Linux Analysis Report
sora.spc.elf

Overview

General Information

Sample name: sora.spc.elf
Analysis ID: 1561517
MD5: faad3a49526c0e7a580399ead1fdb33c
SHA1: 5b07a05ca5a2e8b14551600182116b4f7968b107
SHA256: bf1d0389d8d6bc42c18d8855bd32c195a0c2d18b83829d87caa0bd24cb241a23
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample tries to kill multiple processes (SIGKILL)
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: sora.spc.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: sora.spc.elf ReversingLabs: Detection: 65%
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:40076 -> 45.95.169.104:1312
Sample listens on a socket
Source: /tmp/sora.spc.elf (PID: 5520) Socket: 0.0.0.0:0 Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) Socket: 0.0.0.0:23 Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) Socket: 0.0.0.0:53413 Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) Socket: 0.0.0.0:80 Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) Socket: 0.0.0.0:52869 Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) Socket: 0.0.0.0:37215 Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) Socket: 0.0.0.0:0 Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) Socket: 0.0.0.0:23 Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) Socket: 0.0.0.0:53413 Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) Socket: 0.0.0.0:80 Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) Socket: 0.0.0.0:52869 Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) Socket: 0.0.0.0:37215 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown TCP traffic detected without corresponding DNS query: 34.145.127.198
Source: unknown TCP traffic detected without corresponding DNS query: 5.89.23.198
Source: unknown TCP traffic detected without corresponding DNS query: 39.255.129.196
Source: unknown TCP traffic detected without corresponding DNS query: 156.41.193.157
Source: unknown TCP traffic detected without corresponding DNS query: 240.243.119.241
Source: unknown TCP traffic detected without corresponding DNS query: 23.198.88.140
Source: unknown TCP traffic detected without corresponding DNS query: 136.147.229.125
Source: unknown TCP traffic detected without corresponding DNS query: 157.84.245.39
Source: unknown TCP traffic detected without corresponding DNS query: 208.221.198.93
Source: unknown TCP traffic detected without corresponding DNS query: 111.184.96.7
Source: unknown TCP traffic detected without corresponding DNS query: 109.121.188.38
Source: unknown TCP traffic detected without corresponding DNS query: 70.9.206.192
Source: unknown TCP traffic detected without corresponding DNS query: 46.234.206.24
Source: unknown TCP traffic detected without corresponding DNS query: 146.89.92.43
Source: unknown TCP traffic detected without corresponding DNS query: 8.137.62.62
Source: unknown TCP traffic detected without corresponding DNS query: 54.134.7.104
Source: unknown TCP traffic detected without corresponding DNS query: 89.228.117.171
Source: unknown TCP traffic detected without corresponding DNS query: 48.156.85.132
Source: unknown TCP traffic detected without corresponding DNS query: 248.113.131.239
Source: unknown TCP traffic detected without corresponding DNS query: 125.44.9.16
Source: unknown TCP traffic detected without corresponding DNS query: 95.249.222.221
Source: unknown TCP traffic detected without corresponding DNS query: 85.193.78.183
Source: unknown TCP traffic detected without corresponding DNS query: 13.8.89.109
Source: unknown TCP traffic detected without corresponding DNS query: 116.25.117.127
Source: unknown TCP traffic detected without corresponding DNS query: 69.120.29.88
Source: unknown TCP traffic detected without corresponding DNS query: 119.7.167.176
Source: unknown TCP traffic detected without corresponding DNS query: 180.61.107.246
Source: unknown TCP traffic detected without corresponding DNS query: 220.164.196.105
Source: unknown TCP traffic detected without corresponding DNS query: 163.157.128.151
Source: unknown TCP traffic detected without corresponding DNS query: 118.76.134.112
Source: unknown TCP traffic detected without corresponding DNS query: 177.211.226.128
Source: unknown TCP traffic detected without corresponding DNS query: 105.136.204.12
Source: unknown TCP traffic detected without corresponding DNS query: 85.19.85.250
Source: unknown TCP traffic detected without corresponding DNS query: 247.159.29.119
Source: unknown TCP traffic detected without corresponding DNS query: 204.173.116.82
Source: unknown TCP traffic detected without corresponding DNS query: 35.72.246.123
Source: unknown TCP traffic detected without corresponding DNS query: 103.105.100.135
Source: unknown TCP traffic detected without corresponding DNS query: 53.28.215.115
Source: unknown TCP traffic detected without corresponding DNS query: 83.213.66.190
Source: unknown TCP traffic detected without corresponding DNS query: 142.77.254.73
Source: unknown TCP traffic detected without corresponding DNS query: 243.154.150.168
Source: unknown TCP traffic detected without corresponding DNS query: 192.149.208.63
Source: unknown TCP traffic detected without corresponding DNS query: 112.56.179.156
Source: unknown TCP traffic detected without corresponding DNS query: 106.66.213.106
Source: unknown TCP traffic detected without corresponding DNS query: 24.31.53.4
Source: unknown TCP traffic detected without corresponding DNS query: 167.59.151.175
Source: unknown TCP traffic detected without corresponding DNS query: 23.64.9.242
Source: unknown TCP traffic detected without corresponding DNS query: 2.195.189.102
Source: unknown TCP traffic detected without corresponding DNS query: 126.201.37.54

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: sora.spc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: sora.spc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5545.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5545.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5518.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5518.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5552.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5552.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5520.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5520.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5549.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5549.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5546.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5546.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5529.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5529.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5521.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5521.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5553.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5553.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5556.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5556.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5551.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5551.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5559.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5559.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5527.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5527.