tmp/dmips.elf
PID:6273
Exit Code:
Exit Code Info:
Killed:True
Standard Output:
you are now apart of hail cock botnet
System is now clean
[bot/main.c] Debug mode initialized PID: 6273
[bot/table.c] added "you are now apart of hail cock botnet" to structure on index: "0"
[bot/table.c] added "/tmp" to structure on index: "1"
[bot/table.c] added "/var/tmp" to structure on index: "2"
[bot/table.c] added "/var/run" to structure on index: "3"
[bot/table.c] added "/dev/shm" to structure on index: "4"
[bot/table.c] added "/mnt" to structure on index: "5"
[bot/table.c] added "/home" to structure on index: "6"
[bot/table.c] added "kingstonwikkerink.dyn" to structure on index: "7"
[bot/table.c] added "kingstonwikkerink.dyn" to structure on index: "8"
[bot/table.c] added "kingstonwikkerink.dyn" to structure on index: "9"
[bot/table.c] added "kingstonwikkerink.dyn" to structure on index: "10"
[bot/table.c] added "hailcocks.ru" to structure on index: "11"
[bot/table.c] added "mini_httpd" to structure on index: "12"
[bot/table.c] added "[watchdog/0]" to structure on index: "13"
[bot/table.c] added "/bin/busybox telentd" to structure on index: "14"
[bot/table.c] added "[kswapd0]" to structure on index: "15"
[bot/table.c] added "/bin/busybox ntpd" to structure on index: "16"
[bot/table.c] added "/bin/sh /etc/init.d/rcS" to structure on index: "17"
[bot/telnet.c] Scanner process initialized. Scanning started.
[bot/telnet.c] Attempting to brute found IP 35.34.126.72
[bot/telnet.c] Attempting to brute found IP 71.115.6.88
[bot/telnet.c] Attempting to brute found IP 89.54.92.177
[bot/telnet.c] Attempting to brute found IP 167.72.13.30
[bot/telnet.c] Attempting to brute found IP 198.161.35.185
[bot/telnet.c] Attempting to brute found IP 225.123.187.206
[bot/telnet.c] Attempting to brute found IP 40.84.95.215
[bot/telnet.c] Attempting to brute found IP 203.122.59.64
[bot/telnet.c] Attempting to brute found IP 216.155.31.154
[bot/telnet.c] Attempting to brute found IP 224.146.111.23
[bot/telnet.c] Attempting to brute found IP 116.206.141.180
[bot/telnet.c] Attempting to brute found IP 213.204.106.114
[bot/telnet.c] Attempting to brute found IP 129.34.125.68
[bot/telnet.c] Attempting to brute found IP 237.6.204.164
[bot/telnet.c] Attempting to brute found IP 197.226.78.140
[bot/telnet.c] Attempting to brute found IP 162.14.197.84
[bot/telnet.c] Attempting to brute found IP 129.135.99.108
[bot/telnet.c] Attempting to brute found IP 231.115.46.15
[bot/telnet.c] Attempting to brute found IP 12.227.235.154
[bot/telnet.c] Attempting to brute found IP 42.1.37.196
[bot/telnet.c] Attempting to brute found IP 55.117.230.83
[bot/telnet.c] Attempting to brute found IP 79.50.188.17
[bot/telnet.c] Attempting to brute found IP 215.87.194.166
[bot/telnet.c] Attempting to brute found IP 175.241.226.49
[bot/telnet.c] Attempting to brute found IP 205.161.137.122
[bot/telnet.c] Attempting to brute found IP 227.165.108.104
[bot/telnet.c] Attempting to brute found IP 132.201.247.146
[bot/telnet.c] Attempting to brute found IP 49.179.94.204
[bot/telnet.c] Attempting to brute found IP 182.199.152.66
[bot/telnet.c] Attempting to brute found IP 163.238.149.11
[bot/telnet.c] Attempting to brute found IP 224.110.207.223
[bot/telnet.c] Attempting to brute found IP 4.138.216.186
[bot/telnet.c] Attempting to brute found IP 182.128.55.173
[bot/telnet.c] Attempting to brute found IP 172.199.18.143
[bot/telnet.c] Attempting to brute found IP 67.12.165.204
