Linux Analysis Report
SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf

Overview

General Information

Sample name: SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf
Analysis ID: 1487426
MD5: d84f107a031221fadf8c8c5033ae1b70
SHA1: b6986bb329f9787bd4799879782c4e17c68055a5
SHA256: 02d004bb6c7c3ffdfea5412a2dd46b2ba92d9ab716bb3088be171839b8199f68
Tags: elf
Infos:

Detection

Mirai
Score: 76
Range: 0 - 100
Whitelisted: false

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample is packed with UPX
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Sample contains only a LOAD segment without any section mappings
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf ReversingLabs: Detection: 42%
Source: SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf Virustotal: Detection: 31% Perma Link
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.23:40862 -> 94.156.67.132:9506
Sample listens on a socket
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6227) Socket: 0.0.0.0:23 Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6227) Socket: 0.0.0.0:0 Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6227) Socket: 0.0.0.0:80 Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6227) Socket: 0.0.0.0:81 Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6227) Socket: 0.0.0.0:8443 Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6227) Socket: 0.0.0.0:9009 Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) Socket: 0.0.0.0:0 Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) Socket: 0.0.0.0:80 Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) Socket: 0.0.0.0:81 Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) Socket: 0.0.0.0:8443 Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) Socket: 0.0.0.0:9009 Jump to behavior
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Source: global traffic TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: unknown TCP traffic detected without corresponding DNS query: 27.80.62.18
Source: unknown TCP traffic detected without corresponding DNS query: 18.3.238.181
Source: unknown TCP traffic detected without corresponding DNS query: 202.251.13.187
Source: unknown TCP traffic detected without corresponding DNS query: 220.232.29.183
Source: unknown TCP traffic detected without corresponding DNS query: 100.180.189.166
Source: unknown TCP traffic detected without corresponding DNS query: 36.107.17.178
Source: unknown TCP traffic detected without corresponding DNS query: 45.146.142.248
Source: unknown TCP traffic detected without corresponding DNS query: 43.189.168.85
Source: unknown TCP traffic detected without corresponding DNS query: 206.113.102.161
Source: unknown TCP traffic detected without corresponding DNS query: 92.246.215.23
Source: unknown TCP traffic detected without corresponding DNS query: 120.219.232.98
Source: unknown TCP traffic detected without corresponding DNS query: 134.238.179.255
Source: unknown TCP traffic detected without corresponding DNS query: 192.37.51.78
Source: unknown TCP traffic detected without corresponding DNS query: 85.44.47.11
Source: unknown TCP traffic detected without corresponding DNS query: 34.6.140.150
Source: unknown TCP traffic detected without corresponding DNS query: 108.42.89.196
Source: unknown TCP traffic detected without corresponding DNS query: 158.67.24.72
Source: unknown TCP traffic detected without corresponding DNS query: 108.167.149.234
Source: unknown TCP traffic detected without corresponding DNS query: 204.77.25.248
Source: unknown TCP traffic detected without corresponding DNS query: 155.128.52.7
Source: unknown TCP traffic detected without corresponding DNS query: 23.198.255.242
Source: unknown TCP traffic detected without corresponding DNS query: 36.134.213.225
Source: unknown TCP traffic detected without corresponding DNS query: 96.238.100.237
Source: unknown TCP traffic detected without corresponding DNS query: 120.18.34.207
Source: unknown TCP traffic detected without corresponding DNS query: 9.207.20.210
Source: unknown TCP traffic detected without corresponding DNS query: 175.80.21.94
Source: unknown TCP traffic detected without corresponding DNS query: 202.229.9.33
Source: unknown TCP traffic detected without corresponding DNS query: 80.113.109.240
Source: unknown TCP traffic detected without corresponding DNS query: 108.40.255.67
Source: unknown TCP traffic detected without corresponding DNS query: 200.178.105.90
Source: unknown TCP traffic detected without corresponding DNS query: 122.115.161.15
Source: unknown TCP traffic detected without corresponding DNS query: 101.192.125.88
Source: unknown TCP traffic detected without corresponding DNS query: 5.17.29.29
Source: unknown TCP traffic detected without corresponding DNS query: 243.105.222.224
Source: unknown TCP traffic detected without corresponding DNS query: 116.71.189.94
Source: unknown TCP traffic detected without corresponding DNS query: 8.21.30.82
Source: unknown TCP traffic detected without corresponding DNS query: 119.48.117.117
Source: unknown TCP traffic detected without corresponding DNS query: 81.53.138.82
Source: unknown TCP traffic detected without corresponding DNS query: 162.141.78.5
Source: unknown TCP traffic detected without corresponding DNS query: 191.133.205.148
Source: unknown TCP traffic detected without corresponding DNS query: 65.54.17.145
Source: unknown TCP traffic detected without corresponding DNS query: 166.176.28.173
Source: unknown TCP traffic detected without corresponding DNS query: 53.4.140.139
Source: unknown TCP traffic detected without corresponding DNS query: 5.242.224.235
Source: unknown TCP traffic detected without corresponding DNS query: 89.240.150.4
Source: unknown TCP traffic detected without corresponding DNS query: 84.112.167.252
Source: unknown TCP traffic detected without corresponding DNS query: 34.81.121.78
Source: unknown TCP traffic detected without corresponding DNS query: 182.31.29.39
Source: unknown TCP traffic detected without corresponding DNS query: 184.137.145.202
Source: unknown TCP traffic detected without corresponding DNS query: 221.70.141.158
Source: SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf String found in binary or memory: http://upx.sf.net
Source: unknown Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6225.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6225.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6229.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6229.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 6235.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6235.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Sample contains only a LOAD segment without any section mappings
Source: LOAD without section mappings Program segment: 0x100000
Sample tries to kill a process (SIGKILL)
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6227) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) SIGKILL sent: pid: 936, result: successful Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) SIGKILL sent: pid: 6227, result: successful Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) SIGKILL sent: pid: 759, result: successful Jump to behavior
Yara signature match
Source: 6225.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6225.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6229.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6229.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 6235.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6235.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: classification engine Classification label: mal76.troj.evad.linELF@0/0@0/0

