Linux Analysis Report
kkkx86.elf

Overview

General Information

Sample name: kkkx86.elf
Analysis ID: 1542900
MD5: 59e8e0606102e1231d18a87fee924ac1
SHA1: e220142076cdadfaf4bcfb22431a4ff3d9d4a6d4
SHA256: 69531b6272fc216d690411195f7afe911a9caad17b4acad1f0fe0f9de460525a
Tags: elfkkkMiraiuser-NDA0E
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Machine Learning detection for sample
Detected TCP or UDP traffic on non-standard ports
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: kkkx86.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: kkkx86.elf ReversingLabs: Detection: 73%
Machine Learning detection for sample
Source: kkkx86.elf Joe Sandbox ML: detected
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:46220 -> 5.59.249.232:1337
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 5.59.249.232
Source: unknown TCP traffic detected without corresponding DNS query: 16.255.232.73
Source: unknown TCP traffic detected without corresponding DNS query: 31.5.84.242
Source: unknown TCP traffic detected without corresponding DNS query: 48.189.15.142
Source: unknown TCP traffic detected without corresponding DNS query: 92.90.212.29
Source: unknown TCP traffic detected without corresponding DNS query: 185.231.235.210
Source: unknown TCP traffic detected without corresponding DNS query: 74.189.206.184
Source: unknown TCP traffic detected without corresponding DNS query: 42.4.127.229
Source: unknown TCP traffic detected without corresponding DNS query: 38.182.84.151
Source: unknown TCP traffic detected without corresponding DNS query: 45.36.249.197
Source: unknown TCP traffic detected without corresponding DNS query: 185.30.73.67
Source: unknown TCP traffic detected without corresponding DNS query: 218.128.126.202
Source: unknown TCP traffic detected without corresponding DNS query: 170.142.132.70
Source: unknown TCP traffic detected without corresponding DNS query: 36.28.152.62
Source: unknown TCP traffic detected without corresponding DNS query: 96.35.254.19
Source: unknown TCP traffic detected without corresponding DNS query: 249.202.69.216
Source: unknown TCP traffic detected without corresponding DNS query: 90.189.67.99
Source: unknown TCP traffic detected without corresponding DNS query: 195.151.43.159
Source: unknown TCP traffic detected without corresponding DNS query: 106.21.75.191
Source: unknown TCP traffic detected without corresponding DNS query: 249.0.109.75
Source: unknown TCP traffic detected without corresponding DNS query: 45.157.130.253
Source: unknown TCP traffic detected without corresponding DNS query: 249.64.222.29
Source: unknown TCP traffic detected without corresponding DNS query: 154.84.102.9
Source: unknown TCP traffic detected without corresponding DNS query: 84.152.165.203
Source: unknown TCP traffic detected without corresponding DNS query: 44.37.213.244
Source: unknown TCP traffic detected without corresponding DNS query: 118.218.102.149
Source: unknown TCP traffic detected without corresponding DNS query: 115.229.2.179
Source: unknown TCP traffic detected without corresponding DNS query: 63.208.96.162
Source: unknown TCP traffic detected without corresponding DNS query: 75.81.121.58
Source: unknown TCP traffic detected without corresponding DNS query: 95.46.202.66
Source: unknown TCP traffic detected without corresponding DNS query: 187.25.221.35
Source: unknown TCP traffic detected without corresponding DNS query: 66.169.20.169
Source: unknown TCP traffic detected without corresponding DNS query: 116.59.111.188
Source: unknown TCP traffic detected without corresponding DNS query: 45.238.188.143
Source: unknown TCP traffic detected without corresponding DNS query: 173.29.94.105
Source: unknown TCP traffic detected without corresponding DNS query: 94.117.204.212
Source: unknown TCP traffic detected without corresponding DNS query: 175.129.159.167
Source: unknown TCP traffic detected without corresponding DNS query: 108.156.225.164
Source: unknown TCP traffic detected without corresponding DNS query: 45.48.1.104
Source: unknown TCP traffic detected without corresponding DNS query: 152.58.175.151
Source: unknown TCP traffic detected without corresponding DNS query: 112.209.135.175
Source: unknown TCP traffic detected without corresponding DNS query: 160.201.75.208
Source: unknown TCP traffic detected without corresponding DNS query: 16.239.233.244
Source: unknown TCP traffic detected without corresponding DNS query: 116.77.196.50
Source: unknown TCP traffic detected without corresponding DNS query: 175.254.104.35
Source: unknown TCP traffic detected without corresponding DNS query: 185.223.2.149
Source: unknown TCP traffic detected without corresponding DNS query: 211.51.200.191
Source: unknown TCP traffic detected without corresponding DNS query: 168.186.109.147
Source: unknown TCP traffic detected without corresponding DNS query: 139.155.52.187
