Malware analysis Space.x86_64 Malicious activity | ANY.RUN

Add for printing

File name:	Space.x86_64
Full analysis:	https://app.any.run/tasks/9e54871c-693a-4cc3-a999-420127680d66
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	May 10, 2025, 06:52:03
OS:	Ubuntu 22.04.2
Tags:	mirai botnet
Indicators:
MIME:	application/x-executable
File info:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
MD5:	844C951E0BF8B983FBB745F7FAEF7367
SHA1:	37A79121DE6D87453C4055EDDA17CE4BEDD73C99
SHA256:	C442D1BC17D2460B912798F3E323165F4B46660859C4D180CD932B3F052CCD90
SSDEEP:	768:BGYSKf1YrZGQgFoLLqv4mdiUZBQALQpbnhilmfeQxs6adFf:BGYFfmtvFIZwilBQq6cFf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- MIRAI has been detected (SURICATA)
  - Space.x86_64.elf (PID: 40666)
  - Space.x86_64.elf (PID: 40672)
SUSPICIOUS
- Executes commands using command-line interpreter
  - sudo (PID: 40661)
- Reads profile file
  - Space.x86_64.elf (PID: 40662)
- Modifies file or directory owner
  - sudo (PID: 40658)
- Reads passwd file
  - Space.x86_64.elf (PID: 40662)
- Contacting a server suspected of hosting an CnC
  - Space.x86_64.elf (PID: 40666)
  - Space.x86_64.elf (PID: 40672)
- Connects to unusual port
  - Space.x86_64.elf (PID: 40666)
  - Space.x86_64.elf (PID: 40672)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (100)

EXIF

EXE

CPUArchitecture:	64 bit
CPUByteOrder:	Little endian
ObjectFileType:	Executable file
CPUType:	AMD x86-64

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

235

Monitored processes

15

Malicious processes

6

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
40657	/bin/sh -c "sudo chown user /tmp/Space\.x86_64\.elf && chmod +x /tmp/Space\.x86_64\.elf && DISPLAY=:0 sudo -iu user /tmp/Space\.x86_64\.elf "	/usr/bin/dash	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
40658	sudo chown user /tmp/Space.x86_64.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40659	chown user /tmp/Space.x86_64.elf	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
40660	chmod +x /tmp/Space.x86_64.elf	/usr/bin/chmod	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40661	sudo -iu user /tmp/Space.x86_64.elf	/usr/bin/sudo	—	dash
User: root Integrity Level: UNKNOWN Exit code: 0
40662	/tmp/Space.x86_64.elf	/tmp/Space.x86_64.elf	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
40663	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	Space.x86_64.elf
User: user Integrity Level: UNKNOWN Exit code: 0
40664	/tmp/Space.x86_64.elf	/tmp/Space.x86_64.elf	—	Space.x86_64.elf
User: user Integrity Level: UNKNOWN Exit code: 0
40665	/tmp/Space.x86_64.elf	/tmp/Space.x86_64.elf	—	Space.x86_64.elf
User: user Integrity Level: UNKNOWN Exit code: 0
40666	/tmp/Space.x86_64.elf	/tmp/Space.x86_64.elf		Space.x86_64.elf
User: user Integrity Level: UNKNOWN

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

No data

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

56

DNS requests

11

Threats

16

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.96:80	http://connectivity-check.ubuntu.com/	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.96:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	whitelisted
484	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
1178	snap-store	37.19.194.81:443	odrs.gnome.org	Datacamp Limited	DE	whitelisted
40666	Space.x86_64.elf	77.239.125.252:3778	—	Six Degrees Technology Group Limited	GB	unknown
512	snapd	185.125.188.58:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
512	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	whitelisted
40672	Space.x86_64.elf	77.239.125.252:3778	—	Six Degrees Technology Group Limited	GB	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	91.189.91.96 185.125.190.49 91.189.91.98 91.189.91.49 91.189.91.48 185.125.190.17 185.125.190.98 185.125.190.48 185.125.190.18 185.125.190.97 185.125.190.96 2620:2d:4000:1::98 2620:2d:4000:1::23 2001:67c:1562::24 2620:2d:4002:1::198 2620:2d:4000:1::22 2620:2d:4002:1::196 2620:2d:4000:1::2b 2001:67c:1562::23 2620:2d:4000:1::97 2620:2d:4000:1::96 2620:2d:4000:1::2a	whitelisted
google.com	142.250.181.238 2a00:1450:4001:82b::200e	whitelisted
odrs.gnome.org	37.19.194.81 169.150.255.184 212.102.56.178 195.181.175.40 207.211.211.27 195.181.170.18 169.150.255.181 2a02:6ea0:c700::107 2a02:6ea0:c700::101 2a02:6ea0:c700::21 2a02:6ea0:c700::112 2a02:6ea0:c700::19 2a02:6ea0:c700::11 2a02:6ea0:c700::18	whitelisted
api.snapcraft.io	185.125.188.58 185.125.188.54 185.125.188.57 185.125.188.59 2620:2d:4000:1010::42 2620:2d:4000:1010::2e6 2620:2d:4000:1010::344 2620:2d:4000:1010::117	whitelisted
5.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)
—	—	Malware Command and Control Activity Detected	BOTNET [ANY.RUN] Possible Mirai.Gen (Linux)

Add for printing

No debug info

General Info

Space.x86_64

844C951E0BF8B983FBB745F7FAEF7367

37A79121DE6D87453C4055EDDA17CE4BEDD73C99

C442D1BC17D2460B912798F3E323165F4B46660859C4D180CD932B3F052CCD90

768:BGYSKf1YrZGQgFoLLqv4mdiUZBQALQpbnhilmfeQxs6adFf:BGYFfmtvFIZwilBQq6cFf

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

MIRAI has been detected (SURICATA)

SUSPICIOUS

Executes commands using command-line interpreter

Reads profile file

Modifies file or directory owner

Reads passwd file

Contacting a server suspected of hosting an CnC

Connects to unusual port

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings