Summary

boatnet.arc

File boatnet.arc

Summary
Download Resubmit sample

Size 105.3KB
Type ELF 32-bit LSB executable, Synopsys ARCompact ARC700 cores, version 1 (SYSV), statically linked, stripped
MD5 d34f92e25831ca46cd46742a73d3d14b
SHA1 07a8c92875b95cedc56d9ad74cd120d1322133ae
SHA256 ca41a0e191c740b75e116d3dfe2e79de0928f88da4330585a9cab197f5ccb555
SHA512
cd73380c5280614dc4c31a699d8307a1255e0d4ad08a238c40ec69b9f044e8e7e98b1003f399daa2e2ee74e336e1fdb0368205adfa9fa6f35fc57c43516575d6
CRC32 CA0EDF5D
ssdeep None
Yara None matched

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE Dec. 25, 2024, 8:56 p.m. Dec. 25, 2024, 8:58 p.m. 83 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2024-12-25 20:56:32,001 [root] DEBUG: Starting analyzer from: /tmp/tmp8HT821
2024-12-25 20:56:32,001 [root] DEBUG: Storing results at: /tmp/fkrKnvRzKO
2024-12-25 20:56:34,070 [modules.auxiliary.filecollector] INFO: FileCollector started v0.08
2024-12-25 20:56:34,072 [modules.auxiliary.human] INFO: Human started v0.02
2024-12-25 20:56:34,575 [modules.auxiliary.screenshots] INFO: Screenshots started v0.03
2024-12-25 20:56:39,410 [lib.core.packages] INFO: Process startup took 4.83 seconds
2024-12-25 20:56:39,411 [root] INFO: Added new process to list with pid: 2064
2024-12-25 20:56:45,421 [root] INFO: Process with pid 2064 has terminated
2024-12-25 20:56:45,422 [root] INFO: Process list is empty, terminating analysis.
2024-12-25 20:56:48,424 [lib.core.packages] INFO: Package requested stop
2024-12-25 20:56:48,425 [lib.core.packages] WARNING: Exception uploading log: [Errno 3] No such process

Cuckoo Log

2024-12-25 20:56:41,115 [cuckoo.core.scheduler] INFO: Task #5695864: acquired machine Ubuntu1904x645 (label=Ubuntu1904x645)
2024-12-25 20:56:41,115 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.105 for task #5695864
2024-12-25 20:56:41,351 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 291168 (interface=vboxnet0, host=192.168.168.105)
2024-12-25 20:56:41,373 [cuckoo.machinery.virtualbox] DEBUG: Starting vm Ubuntu1904x645
2024-12-25 20:56:41,892 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine Ubuntu1904x645 to Snapshot
2024-12-25 20:56:48,947 [cuckoo.core.guest] INFO: Starting analysis #5695864 on guest (id=Ubuntu1904x645, ip=192.168.168.105)
2024-12-25 20:56:49,953 [cuckoo.core.guest] DEBUG: Ubuntu1904x645: not ready yet
2024-12-25 20:56:54,980 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=Ubuntu1904x645, ip=192.168.168.105)
2024-12-25 20:56:55,006 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=Ubuntu1904x645, ip=192.168.168.105, monitor=latest, size=73219)
2024-12-25 20:56:55,251 [cuckoo.core.resultserver] DEBUG: Task #5695864: live log analysis.log initialized.
2024-12-25 20:57:00,399 [cuckoo.core.resultserver] DEBUG: Task #5695864: File upload for 'shots/0001.jpg'
2024-12-25 20:57:00,406 [cuckoo.core.resultserver] DEBUG: Task #5695864 uploaded file length: 171572
2024-12-25 20:57:10,216 [cuckoo.core.guest] DEBUG: Ubuntu1904x645: analysis #5695864 still processing
2024-12-25 20:57:11,659 [cuckoo.core.resultserver] DEBUG: Task #5695864: File upload for 'logs/all.stap'
2024-12-25 20:57:11,663 [cuckoo.core.resultserver] DEBUG: Task #5695864 uploaded file length: 1187
2024-12-25 20:57:25,447 [cuckoo.core.guest] DEBUG: Ubuntu1904x645: analysis #5695864 still processing
2024-12-25 20:57:40,586 [cuckoo.core.guest] DEBUG: Ubuntu1904x645: analysis #5695864 still processing
2024-12-25 20:57:55,681 [cuckoo.core.guest] INFO: Ubuntu1904x645: end of analysis reached!
2024-12-25 20:57:55,701 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2024-12-25 20:57:55,728 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2024-12-25 20:57:56,444 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label Ubuntu1904x645 to path /srv/cuckoo/cwd/storage/analyses/5695864/memory.dmp
2024-12-25 20:57:56,445 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm Ubuntu1904x645
2024-12-25 20:58:03,714 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.105 for task #5695864
2024-12-25 20:58:03,714 [cuckoo.core.resultserver] DEBUG: Cancel <Context for LOG> for task 5695864
2024-12-25 20:58:04,106 [cuckoo.core.scheduler] DEBUG: Released database task #5695864
2024-12-25 20:58:04,129 [cuckoo.core.scheduler] INFO: Task #5695864: analysis procedure completed