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5518, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5518, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5520, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5520, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5521, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5521, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5527, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5529, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5529, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5545, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5545, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5546, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5546, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5549, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5549, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5551, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5551, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5552, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5552, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5553, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5556, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5556, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5559, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: sora.spc.elf PID: 5559, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/sora.spc.elf (PID: 5520) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 5546, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 723, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 764, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 793, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 804, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 850, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 888, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 1431, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 1432, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3044, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3047, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3055, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3273, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3275, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3278, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3368, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3394, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3456, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3461, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3465, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3469, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3475, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 5529, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 5549, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 5553, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 5556, result: successful Jump to behavior
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/sora.spc.elf (PID: 5520) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 5546, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 723, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 764, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 793, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 804, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 850, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 888, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 1431, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 1432, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3044, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3047, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3055, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3273, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3275, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3278, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3368, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3394, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3456, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3461, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3465, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3469, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 3475, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 5529, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 5549, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 5553, result: successful Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) SIGKILL sent: pid: 5556, result: successful Jump to behavior
Yara signature match
Source: sora.spc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: sora.spc.elf, type: SAMPLE Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5545.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5545.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5518.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5518.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5552.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5552.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5520.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5520.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5549.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5549.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5546.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5546.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5529.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5529.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5521.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5521.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5553.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5553.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5556.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5556.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5551.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5551.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5559.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5559.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5527.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5527.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5518, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5518, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5520, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5520, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5521, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5521, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5527, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5529, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5529, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5545, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5545, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5546, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5546, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5549, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5549, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5551, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5551, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5552, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5552, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5553, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5556, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5556, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5559, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: sora.spc.elf PID: 5559, type: MEMORYSTR Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: classification engine Classification label: mal76.spre.troj.linELF@0/0@0/0
Enumerates processes within the "proc" file system
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/490/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/793/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/794/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/850/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/796/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/777/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/931/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/658/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/779/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/812/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/933/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/917/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/782/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/764/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/766/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/723/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/789/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/800/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/888/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/724/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/802/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/803/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5520) File opened: /proc/804/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1185/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3241/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3241/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3483/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3483/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1732/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1732/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1730/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1730/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1333/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1333/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1695/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1695/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3235/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3235/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3234/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3234/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/515/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/911/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1617/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1617/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/914/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1615/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1615/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/917/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/917/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/917/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/917/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/5552/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/5553/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3255/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3255/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3253/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3253/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1591/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1591/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3252/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3252/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3251/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3251/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3250/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3250/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3803/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1623/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1588/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1588/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3249/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3249/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/764/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/764/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/764/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/764/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3368/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3368/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1585/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1585/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3246/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3246/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3488/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/3488/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/766/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/766/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/766/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/766/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/800/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/800/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/800/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/800/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/888/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/888/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/888/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/888/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/802/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/802/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/802/exe Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/802/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1509/fd Jump to behavior
Source: /tmp/sora.spc.elf (PID: 5526) File opened: /proc/1509/exe Jump to behavior
Executes the "rm" command used to delete files or directories
Source: /usr/bin/dash (PID: 5507) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.413PjLJr6s /tmp/tmp.xdGHkuHanB /tmp/tmp.mESHpqsfBL Jump to behavior
Source: /usr/bin/dash (PID: 5508) Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.413PjLJr6s /tmp/tmp.xdGHkuHanB /tmp/tmp.mESHpqsfBL Jump to behavior
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/sora.spc.elf (PID: 5518) Queries kernel information via 'uname': Jump to behavior
Source: sora.spc.elf, 5518.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5520.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5545.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5546.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5549.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5552.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5556.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5551.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5553.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5521.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5559.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5527.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5529.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/sora.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/sora.spc.elf
Source: sora.spc.elf, 5518.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5520.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5545.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5546.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5549.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5552.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5556.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5551.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5553.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5521.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5559.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5527.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5529.1.00005595024b7000.000055950253c000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sparc
Source: sora.spc.elf, 5518.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5520.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5545.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5546.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5549.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5552.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5556.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5551.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5553.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5521.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5559.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5527.1.00005595024b7000.000055950253c000.rw-.sdmp, sora.spc.elf, 5529.1.00005595024b7000.000055950253c000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: sora.spc.elf, 5559.1.000055950253c000.000055950255d000.rw-.sdmp Binary or memory string: /usr/bin/vmtoolsd
Source: sora.spc.elf, 5559.1.000055950253c000.000055950255d000.rw-.sdmp Binary or memory string: U/sparc/10 /proc/3241/fd/60!/proc/3188/fd/111/usr/bin/qemu-sparcrc/10!/proc/3241/fd/50!/proc/3188/fd/121
Source: sora.spc.elf, 5559.1.000055950253c000.000055950255d000.rw-.sdmp Binary or memory string: U/sparc/10 /proc/3272/fd/60!/proc/3060/fd/561/usr/bin/vmtoolsdparc/10!/proc/3272/fd/50!/proc/3060/fd/571
Source: sora.spc.elf, 5518.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5520.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5545.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5546.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5549.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5552.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5556.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5551.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5553.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5521.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5559.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5559.1.000055950253c000.000055950255d000.rw-.sdmp, sora.spc.elf, 5527.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp, sora.spc.elf, 5529.1.00007ffebcb4b000.00007ffebcb6c000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: sora.spc.elf, type: SAMPLE