[bot/telnet.c] Attempting to brute found IP 168.169.180.107
[bot/telnet.c] Attempting to brute found IP 46.153.185.59
[bot/telnet.c] Attempting to brute found IP 229.185.61.136
[bot/telnet.c] Attempting to brute found IP 80.88.241.141
[bot/telnet.c] Attempting to brute found IP 65.179.39.148
[bot/telnet.c] Attempting to brute found IP 58.172.129.172
[bot/telnet.c] Attempting to brute found IP 167.127.37.153
[bot/telnet.c] Attempting to brute found IP 198.98.60.56
[bot/telnet.c] Attempting to brute found IP 79.234.158.53
[bot/telnet.c] Attempting to brute found IP 1.83.245.160
[bot/telnet.c] Attempting to brute found IP 54.55.115.157
[bot/telnet.c] Attempting to brute found IP 246.170.15.39
[bot/telnet.c] Attempting to brute found IP 177.244.197.179
[bot/telnet.c] Attempting to brute found IP 183.44.52.144
[bot/telnet.c] Attempting to brute found IP 82.249.161.105
[bot/telnet.c] Attempting to brute found IP 206.112.168.98
[bot/telnet.c] Attempting to brute found IP 135.125.85.184
[bot/telnet.c] Attempting to brute found IP 101.93.3.168
[bot/telnet.c] Attempting to brute found IP 126.165.222.141
[bot/telnet.c] Attempting to brute found IP 124.231.194.161
[bot/telnet.c] Attempting to brute found IP 189.29.234.199
[bot/telnet.c] Attempting to brute found IP 8.222.95.152
[bot/telnet.c] Attempting to brute found IP 27.1.54.129
[bot/telnet.c] Attempting to brute found IP 63.194.158.133
[bot/telnet.c] Attempting to brute found IP 72.212.142.107
[bot/telnet.c] Attempting to brute found IP 13.123.136.61
[bot/telnet.c] Attempting to brute found IP 98.107.55.217
[bot/telnet.c] Attempting to brute found IP 163.46.122.175
[bot/telnet.c] Attempting to brute found IP 240.163.26.115
[bot/telnet.c] Attempting to brute found IP 41.20.182.34
[bot/telnet.c] Attempting to brute found IP 0.102.36.93
[bot/telnet.c] Attempting to brute found IP 177.163.106.215
[bot/telnet.c] Attempting to brute found IP 244.229.187.213
[bot/telnet.c] Attempting to brute found IP 233.33.161.108
[bot/telnet.c] Attempting to brute found IP 218.146.42.205
[bot/telnet.c] Attempting to brute found IP 192.18.51.137
[bot/telnet.c] Attempting to brute found IP 23.141.102.16
[bot/telnet.c] Attempting to brute found IP 160.228.88.199
[bot/telnet.c] Attempting to brute found IP 225.235.155.51
[bot/telnet.c] Attempting to brute found IP 215.27.142.39
[bot/telnet.c] Attempting to brute found IP 167.59.63.77
[bot/telnet.c] Attempting to brute found IP 85.24.48.93
[bot/telnet.c] Attempting to brute found IP 119.244.19.122
[bot/telnet.c] Attempting to brute found IP 8.138.87.192
[bot/telnet.c] Attempting to brute found IP 143.59.76.13
[bot/telnet.c] Attempting to brute found IP 0.7.214.126
[bot/telnet.c] Attempting to brute found IP 160.211.224.177
[bot/telnet.c] Attempting to brute found IP 194.44.212.61
[bot/telnet.c] Attempting to brute found IP 228.26.11.40
[bot/telnet.c] Attempting to brute found IP 85.49.3.206
[bot/telnet.c] Attempting to brute found IP 15.5.213.160
[bot/telnet.c] Attempting to brute found IP 4.25.68.44
[bot/telnet.c] Attempting to brute found IP 152.44.85.35
[bot/telnet.c] Attempting to brute found IP 70.178.204.182
[bot/telnet.c] Attempting to brute found IP 161.197.206.179
[bot/telnet.c] Attempting to brute found IP 159.75.189.87
[bot/telnet.c] Attempting to brute found IP 165.11.127.25
[bot/telnet.c] Attempting to brute found IP 109.211.150.212
[bot/telnet.c] Attempting to brute found IP 10.217.119.184