Signatures

File has been identified by 16 AntiVirus engine on IRMA as malicious (16 events)
G Data Antivirus (Windows) Virus: Trojan.Linux.GenericKDZ.198 (Engine A)
Avast Core Security (Linux) ELF:Agent-AYQ [Trj]
C4S ClamAV (Linux) Unix.Dropper.Mirai-7136013-0
F-Secure Antivirus (Linux) Exploit.EXP/ELF.Mirai.Z.A [Aquarius]
Windows Defender (Windows) Backdoor:Linux/Mirai.E!xp
Forticlient (Linux) ELF/Mirai.BTS!tr
Sophos Anti-Virus (Linux) Mal/Generic-S
eScan Antivirus (Linux) Trojan.Linux.GenericKDZ.198(DB)
ESET Security (Windows) Linux/Mirai.BTS trojan
McAfee CLI scanner (Linux) Linux/Mirai-FROZ
DrWeb Antivirus (Linux) Linux.Siggen.9999
Trend Micro SProtect (Linux) Backdoor.Linux.BASHLITE.SMJC11
ClamAV (Linux) Unix.Dropper.Mirai-7136013-0
Bitdefender Antivirus (Linux) Trojan.Linux.GenericKDZ.198
Kaspersky Standard (Windows) HEUR:Backdoor.Linux.Mirai.cw
Emsisoft Commandline Scanner (Windows) Trojan.Linux.GenericKDZ.198 (B)
File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)
Elastic Linux.Trojan.Gafgyt
Cynet Malicious (score: 99)
CTX elf.trojan.generickdz
Skyhigh Linux/Mirai-FROZ!D34F92E25831
ALYac Trojan.Linux.GenericKDZ.198
VIPRE Trojan.Linux.GenericKDZ.198
Sangfor Suspicious.Linux.Save.a
Arcabit Trojan.Linux.Generic.198
Symantec Linux.Mirai
ESET-NOD32 Linux/Mirai.BTS
TrendMicro-HouseCall Backdoor.Linux.BASHLITE.SMJC11
Avast ELF:Agent-AYQ [Trj]
ClamAV Unix.Dropper.Mirai-7136013-0
Kaspersky HEUR:Backdoor.Linux.Mirai.cw
BitDefender Trojan.Linux.GenericKDZ.198
MicroWorld-eScan Trojan.Linux.GenericKDZ.198
Rising Backdoor.Mirai/Linux!1.F3F6 (CLASSIC)
Emsisoft Trojan.Linux.GenericKDZ.198 (B)
F-Secure Exploit.EXP/ELF.Mirai.Z.A
DrWeb Linux.Siggen.9999
Zillya Trojan.Mirai.Linux.118979
TrendMicro Backdoor.Linux.BASHLITE.SMJC11
Ikarus Trojan.Linux.Mirai
FireEye Trojan.Linux.GenericKDZ.198
Jiangmin Backdoor.Linux.hzpz
Google Detected
Avira EXP/ELF.Mirai.Z.A
Antiy-AVL Trojan[Backdoor]/Linux.Mirai.cw
Kingsoft ELF.Troj.2024149
Microsoft Backdoor:Linux/Mirai.E!xp
Avast-Mobile ELF:Gafgyt-KS [Trj]
GData Trojan.Linux.GenericKDZ.198
Varist E32/Mirai.EH.gen!Camelot
AhnLab-V3 Linux/Mirai.Gen35
Tencent Backdoor.Linux.Mirai.bik
huorong Trojan/Linux.Mirai.g
Fortinet ELF/Mirai.BTS!tr
AVG ELF:Agent-AYQ [Trj]
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.