Linux Analysis Report
sora.x86.elf

Overview

General Information

Sample name: sora.x86.elf
Analysis ID: 1561520
MD5: 6199ca46e9c49353b131e3ea478f8832
SHA1: 60306a983089cb8e2a06b8f60c5644d52d713a39
SHA256: cb58d0eb997895fc02813aec7dee3600d67810ffaecb42b86f97130e541674f4
Tags: elfuser-abuse_ch
Infos:

Detection

Mirai
Score: 72
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Machine Learning detection for sample
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample tries to kill a process (SIGKILL)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: sora.x86.elf ReversingLabs: Detection: 65%
Machine Learning detection for sample
Source: sora.x86.elf Joe Sandbox ML: detected
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.15:40086 -> 45.95.169.104:1312
Source: unknown TCP traffic detected without corresponding DNS query: 45.95.169.104
Source: unknown TCP traffic detected without corresponding DNS query: 24.86.52.153
Source: unknown TCP traffic detected without corresponding DNS query: 166.157.92.153
Source: unknown TCP traffic detected without corresponding DNS query: 2.42.12.83
Source: unknown TCP traffic detected without corresponding DNS query: 72.158.23.152
Source: unknown TCP traffic detected without corresponding DNS query: 2.197.161.228
Source: unknown TCP traffic detected without corresponding DNS query: 73.12.5.192
Source: unknown TCP traffic detected without corresponding DNS query: 125.219.232.118
Source: unknown TCP traffic detected without corresponding DNS query: 157.86.141.86
Source: unknown TCP traffic detected without corresponding DNS query: 126.165.238.42
Source: unknown TCP traffic detected without corresponding DNS query: 219.125.228.110
Source: unknown TCP traffic detected without corresponding DNS query: 168.61.209.80
Source: unknown TCP traffic detected without corresponding DNS query: 115.114.131.32
Source: unknown TCP traffic detected without corresponding DNS query: 79.180.41.80
Source: unknown TCP traffic detected without corresponding DNS query: 57.41.200.163
Source: unknown TCP traffic detected without corresponding DNS query: 182.45.107.52
Source: unknown TCP traffic detected without corresponding DNS query: 62.155.104.80
Source: unknown TCP traffic detected without corresponding DNS query: 104.162.68.255
Source: unknown TCP traffic detected without corresponding DNS query: 254.214.106.6
Source: unknown TCP traffic detected without corresponding DNS query: 153.50.169.93
Source: unknown TCP traffic detected without corresponding DNS query: 32.41.204.9
Source: unknown TCP traffic detected without corresponding DNS query: 39.145.108.162
Source: unknown TCP traffic detected without corresponding DNS query: 172.156.235.120
Source: unknown TCP traffic detected without corresponding DNS query: 180.46.91.85
Source: unknown TCP traffic detected without corresponding DNS query: 84.140.184.250
Source: unknown TCP traffic detected without corresponding DNS query: 80.225.9.107
Source: unknown TCP traffic detected without corresponding DNS query: 252.31.36.236
Source: unknown TCP traffic detected without corresponding DNS query: 90.95.104.219
Source: unknown TCP traffic detected without corresponding DNS query: 250.237.126.78
Source: unknown TCP traffic detected without corresponding DNS query: 177.207.79.196
Source: unknown TCP traffic detected without corresponding DNS query: 142.104.32.81
Source: unknown TCP traffic detected without corresponding DNS query: 116.74.95.102
Source: unknown TCP traffic detected without corresponding DNS query: 173.71.92.158
Source: unknown TCP traffic detected without corresponding DNS query: 118.194.82.140
Source: unknown TCP traffic detected without corresponding DNS query: 120.200.43.82
Source: unknown TCP traffic detected without corresponding DNS query: 81.94.85.111
Source: unknown TCP traffic detected without corresponding DNS query: 253.108.219.197
Source: unknown TCP traffic detected without corresponding DNS query: 16.3.45.60
Source: unknown TCP traffic detected without corresponding DNS query: 69.40.154.221
Source: unknown TCP traffic detected without corresponding DNS query: 168.128.143.229
Source: unknown TCP traffic detected without corresponding DNS query: 153.180.195.234
Source: unknown TCP traffic detected without corresponding DNS query: 62.132.167.132
Source: unknown TCP traffic detected without corresponding DNS query: 220.208.181.243
Source: unknown TCP traffic detected without corresponding DNS query: 240.11.88.56
Source: unknown TCP traffic detected without corresponding DNS query: 20.91.168.90
Source: unknown TCP traffic detected without corresponding DNS query: 84.208.128.114
Source: unknown TCP traffic detected without corresponding DNS query: 68.226.225.89
Source: unknown TCP traffic detected without corresponding DNS query: 92.191.232.158
Source: unknown TCP traffic detected without corresponding DNS query: 205.216.175.93
Source: unknown TCP traffic detected without corresponding DNS query: 91.133.63.150
Source: global traffic DNS traffic detected: DNS query: daisy.ubuntu.com
Source: sora.x86.elf String found in binary or memory: http://upx.sf.net