[bot/telnet.c] Attempting to brute found IP 109.149.74.11
[bot/telnet.c] Attempting to brute found IP 49.159.250.138
[bot/telnet.c] Attempting to brute found IP 138.142.5.202
[bot/telnet.c] Attempting to brute found IP 247.166.67.41
[bot/telnet.c] Attempting to brute found IP 92.226.25.70
[bot/telnet.c] Attempting to brute found IP 123.61.127.120
[bot/telnet.c] Attempting to brute found IP 116.233.134.51
[bot/telnet.c] Attempting to brute found IP 150.0.122.210
[bot/telnet.c] Attempting to brute found IP 252.194.109.108
[bot/telnet.c] Attempting to brute found IP 136.77.148.27
[bot/telnet.c] Attempting to brute found IP 44.243.1.219
[bot/telnet.c] Attempting to brute found IP 187.50.135.49
[bot/telnet.c] Attempting to brute found IP 15.65.230.211
[bot/telnet.c] Attempting to brute found IP 217.207.59.223
[bot/telnet.c] Attempting to brute found IP 82.156.203.150
[bot/telnet.c] Attempting to brute found IP 150.77.154.90
[bot/telnet.c] Attempting to brute found IP 130.250.55.162
[bot/telnet.c] Attempting to brute found IP 254.40.80.42
[bot/telnet.c] Attempting to brute found IP 83.26.197.196
[bot/telnet.c] Attempting to brute found IP 233.188.94.19
[bot/telnet.c] Attempting to brute found IP 207.132.28.92
[bot/telnet.c] Attempting to brute found IP 139.53.122.60
[bot/telnet.c] Attempting to brute found IP 36.28.192.61
[bot/telnet.c] Attempting to brute found IP 131.137.198.139
[bot/telnet.c] Attempting to brute found IP 75.48.63.126
[bot/telnet.c] Attempting to brute found IP 98.30.245.116
[bot/telnet.c] Attempting to brute found IP 9.192.230.31
[bot/telnet.c] Attempting to brute found IP 7.186.215.87
[bot/telnet.c] Attempting to brute found IP 57.237.133.9
[bot/telnet.c] Attempting to brute found IP 232.108.153.110
[bot/telnet.c] Attempting to brute found IP 248.22.251.109
[bot/telnet.c] Attempting to brute found IP 156.86.159.38
[bot/telnet.c] Attempting to brute found IP 184.89.128.172
[bot/telnet.c] Attempting to brute found IP 36.111.255.24
[bot/telnet.c] Attempting to brute found IP 164.87.82.16
[bot/telnet.c] Attempting to brute found IP 223.220.247.107
[bot/telnet.c] Attempting to brute found IP 195.178.202.197
[bot/telnet.c] Attempting to brute found IP 16.51.67.168
[bot/telnet.c] Attempting to brute found IP 198.157.72.52
[bot/telnet.c] Attempting to brute found IP 148.32.231.55
[bot/telnet.c] Attempting to brute found IP 50.241.49.173
[bot/telnet.c] Attempting to brute found IP 225.6.17.133
[bot/telnet.c] Attempting to brute found IP 63.70.209.110
[bot/telnet.c] Attempting to brute found IP 31.70.37.86
[bot/telnet.c] Attempting to brute found IP 175.235.129.146
[bot/telnet.c] Attempting to brute found IP 4.159.222.171
[bot/telnet.c] Attempting to brute found IP 45.35.77.194
[bot/telnet.c] Attempting to brute found IP 160.38.184.99
[bot/telnet.c] Attempting to brute found IP 66.69.64.151
[bot/telnet.c] Attempting to brute found IP 102.54.248.110
[bot/telnet.c] Attempting to brute found IP 99.137.11.188
[bot/telnet.c] Attempting to brute found IP 162.130.76.152
[bot/telnet.c] Attempting to brute found IP 227.234.218.139
[bot/telnet.c] Attempting to brute found IP 216.105.94.137
[bot/telnet.c] Attempting to brute found IP 226.214.40.76
[bot/telnet.c] Attempting to brute found IP 228.26.14.181
[bot/telnet.c] Attempting to brute found IP 162.236.143.117
[bot/telnet.c] Attempting to brute found IP 166.156.251.38
[bot/telnet.c] Attempting to brute found IP 108.186.212.202