Data Obfuscation
barindex
Sample is packed with UPX
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
Enumerates processes within the "proc" file system
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2033/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2033/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1582/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1582/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2275/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1612/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1612/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1579/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1579/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1699/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1699/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1335/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1335/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1698/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1698/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2028/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2028/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1334/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1334/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1576/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1576/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2302/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/3236/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2025/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2025/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2146/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/6227/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/910/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/912/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/912/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/912/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/759/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/759/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/759/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/517/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2307/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/918/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/918/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/918/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1594/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1594/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2285/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2281/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1349/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1349/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1623/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1623/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/761/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/761/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/761/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1622/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1622/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/884/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/884/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/884/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1983/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1983/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2038/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2038/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1586/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1586/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1465/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1465/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1344/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1344/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1860/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1860/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1463/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1463/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2156/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/800/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/800/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/800/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/801/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/801/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/801/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1629/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1629/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1627/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1627/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1900/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1900/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/491/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/491/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/491/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2294/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2050/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/2050/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1877/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1877/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/772/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/772/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/772/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1633/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1633/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1599/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1599/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1632/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1632/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1477/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/1477/exe Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/774/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/774/fd Jump to behavior
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6233) File opened: /proc/774/exe Jump to behavior
ELF contains segments with high entropy indicating compressed/encrypted content
Source: SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf Submission file: segment LOAD with 7.9276 entropy (max. 8.0)
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf (PID: 6225) Queries kernel information via 'uname': Jump to behavior
Source: SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf, 6225.1.000055bf3177f000.000055bf31827000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf, 6229.1.000055bf3177f000.000055bf31827000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf, 6235.1.000055bf3177f000.000055bf31827000.rw-.sdmp Binary or memory string: U!/etc/qemu-binfmt/mips
Source: SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf, 6225.1.000055bf3177f000.000055bf31827000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf, 6229.1.000055bf3177f000.000055bf31827000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf, 6235.1.000055bf3177f000.000055bf31827000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/mips
Source: SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf, 6225.1.00007ffd473f1000.00007ffd47412000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf, 6229.1.00007ffd473f1000.00007ffd47412000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf, 6235.1.00007ffd473f1000.00007ffd47412000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf
Source: SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf, 6225.1.00007ffd473f1000.00007ffd47412000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf, 6229.1.00007ffd473f1000.00007ffd47412000.rw-.sdmp, SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf, 6235.1.00007ffd473f1000.00007ffd47412000.rw-.sdmp Binary or memory string: /usr/bin/qemu-mips