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0xc01000
Sample tries to kill a process (SIGKILL)
Source: /tmp/sora.x86.elf (PID: 5591) SIGKILL sent: pid: 933, result: successful Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) SIGKILL sent: pid: 933, result: successful Jump to behavior
Yara signature match
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: classification engine Classification label: mal72.troj.evad.linELF@0/0@10/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/490/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/793/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/794/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/850/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/796/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/777/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/931/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/658/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/779/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/812/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/933/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/917/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/5591/exe Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/782/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/764/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/766/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/723/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/789/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/800/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/888/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/724/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/802/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/803/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5591) File opened: /proc/804/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/490/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/793/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/794/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/850/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/796/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/777/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/931/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/658/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/779/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/812/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/933/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/917/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/5594/exe Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/782/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/1/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/764/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/766/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/723/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/789/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/800/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/888/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/724/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/802/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/803/fd Jump to behavior
Source: /tmp/sora.x86.elf (PID: 5594) File opened: /proc/804/fd Jump to behavior
ELF contains segments with high entropy indicating compressed/encrypted content
Source: sora.x86.elf Submission file: segment LOAD with 7.8709 entropy (max. 8.0)

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 5723.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5592.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5710.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5715.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5590.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5595.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5591.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 5707.1.0000000008048000.0000000008057000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
130.32.76.121
 unknown United Kingdom
15601 BaringInvestmentServicesGB false
93.182.85.138
 unknown Turkey
44558 NETONLINETR false
113.181.189.118
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN false
189.43.200.159
 unknown Brazil
4230 CLAROSABR false
85.173.111.157
 unknown Russian Federation
43132 KBT-ASBranchformerKabbalktelecomRU false
202.223.118.186
 unknown Japan 2527 SO-NETSo-netEntertainmentCorporationJP false
157.161.177.152
 unknown Switzerland
6772 IMPNET-ASCH false
157.125.160.228
 unknown Sweden
31655 ASN-GAMMATELECOMGB false
136.18.177.245
 unknown United States
60311 ONEFMCH false
195.158.190.32
 unknown Germany
20676 PLUSNETDE false
100.173.129.158
 unknown United States
21928 T-MOBILE-AS21928US false
90.141.207.159
 unknown Sweden
39651 COMHEM-SWEDENSE false
2.11.201.137
 unknown France
3215 FranceTelecom-OrangeFR false
114.14.51.58
 unknown Indonesia
56046 CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN false
217.212.229.231
 unknown Sweden
1299 TELIANETTeliaCarrierEU false
4.58.123.111
 unknown United States
3356 LEVEL3US false
195.143.61.82
 unknown United Kingdom
8928 INTEROUTE25CanadaSquareCanaryWharf31stFloorGB false
93.133.173.207
 unknown Germany
6805 TDDE-ASN1DE false
195.19.76.32