[bot/telnet.c] Attempting to brute found IP 6.161.241.182
[bot/telnet.c] Attempting to brute found IP 53.167.163.23
[bot/telnet.c] Attempting to brute found IP 67.188.255.104
[bot/telnet.c] Attempting to brute found IP 82.129.50.53
[bot/telnet.c] Attempting to brute found IP 28.249.122.47
[bot/telnet.c] Attempting to brute found IP 144.242.189.144
[bot/telnet.c] Attempting to brute found IP 13.84.71.115
[bot/telnet.c] Attempting to brute found IP 67.26.61.85
[bot/telnet.c] Attempting to brute found IP 64.54.241.164
[bot/telnet.c] Attempting to brute found IP 106.133.240.51
[bot/telnet.c] Attempting to brute found IP 73.203.253.119
[bot/telnet.c] Attempting to brute found IP 95.49.109.40
[bot/telnet.c] Attempting to brute found IP 59.19.2.91
[bot/telnet.c] Attempting to brute found IP 4.118.58.162
[bot/telnet.c] Attempting to brute found IP 188.90.144.59
[bot/telnet.c] Attempting to brute found IP 17.91.217.121
[bot/telnet.c] Attempting to brute found IP 157.64.223.122
[bot/telnet.c] Attempting to brute found IP 150.201.166.83
[bot/telnet.c] Attempting to brute found IP 199.246.42.9
[bot/telnet.c] Attempting to brute found IP 74.168.174.103
[bot/telnet.c] Attempting to brute found IP 228.250.104.110
[bot/telnet.c] Attempting to brute found IP 105.237.47.193
[bot/telnet.c] Attempting to brute found IP 114.183.38.15
[bot/telnet.c] Attempting to brute found IP 61.211.124.145
[bot/telnet.c] Attempting to brute found IP 152.134.70.99
[bot/telnet.c] Attempting to brute found IP 165.75.251.97
[bot/telnet.c] Attempting to brute found IP 193.192.135.147
[bot/telnet.c] Attempting to brute found IP 68.202.8.54
[bot/telnet.c] Attempting to brute found IP 232.90.142.214
[bot/telnet.c] Attempting to brute found IP 255.70.230.140
[bot/telnet.c] Attempting to brute found IP 44.181.93.105
[bot/telnet.c] Attempting to brute found IP 139.163.41.223
[bot/telnet.c] Attempting to brute found IP 222.214.8.67
[bot/telnet.c] Attempting to brute found IP 69.48.20.169
[bot/telnet.c] Attempting to brute found IP 255.7.217.147
[bot/telnet.c] Attempting to brute found IP 155.72.163.151
[bot/telnet.cSystem is now clean
[bot/main.c] Debug mode initialized PID: 6273
[bot/table.c] added "you are now apart of hail cock botnet" to structure on index: "0"
[bot/table.c] added "/tmp" to structure on index: "1"
[bot/table.c] added "/var/tmp" to structure on index: "2"
[bot/table.c] added "/var/run" to structure on index: "3"
[bot/table.c] added "/dev/shm" to structure on index: "4"
[bot/table.c] added "/mnt" to structure on index: "5"
[bot/table.c] added "/home" to structure on index: "6"
[bot/table.c] added "kingstonwikkerink.dyn" to structure on index: "7"
[bot/table.c] added "kingstonwikkerink.dyn" to structure on index: "8"
[bot/table.c] added "kingstonwikkerink.dyn" to structure on index: "9"
[bot/table.c] added "kingstonwikkerink.dyn" to structure on index: "10"
[bot/table.c] added "hailcocks.ru" to structure on index: "11"
[bot/table.c] added "mini_httpd" to structure on index: "12"
[bot/table.c] added "[watchdog/0]" to structure on index: "13"
[bot/table.c] added "/bin/busybox telentd" to structure on index: "14"
[bot/table.c] added "[kswapd0]" to structure on index: "15"
[bot/table.c] added "/bin/busybox ntpd" to structure on index: "16"
[bot/table.c] added "/bin/sh /etc/init.d/rcS" to structure on index: "17"
[bot/main.c] Attempting to connect to CNC
[bot/main.c] Attempting to resolve "kingstonwikkerink.dyn"