Source: Yara match File source: 5545.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5518.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5552.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5520.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5549.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5546.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5529.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5521.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5553.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5556.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5551.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5559.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5527.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: sora.spc.elf, type: SAMPLE
Source: Yara match File source: 5545.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5518.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5552.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5520.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5549.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5546.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5529.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5521.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5553.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5556.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5551.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5559.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5527.1.00007fcfd8011000.00007fcfd8023000.r-x.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.127.23.179
 unknown Poland
199517 INTERMATIKPL false
255.248.177.175
 unknown Reserved
unknown unknown false
154.62.186.135
 unknown United States
174 COGENT-174US false
79.67.224.251
 unknown United Kingdom
9105 TISCALI-UKTalkTalkCommunicationsLimitedGB false
240.120.181.204
 unknown Reserved
unknown unknown false
183.6.127.3
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
170.248.162.27
 unknown India
21433 ACCENTUREFSSCLondonDCGB false
203.120.64.241
 unknown Japan 4637 ASN-TELSTRA-GLOBALTelstraGlobalHK false
133.157.211.84
 unknown Japan 38634 DWANGODWANGOCoLtdJP false
32.201.156.107
 unknown United States
2686 ATGS-MMD-ASUS false
243.55.182.85
 unknown Reserved
unknown unknown false
222.174.254.119
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
39.120.100.66
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
78.29.47.65
 unknown Russian Federation
8369 INTERSVYAZ-AS38-BKomsomolskyprospektRU false
188.32.171.244
 unknown Russian Federation
42610 NCNET-ASRU false
39.252.1.22
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
89.186.65.127
 unknown Italy
5602 AS-IRIDEOS-KPIT false
12.146.141.135
 unknown United States
7018 ATT-INTERNET4US false
145.99.115.160
 unknown Netherlands
1101 IP-EEND-ASIP-EENDBVNL false
220.143.72.169
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
130.20.230.29
 unknown United States
3428 ESNET-ASUS false
196.107.23.177
 unknown Kenya
33771 SAFARICOM-LIMITEDKE false
221.191.185.87
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
120.111.251.239
 unknown Taiwan; Republic of China (ROC)
17716 NTU-TWNationalTaiwanUniversityTW false
195.99.145.240
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
201.129.155.178
 unknown Mexico
8151 UninetSAdeCVMX false
107.231.116.161
 unknown United States
20057 ATT-MOBILITY-LLC-AS20057US false
122.250.79.165
 unknown Japan 18077 C-ABLEYamaguchiCableVisionCoLtdJP false
23.254.189.223
 unknown United States
54290 HOSTWINDSUS false
219.112.241.104
 unknown Japan 7514 MEXComputerEngineeringConsultingLtdJP false
17.117.4.139
 unknown United States
714 APPLE-ENGINEERINGUS false
203.207.247.216
 unknown China
17964 DXTNETBeijingDian-Xin-TongNetworkTechnologiesCoLtd false
255.133.42.201
 unknown Reserved
unknown unknown false
245.191.24.230
 unknown Reserved
unknown unknown false
190.112.213.127
 unknown Paraguay
263228 PLANETSAPY false
118.98.166.172
 unknown Indonesia
18051 JARDIKNAS-AS-APPustekkomID false
4.36.107.41
 unknown United States
3356 LEVEL3US false
245.124.246.192
 unknown Reserved
unknown unknown false
193.162.141.28
 unknown Denmark
1935 FR-RENATER-LIMOUSINReseauRegionalLimousinEU false
186.147.3.102
 unknown Colombia
10620 TelmexColombiaSACO false
183.109.186.152
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
19.190.240.59
 unknown United States
3 MIT-GATEWAYSUS false
133.237.234.248
 unknown Japan 23820 RAKUTENRakutenIncJP false
153.177.50.117
 unknown Japan 4713 OCNNTTCommunicationsCorporationJP false
115.148.215.124
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
72.3.186.10
 unknown United States
33070 RMH-14US false
45.182.28.157
 unknown Argentina
265816 DELCOIMAGENSAAR false
18.182.10.192
 unknown United States
16509 AMAZON-02US false
65.195.172.153
 unknown United States
701 UUNETUS false
149.4.146.125
 unknown United States
31822 CITY-UNIVERSITY-OF-NEW-YORKUS false
39.137.88.230
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
59.122.154.54
 unknown Taiwan; Republic of China (ROC)
3462 HINETDataCommunicationBusinessGroupTW false
167.29.26.191
 unknown United States
14303 MEMASN1US false
53.23.29.254
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
223.209.141.28
 unknown China
7497 CSTNET-AS-APComputerNetworkInformationCenterCN false
83.55.90.210
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
255.182.145.105
 unknown Reserved
unknown unknown false
118.137.152.123
 unknown Indonesia
23700 FASTNET-AS-IDLinknet-FastnetASNID false
20.190.241.21
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
189.59.62.33
 unknown Brazil
18881 TELEFONICABRASILSABR false
245.107.139.164
 unknown Reserved
unknown unknown false
17.177.7.51
 unknown United States
714 APPLE-ENGINEERINGUS false
163.22.58.87
 unknown Taiwan; Republic of China (ROC)
1659 ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC false
197.69.60.19
 unknown South Africa
16637 MTNNS-ASZA false
58.134.74.39
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
58.166.71.76
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
88.240.106.216
 unknown Turkey
9121 TTNETTR false
70.143.168.171
 unknown United States
25993 AS-25993US false
57.175.156.177
 unknown Belgium
2686 ATGS-MMD-ASUS false
68.211.171.217
 unknown United States
6389 BELLSOUTH-NET-BLKUS false
245.124.158.3
 unknown Reserved
unknown unknown false
249.172.233.246
 unknown Reserved
unknown unknown false
164.200.230.214
 unknown United States
3303 SWISSCOMSwisscomSwitzerlandLtdCH false
252.243.8.163
 unknown Reserved
unknown unknown false
92.211.13.36
 unknown Germany
3209 VODANETInternationalIP-BackboneofVodafoneDE false
98.37.223.163
 unknown United States
7922 COMCAST-7922US false
105.191.121.138
 unknown Morocco
36925 ASMediMA false
73.15.246.110
 unknown United States
7922 COMCAST-7922US false
99.186.218.154
 unknown United States
7018 ATT-INTERNET4US false
110.59.178.109
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
168.250.156.166
 unknown United States
4241 CSFTBUS false
101.228.227.61
 unknown China
4812 CHINANET-SH-APChinaTelecomGroupCN false
99.7.155.84
 unknown United States
7018 ATT-INTERNET4US false
86.84.87.51
 unknown Netherlands
1136 KPNKPNNationalEU false
61.38.180.171
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
40.10.91.129
 unknown United States
4249 LILLY-ASUS false
126.124.50.231
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
185.183.23.68
 unknown United Kingdom
43872 OPTINETGB false
167.112.151.39
 unknown United States
2055 LSU-1US false
251.107.90.63
 unknown Reserved
unknown unknown false
219.248.231.24
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
46.109.64.7
 unknown Latvia
12578 APOLLO-ASLatviaLV false
149.228.102.33
 unknown Germany
702 UUNETUS false
249.61.80.44
 unknown Reserved
unknown unknown false
177.130.157.61
 unknown Brazil
28202 RedeBrasileiradeComunicacaoLtdaBR false
75.101.9.192
 unknown United States
7065 SONOMAUS false
223.43.152.174
 unknown Korea Republic of
9644 SKTELECOM-NET-ASSKTelecomKR false
171.157.23.140
 unknown United States
9874 STARHUB-MOBILEStarHubLtdSG false
248.157.178.214
 unknown Reserved
unknown unknown false
73.107.145.69
 unknown United States
7922 COMCAST-7922US false