 unknown Russian Federation
47503 NTCITROSA-ASRU false
162.25.3.77
 unknown Austria
197636 BAGIS-ASAS1764NextLayerAT false
45.2.32.82
 unknown Canada
7311 FRONTIERCA false
109.12.57.83
 unknown France
15557 LDCOMNETFR false
54.22.206.157
 unknown United States
14618 AMAZON-AESUS false
73.40.192.128
 unknown United States
7922 COMCAST-7922US false
68.31.46.69
 unknown United States
10507 SPCSUS false
34.221.248.6
 unknown United States
16509 AMAZON-02US false
76.160.56.241
 unknown United States
7029 WINDSTREAMUS false
189.219.27.127
 unknown Mexico
265594 TelevisionInternacionalSAdeCVMX false
174.38.70.156
 unknown United States
22394 CELLCOUS false
185.85.81.7
 unknown Netherlands
202120 COMSAVE-ASNL false
142.64.238.7
 unknown Canada
5769 VIDEOTRONCA false
155.196.171.183
 unknown Sudan
37197 SUDRENSD false
104.140.201.50
 unknown United States
62904 EONIX-COMMUNICATIONS-ASBLOCK-62904US false
179.153.48.17
 unknown Brazil
28573 CLAROSABR false
254.84.81.217
 unknown Reserved
unknown unknown false
202.164.222.145
 unknown Indonesia
45288 CYBER512-AS-IDKOMUNIKALIMADUABELASPTID false
166.43.38.178
 unknown United States
3372 MCI-ASNUS false
37.150.27.35
 unknown Kazakhstan
9198 KAZTELECOM-ASKZ false
150.158.191.54
 unknown China
45090 CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa false
124.73.249.106
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
2.11.201.160
 unknown France
3215 FranceTelecom-OrangeFR false
57.237.12.143
 unknown Belgium
2686 ATGS-MMD-ASUS false
104.205.179.251
 unknown Canada
852 ASN852CA false
204.83.235.104
 unknown Canada
803 SASKTELCA false
197.252.28.254
 unknown Sudan
15706 SudatelSD false
79.24.218.178
 unknown Italy
3269 ASN-IBSNAZIT false
53.52.219.64
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
45.158.40.106
 unknown Germany
208135 FLUEPKE-NETBlahaj3DE false
88.16.29.74
 unknown Spain
3352 TELEFONICA_DE_ESPANAES false
170.181.187.25
 unknown United States
11685 HNBCOL-ASUS false
145.20.164.130
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
213.195.65.150
 unknown Spain
15915 IBERCOMES false
57.79.150.60
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
207.105.217.18
 unknown United States
7018 ATT-INTERNET4US false
135.99.199.237
 unknown United States
18676 AVAYAUS false
1.155.226.237
 unknown Australia
1221 ASN-TELSTRATelstraCorporationLtdAU false
157.15.151.199
 unknown unknown
2512 TCP-NETTCPIncJP false
79.18.155.214
 unknown Italy
3269 ASN-IBSNAZIT false
203.105.122.152
 unknown China
2914 NTT-COMMUNICATIONS-2914US false
92.98.133.71
 unknown United Arab Emirates
5384 EMIRATES-INTERNETEmiratesInternetAE false
213.225.83.148
 unknown Norway
25400 TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO false
163.105.78.253
 unknown France
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
19.246.207.204
 unknown United States
3 MIT-GATEWAYSUS false
169.162.6.4
 unknown United States
37611 AfrihostZA false
157.113.138.107
 unknown Japan 9993 CTC-ODCITOCHUTechno-SolutionsCorporationJP false
245.151.42.10
 unknown Reserved
unknown unknown false
113.128.153.213
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
194.22.157.147
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
53.70.141.238
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
81.79.36.29
 unknown United Kingdom
3269 ASN-IBSNAZIT false
40.53.69.11
 unknown United States
4249 LILLY-ASUS false
36.126.70.96
 unknown China
4847 CNIX-APChinaNetworksInter-ExchangeCN false
195.203.1.173
 unknown Germany
15854 HP_WEBSERVICESDE false
112.252.196.72
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
81.170.168.43
 unknown Sweden
8473 BAHNHOFhttpwwwbahnhofnetSE false
16.193.214.48
 unknown United States
unknown unknown false
84.45.15.219
 unknown United Kingdom
56990 SYSCOMMGB false
106.238.35.190
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
20.74.225.207
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
61.111.17.40
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR false
223.212.24.239
 unknown China
17962 TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCN false
201.11.89.180
 unknown Brazil
8167 BrasilTelecomSA-FilialDistritoFederalBR false
203.216.198.68
 unknown Japan 9607 BBTOWERBroadBandTowerIncJP false
63.73.210.34
 unknown United States
701 UUNETUS false
87.178.105.203
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
104.170.219.167
 unknown United States
36352 AS-COLOCROSSINGUS false
136.18.177.227
 unknown United States
60311 ONEFMCH false
101.127.49.23
 unknown Singapore
55430 STARHUB-NGNBNStarhubLtdSG false
157.136.46.255
 unknown France
2200 FR-RENATERReseauNationaldetelecommunicationspourlaTec false
223.148.241.89
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
92.35.21.203
 unknown Sweden
2119 TELENOR-NEXTELTelenorNorgeASNO false
203.27.8.77
 unknown Australia
2764 AAPTAAPTLimitedAU false
179.216.80.190
 unknown Brazil
28573 CLAROSABR false
204.237.205.137
 unknown United States
20940 AKAMAI-ASN1EU false
84.9.214.24
 unknown United Kingdom
25310 ASN-CWACCESSGB false
81.6.84.42
 unknown Turkey
15897 VODAFONETURKEYTR false
79.101.206.71
 unknown Serbia
8400 TELEKOM-ASRS false
193.47.67.163
 unknown Italy
213311 SS-NLDNL false
192.253.43.30
 unknown United States
394384 EDGE-BROADBANDUS false
101.25.124.11
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true