[bot/resolve.c] Got response from select
[bot/resolve.c] Found IP address: 45.193.233.193
[bot/resolve.c] Found IP address: 181.200.82.185
[bot/resolve.c] Found IP address: 29.198.87.194
[bot/resolve.c] Found IP address: 80.100.107.86
[bot/resolve.c] Found IP address: 89.248.13.31
[bot/resolve.c] Found IP address: 22.195.151.88
[bot/resolve.c] Found IP address: 178.149.29.81
[bot/resolve.c] Found IP address: 18.238.149.91
[bot/resolve.c] Found IP address: 232.218.149.91
[bot/resolve.c] Found IP address: 57.204.182.213
[bot/resolve.c] Found IP address: 51.92.133.195
[bot/main.c] Successfully resolved "kingstonwikkerink.dyn"
[bot/main.c] Connecting to CNC with IP address: 195.133.92.51
[bot/main.c] Connecting to CNC with port 8866
[bot/main.c] Connected to CNC
[bot/main.c] Lost connection with CNC (errno = 14) 2
[bot/main.c] Tearing down connection to CNC!
[bot/main.c] Attempting to connect to CNC
[bot/main.c] Attempting to resolve "kingstonwikkerink.dyn"
[bot/resolve.c] Got response from select
[bot/resolve.c] Found IP address: 57.204.182.213
[bot/resolve.c] Found IP address: 178.149.29.81
[bot/resolve.c] Found IP address: 89.248.13.31
[bot/resolve.c] Found IP address: 80.100.107.86
[bot/resolve.c] Found IP address: 232.218.149.91
[bot/resolve.c] Found IP address: 51.92.133.195
[bot/resolve.c] Found IP address: 18.238.149.91
[bot/resolve.c] Found IP address: 22.195.151.88
[bot/resolve.c] Found IP address: 181.200.82.185
[bot/resolve.c] Found IP address: 29.198.87.194
[bot/resolve.c] Found IP address: 45.193.233.193
[bot/main.c] Successfully resolved "kingstonwikkerink.dyn"
[bot/main.c] Connecting to CNC with IP address: 88.151.195.22
[bot/main.c] Connecting to CNC with port 3908
[bot/main.c] Connected to CNC
[bot/main.c] Lost connection with CNC (errno = 14) 2
[bot/main.c] Tearing down connection to CNC!
[bot/main.c] Attempting to connect to CNC
[bot/main.c] Attempting to resolve "kingstonwikkerink.dyn"
[bot/resolve.c] Couldn't resolve kingstonwikkerink.dyn in time. 1 try
[bot/main.c] Failed to resolve "kingstonwikkerink.dyn"
[bot/main.c] Attempting to resolve "kingstonwikkerink.dyn"
[bot/resolve.c] Couldn't resolve kingstonwikkerink.dyn in time. 1 try
[bot/main.c] Failed to resolve "kingstonwikkerink.dyn"
[bot/main.c] Attempting to resolve "kingstonwikkerink.dyn"
[bot/resolve.c] Got response from select
[bot/resolve.c] Found IP address: 45.193.233.193
[bot/resolve.c] Found IP address: 18.238.149.91
[bot/resolve.c] Found IP address: 22.195.151.88
[bot/resolve.c] Found IP address: 51.92.133.195
[bot/resolve.c] Found IP address: 29.198.87.194
[bot/resolve.c] Found IP address: 80.100.107.86
[bot/resolve.c] Found IP address: 57.204.182.213
[bot/resolve.c] Found IP address: 178.149.29.81
[bot/resolve.c] Found IP address: ] Attempting to brute found IP 247.45.111.123
[bot/telnet.c] Attempting to brute found IP 135.34.151.107
[bot/telnet.c] Attempting to brute found IP 87.141.16.149
[bot/telnet.c] Attempting to brute found IP 149.71.8.205
[bot/telnet.c] Attempting to brute found IP 27.185.169.78
[bot/telnet.c] Attempting to brute found IP 4.183.34.3
[bot/telnet.c] Attempting to brute found IP 130.249.143.218
[bot/telnet.c] Attempting to brute found IP 132.222.143.55
[bot/telnet.c] Attempting to brute found IP 249.84.198.149
[bot/telnet.c] Attempting to brute found IP 91.209.185.195
[bot/telnet.c] Attempting to brute found IP 210.65.218.162