Source: unknown TCP traffic detected without corresponding DNS query: 17.63.102.245
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: kkkx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: kkkx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: kkkx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: kkkx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: kkkx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6235.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6235.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6235.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6235.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6235.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6238.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6238.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6238.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6238.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6238.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6237.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6237.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6237.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6237.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6237.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6234.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6234.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6234.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6234.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6234.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Yara signature match
Source: kkkx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: kkkx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: kkkx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: kkkx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: kkkx86.elf, type: SAMPLE Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6235.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6235.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6235.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6235.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6235.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6238.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6238.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6238.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6237.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6237.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6237.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6237.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6237.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6234.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6234.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6234.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6234.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6234.1.0000000008048000.0000000008053000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: classification engine Classification label: mal68.linELF@0/0@0/0

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
241.73.28.15
 unknown Reserved
unknown unknown false
24.138.125.115
 unknown Canada
5690 VIANET-NOCA false
152.87.9.185
 unknown United States
10384 TVAUS false
167.186.89.213
 unknown United States
15071 BAX-BGPUS false
19.67.79.77
 unknown United States
3 MIT-GATEWAYSUS false
102.243.119.128
 unknown Tunisia
36926 CKL1-ASNKE false
9.32.8.235
 unknown United States
3356 LEVEL3US false
255.223.94.130
 unknown Reserved
unknown unknown false
88.130.213.33
 unknown Germany
8881 VERSATELDE false
23.251.196.212
 unknown United States
14265 US-TELEPACIFICUS false
251.26.192.184
 unknown Reserved
unknown unknown false
122.202.243.138
 unknown Korea Republic of
9946 CABLENET-AS-KRKCTVJEJUBROADCASTINGKR false
149.203.174.71
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
204.62.113.0
 unknown United States
11398 CENTURYLINK-LEGACY-EMBARQ-LVGSUS false
94.207.100.121
 unknown United Arab Emirates
15802 DU-AS1AE false
98.72.203.126
 unknown United States
7018 ATT-INTERNET4US false
186.135.1.126
 unknown Argentina
22927 TelefonicadeArgentinaAR false
155.232.149.249
 unknown South Africa
2018 TENET-1ZA false
167.110.48.54
 unknown United States
6057 AdministracionNacionaldeTelecomunicacionesUY false
223.158.59.7
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
18.169.174.93
 unknown United States
3 MIT-GATEWAYSUS false
102.112.135.91
 unknown Mauritius
23889 MauritiusTelecomMU false
146.158.159.171
 unknown Spain
12479 UNI2-ASES false
44.96.109.204
 unknown United States
7377 UCSDUS false
213.209.175.85
 unknown Italy
29286 SKYLOGIC-ASIT false
85.240.110.193
 unknown Portugal
3243 MEO-RESIDENCIALPT false
196.200.107.228
 unknown Eritrea
30987 ERITEL-ASER false
198.160.166.77
 unknown United States
3620 MCIASN-BLKUS false
164.81.160.238
 unknown France
1935 FR-RENATER-LIMOUSINReseauRegionalLimousinEU false
181.61.106.93
 unknown Colombia
10620 TelmexColombiaSACO false
175.5.178.64
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
162.236.64.255
 unknown United States
7018 ATT-INTERNET4US false
74.70.14.183
 unknown United States
11351 TWC-11351-NORTHEASTUS false
36.177.181.93
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
166.81.233.153
 unknown Hong Kong
58681 NSWPOLSERV-AS-APNewSouthWalesPoliceAU false
102.168.228.87
 unknown Tunisia
37693 TUNISIANATN false
210.174.254.91
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
206.79.161.123
 unknown United States
3561 CENTURYLINK-LEGACY-SAVVISUS false
133.184.57.109
 unknown Japan 385 AFCONC-BLOCK1-ASUS false
13.78.100.150
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
53.123.103.129
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
34.235.17.79
 unknown United States
14618 AMAZON-AESUS false
168.142.106.64
 unknown South Africa
3741 ISZA false
250.241.123.242
 unknown Reserved
unknown unknown false
78.102.109.142
 unknown Czech Republic
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
114.245.90.223
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
198.143.224.119
 unknown United States
7029 WINDSTREAMUS false
98.150.97.111
 unknown United States
20001 TWC-20001-PACWESTUS false
252.36.68.9
 unknown Reserved
unknown unknown false
80.93.71.84
 unknown Italy
8660 MATRIX-ASIT false
96.223.138.186
 unknown United States
7922 COMCAST-7922US false
186.1.226.65
 unknown Argentina
52251 NORTECHAR false
93.171.158.31
 unknown Czech Republic
51214 VIKS-NETRU false
62.137.190.139
 unknown United Kingdom
12337 NORIS-NETWORKITServiceProviderlocatedinNuernbergGerm false
44.144.226.157
 unknown United States
62383 LDS-ASBE false
62.184.189.86
 unknown European Union
34456 RIALCOM-ASRU false
48.99.4.215
 unknown United States
2686 ATGS-MMD-ASUS false
175.178.176.179
 unknown China
10139 SMARTBRO-PH-APSmartBroadbandIncPH false
18.2.137.223
 unknown United States
10578 GIGAPOP-NEUS false
117.31.78.188
 unknown China
133776 CHINATELECOM-FUJIAN-QUANZHOU-IDC1QuanzhouCN false
125.188.78.204
 unknown Korea Republic of
17858 POWERVIS-AS-KRLGPOWERCOMMKR false
146.176.50.214
 unknown United Kingdom
786 JANETJiscServicesLimitedGB false
97.5.23.186
 unknown United States
22394 CELLCOUS false
12.30.164.110
 unknown United States
7018 ATT-INTERNET4US false
95.187.247.93
 unknown Saudi Arabia
39891 ALJAWWALSTC-ASSA false
200.185.14.59
 unknown Brazil
16685 TIVITTERCEIRIZACAODEPROCESSOSSERVETECSABR false
207.185.130.84
 unknown United States
32190 ADS-17-32190US false
80.212.212.251
 unknown Norway
2119 TELENOR-NEXTELTelenorNorgeASNO false
107.223.24.13
 unknown United States
7018 ATT-INTERNET4US false
80.73.56.189
 unknown Sweden
61207 ILAITSE false
126.225.23.158
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
245.183.75.66
 unknown Reserved
unknown unknown false
76.73.6.91
 unknown United States
25921 LUS-FIBER-LCGUS false
208.223.7.209
 unknown United States
701 UUNETUS false
177.227.164.209
 unknown Mexico
13999 MegaCableSAdeCVMX false
38.212.25.210
 unknown United States
174 COGENT-174US false
89.173.190.161
 unknown Slovakia (SLOVAK Republic)
6830 LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding false
183.34.238.76
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
59.218.244.81
 unknown China
2516 KDDIKDDICORPORATIONJP false
64.228.69.165
 unknown Canada
577 BACOMCA false
121.135.157.171
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
181.99.79.250
 unknown Argentina
7303 TelecomArgentinaSAAR false
80.226.137.149
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
186.152.31.245
 unknown Argentina
7303 TelecomArgentinaSAAR false
166.7.152.45
 unknown United States
4152 USDA-1US false
121.124.149.157
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
93.38.40.119
 unknown Italy
12874 FASTWEBIT false
4.93.36.127
 unknown United States
3356 LEVEL3US false
40.181.174.131
 unknown United States
4249 LILLY-ASUS false
149.255.185.253
 unknown United Kingdom
15830 EQUINIX-CONNECT-EMEAGB false
240.98.94.16
 unknown Reserved
unknown unknown false
17.127.80.64
 unknown United States
714 APPLE-ENGINEERINGUS false
175.254.132.129
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
192.153.62.184
 unknown United States
600 OARNET-ASUS false
100.224.211.219
 unknown United States
21928 T-MOBILE-AS21928US false
89.23.58.81
 unknown Russian Federation
43404 UCARU-ASRU false
19.255.124.150
 unknown United States
3 MIT-GATEWAYSUS false
112.96.135.205
 unknown China
17622 CNCGROUP-GZChinaUnicomGuangzhounetworkCN false
142.254.118.69
 unknown United States
46375 AS-SONICTELECOMUS false
176.216.157.226
 unknown Turkey
8386 KOCNETTR false