[bot/telnet.c] Attempting to brute found IP 57.22.168.141
[bot/telnet.c] Attempting to brute found IP 192.74.237.219
[bot/telnet.c] Attempting to brute found IP 147.223.23.178
[bot/telnet.c] Attempting to brute found IP 249.51.101.17
[bot/telnet.c] Attempting to brute found IP 103.147.167.219
[bot/telnet.c] Attempting to brute found IP 214.212.5.52
[bot/telnet.c] Attempting to brute found IP 119.21.49.131
[bot/telnet.c] Attempting to brute found IP 120.86.148.4
[bot/telnet.c] Attempting to brute found IP 218.243.199.81
[bot/telnet.c] Attempting to brute found IP 156.192.29.62
[bot/telnet.c] Attempting to brute found IP 221.115.210.50
[bot/telnet.c] Attempting to brute found IP 43.69.182.137
[bot/telnet.c] Attempting to brute found IP 246.181.40.59
[bot/telnet.c] Attempting to brute found IP 219.18.242.50
[bot/telnet.c] Attempting to brute found IP 153.21.154.131
[bot/telnet.c] Attempting to brute found IP 204.52.90.116
[bot/telnet.c] Attempting to brute found IP 10.17.219.144
[bot/telnet.c] Attempting to brute found IP 250.33.74.120
[bot/telnet.c] Attempting to brute found IP 238.37.84.46
[bot/telnet.c] Attempting to brute found IP 43.142.48.25
[bot/telnet.c] Attempting to brute found IP 35.102.177.204
[bot/telnet.c] Attempting to brute found IP 7.230.50.150
[bot/telnet.c] Attempting to brute found IP 169.11.179.169
[bot/telnet.c] Attempting to brute found IP 144.186.240.91
[bot/telnet.c] Attempting to brute found IP 68.128.82.11
[bot/telnet.c] Attempting to brute found IP 208.151.117.14
[bot/telnet.c] Attempting to brute found IP 216.138.188.74
[bot/telnet.c] Attempting to brute found IP 116.201.213.74
[bot/telnet.c] Attempting to brute found IP 45.94.231.124
[bot/telnet.c] Attempting to brute found IP 85.216.170.180
[bot/telnet.c] Attempting to brute found IP 160.121.16.200
[bot/telnet.c] Attempting to brute found IP 134.76.196.84
[bot/telnet.c] Attempting to brute found IP 18.147.86.72
[bot/telnet.c] Attempting to brute found IP 65.233.159.102
[bot/telnet.c] Attempting to brute found IP 79.84.180.110
[bot/telnet.c] Attempting to brute found IP 117.218.111.175
[bot/telnet.c] Attempting to brute found IP 210.108.130.72
[bot/telnet.c] Attempting to brute found IP 171.156.82.29
[bot/telnet.c] Attempting to brute found IP 39.64.192.147
[bot/telnet.c] Attempting to brute found IP 10.200.195.100
[bot/telnet.c] Attempting to brute found IP 49.191.1.171
[bot/telnet.c] Attempting to brute found IP 155.232.170.221
[bot/telnet.c] Attempting to brute found IP 114.201.220.187
[bot/telnet.c] Attempting to brute found IP 217.130.233.191
[bot/telnet.c] Attempting to brute found IP 121.145.160.112
[bot/telnet.c] Attempting to brute found IP 121.162.16.128
[bot/telnet.c] Attempting to brute found IP 195.63.170.93
[bot/telnet.c] Attempting to brute found IP 5.221.66.19
[bot/telnet.c] Attempting to brute found IP 194.206.108.63
[bot/telnet.c] Attempting to brute found IP 254.201.24.217
[bot/telnet.c] Attempting to brute found IP 170.192.137.102
[bot/telnet.c] Attempting to brute found IP 113.118.184.5
[bot/telnet.c] Attempting to brute found IP 66.116.103.160
[bot/telnet.c] Attempting to brute found IP 20.235.255.201
[bot/telnet.c] Attempting to brute found IP 192.181.171.62
[bot/telnet.c] Attempting to brute found IP 65.1.172.181
[bot/telnet.c] Attempting to brute found IP 15.44.236.101
[bot/telnet.c] Attempting to brute found IP 16.70.79.52
[bot/telnet.c] Attempting to brute found IP 37.157.189.212
Standard Error:

Process Tree

  • system is lnxubuntu20
  • dmips.elf (PID: 6273, Parent: 6197, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/dmips.elf
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
dmips.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    6273.1.00007f862c400000.00007f862c41a000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Antivirus / Scanner detection for submitted sample
      Source: dmips.elfAvira: detected
      Multi AV Scanner detection for submitted file
      Source: dmips.elfReversingLabs: Detection: 34%
      Source: /tmp/dmips.elf (PID: 6273)Socket: 127.0.0.1:1172Jump to behavior
      Source: ELF static info symbol of initial sample.symtab present: no
      Source: classification engineClassification label: mal64.troj.linELF@0/0@0/0
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6340/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6351/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6350/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6342/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6353/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6341/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6352/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6333/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6344/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6343/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6346/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6345/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6106/cmdlineJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6337/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6348/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6336/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6347/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6339/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6338/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6276)File opened: /proc/6349/statusJump to behavior
      Source: /tmp/dmips.elf (PID: 6273)Queries kernel information via 'uname': Jump to behavior
      Source: dmips.elf, 6273.1.0000556da2926000.0000556da29f2000.rw-.sdmpBinary or memory string: mU!/etc/qemu-binfmt/mips
      Source: dmips.elf, 6273.1.00007ffff520a000.00007ffff522b000.rw-.sdmpBinary or memory string: sxxx86_64/usr/bin/qemu-mips/tmp/dmips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/dmips.elf
      Source: dmips.elf, 6273.1.0000556da2926000.0000556da29f2000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/mips
      Source: dmips.elf, 6273.1.00007ffff520a000.00007ffff522b000.rw-.sdmpBinary or memory string: /usr/bin/qemu-mips

      Stealing of Sensitive Information

      barindex
      Yara detected Mirai
      Source: Yara matchFile source: dmips.elf, type: SAMPLE
      Source: Yara matchFile source: 6273.1.00007f862c400000.00007f862c41a000.r-x.sdmp, type: MEMORY

      Remote Access Functionality

      barindex
      Yara detected Mirai
      Source: Yara matchFile source: dmips.elf, type: SAMPLE
      Source: Yara matchFile source: 6273.1.00007f862c400000.00007f862c41a000.r-x.sdmp, type: MEMORY

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionDirect Volume Access1
      OS Credential Dumping      		11
      Security Software Discovery      		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features

      Malware Configuration

      ⊘No configs have been found

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 signatures2 2 Behavior Graph ID: 1542860 Sample: dmips.elf Startdate: 26/10/2024 Architecture: LINUX Score: 64 19 Antivirus / Scanner detection for submitted sample 2->19 21 Multi AV Scanner detection for submitted file 2->21 23 Yara detected Mirai 2->23 7 dmips.elf 2->7         started        process3 process4 9 dmips.elf 7->9         started        11 dmips.elf 7->11         started        13 dmips.elf 7->13         started        process5 15 dmips.elf 9->15         started        17 dmips.elf 9->17         started       

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      dmips.elf34%ReversingLabsLinux.Backdoor.Mirai
      dmips.elf100%AviraEXP/ELF.Mirai.W

      Dropped Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Contacted Domains

      ⊘No contacted domains info

      World Map of Contacted IPs

      ⊘No contacted IP infos

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      ⊘No created / dropped files found

      Static File Info

      General

      File type:ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
      Entropy (8bit):5.569245759210382
      TrID:
      • ELF Executable and Linkable format (generic) (4004/1) 100.00%
      File name:dmips.elf
      File size:109'728 bytes
      MD5:18bb54f58aa90cc5d48968a0bf7970e1
      SHA1:a4a833f63c054d223daf36bb0b492fe5c7093d03
      SHA256:8398866a812765361d7e523bb66e7961f0c6fd191a42265d5c85b083fc993ea7
      SHA512:d8c3338036ba5c605d26be6ef28994c8f435c82562af8d1c48ec00e31354c77e01fbed56d62d8c5af22300e38e8a384a235b137b15ec02fd23938ddf256ebc7d
      SSDEEP:3072:aUcL3Ivmk/IoAoQYxbJuaato1MQrN6XXm1mK7/9:avL3IekjuVo1vgHHO1
      TLSH:2FB3D71E6E618FADF368C23447B78A31A35833D627E0D685D1ACD5111F6038E685FFA8
      File Content Preview:.ELF.....................@.`...4...p.....4. ...(.............@...@...........................E...E........[.........dt.Q............................<...'.#....!'.......................<...'.#....!... ....'9... ......................<...'.#X...!...$....'9w

      Static ELF Info

      ELF header

      Class:ELF32
      Data:2's complement, big endian
      Version:1 (current)
      Machine:MIPS R3000
      Version Number:0x1
      Type:EXEC (Executable file)
      OS/ABI:UNIX - System V
      ABI Version:0
      Entry Point Address:0x400260
      Flags:0x1007
      ELF Header Size:52
      Program Header Offset:52
      Program Header Size:32
      Number of Program Headers:3
      Section Header Offset:109168
      Section Header Size:40
      Number of Section Headers:14
      Header String Table Index:13

      Sections

      NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
      NULL0x00x00x00x00x0000
      .initPROGBITS0x4000940x940x8c0x00x6AX004
      .textPROGBITS0x4001200x1200x177100x00x6AX0016
      .finiPROGBITS0x4178300x178300x5c0x00x6AX004
      .rodataPROGBITS0x4178900x178900x24800x00x2A0016
      .ctorsPROGBITS0x45a0000x1a0000x80x00x3WA004
      .dtorsPROGBITS0x45a0080x1a0080x80x00x3WA004
      .data.rel.roPROGBITS0x45a0140x1a0140x100x00x3WA004
      .dataPROGBITS0x45a0300x1a0300x4180x00x3WA0016
      .gotPROGBITS0x45a4500x1a4500x5bc0x40x10000003WAp0016
      .sbssNOBITS0x45aa0c0x1aa0c0x2c0x00x10000003WAp004
      .bssNOBITS0x45aa400x1aa0c0x51880x00x3WA0016
      .mdebug.abi32PROGBITS0xc720x1aa0c0x00x00x0001
      .shstrtabSTRTAB0x00x1aa0c0x640x00x0001

      Program Segments

      TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
      LOAD0x00x4000000x4000000x19d100x19d105.61060x5R E0x10000.init .text .fini .rodata
      LOAD0x1a0000x45a0000x45a0000xa0c0x5bc84.26690x6RW 0x10000.ctors .dtors .data.rel.ro .data .got .sbss .bss
      GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

      Network Behavior

      ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

      System Behavior

      General

      Start time (UTC):17:21:18
      Start date (UTC):26/10/2024
      Path:/tmp/dmips.elf
      Arguments:/tmp/dmips.elf
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):17:21:18
      Start date (UTC):26/10/2024
      Path:/tmp/dmips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):17:22:03
      Start date (UTC):26/10/2024
      Path:/tmp/dmips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):17:22:03
      Start date (UTC):26/10/2024
      Path:/tmp/dmips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):17:21:19
      Start date (UTC):26/10/2024
      Path:/tmp/dmips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities


      General

      Start time (UTC):17:21:19
      Start date (UTC):26/10/2024
      Path:/tmp/dmips.elf
      Arguments:-
      File size:5777432 bytes
      MD5 hash:0083f1f0e77be34ad27f849842bbb00c

      Chronological Activities