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: 6225.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6229.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6235.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf PID: 6225, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf PID: 6229, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Mirai
Source: Yara match File source: 6225.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6229.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: 6235.1.00007f4ea0400000.00007f4ea0421000.r-x.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf PID: 6225, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf PID: 6229, type: MEMORYSTR
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
59.42.177.199
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
178.234.54.84
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
139.170.164.89
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
84.98.226.158
 unknown France
15557 LDCOMNETFR false
181.132.105.252
 unknown Colombia
13489 EPMTelecomunicacionesSAESPCO false
251.249.160.195
 unknown Reserved
unknown unknown false
43.68.87.229
 unknown Japan 4249 LILLY-ASUS false
90.86.127.154
 unknown France
3215 FranceTelecom-OrangeFR false
217.205.123.205
 unknown United Kingdom
4589 EASYNETEasynetGlobalServicesEU false
247.20.186.144
 unknown Reserved
unknown unknown false
147.45.234.215
 unknown Russian Federation
2895 FREE-NET-ASFREEnetEU false
125.88.89.29
 unknown China
4813 BACKBONE-GUANGDONG-APChinaTelecomGroupCN false
82.215.163.167
 unknown Italy
34606 ASN-BBBELLIT false
14.1.76.192
 unknown New Zealand
18199 LINKTELECOM-NZ-APLinkTelecomNZLimitedNZ false
78.226.108.72
 unknown France
12322 PROXADFR false
106.216.220.13
 unknown India
45609 BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService false
202.178.223.195
 unknown Taiwan; Republic of China (ROC)
17709 APTAsiaPacificTelecomTW false
77.87.151.60
 unknown Ukraine
29107 SYNAPSE-ASUA false
44.11.16.24
 unknown United States
7377 UCSDUS false
53.190.234.224
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
122.197.113.115
 unknown Japan 9617 ZAQJupiterTelecommunicationsCoLtdJP false
181.141.157.166
 unknown Colombia
13489 EPMTelecomunicacionesSAESPCO false
167.70.99.184
 unknown United States
4583 WESTPUB-AUS false
152.45.234.132
 unknown United States
81 NCRENUS false
245.111.205.175
 unknown Reserved
unknown unknown false
143.10.148.22
 unknown United States
11003 PANDGUS false
75.36.239.132
 unknown United States
7018 ATT-INTERNET4US false
122.94.126.3
 unknown China
9394 CTTNETChinaTieTongTelecommunicationsCorporationCN false
107.175.9.129
 unknown United States
20278 NEXEONUS false
23.69.75.143
 unknown United States
7922 COMCAST-7922US false
159.206.239.168
 unknown Canada
16793 DATA-TRONICSUS false
197.144.80.234
 unknown Morocco
36884 MAROCCONNECTMA false
166.15.255.80
 unknown Switzerland
11798 ACEDATACENTERS-AS-1US false
221.99.229.43
 unknown Japan 17676 GIGAINFRASoftbankBBCorpJP false
17.35.31.215
 unknown United States
714 APPLE-ENGINEERINGUS false
221.139.221.33
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR false
1.13.112.135
 unknown China
13335 CLOUDFLARENETUS false
153.75.126.64
 unknown United States
14962 NCR-252US false
8.163.215.215
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
185.65.144.43
 unknown United Kingdom
201358 FNZ-UKGB false
36.45.72.53
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
206.60.23.188
 unknown United States
8014 BATELNETBS false
210.69.126.21
 unknown Taiwan; Republic of China (ROC)
4782 GSNETDataCommunicationBusinessGroupTW false
210.255.149.169
 unknown Japan 2516 KDDIKDDICORPORATIONJP false
145.109.4.233
 unknown Netherlands
1124 UVA-NLUniversiteitvanAmsterdamEU false
92.71.5.181
 unknown Netherlands
286 KPNNL false
179.47.173.60
 unknown Venezuela
22927 TelefonicadeArgentinaAR false
57.242.95.189
 unknown Belgium
2686 ATGS-MMD-ASUS false
101.57.199.5
 unknown Italy
210278 SKYIT-BBIT false
90.201.235.100
 unknown United Kingdom
5607 BSKYB-BROADBAND-ASGB false
255.102.120.68
 unknown Reserved
unknown unknown false
38.11.161.217
 unknown United States
174 COGENT-174US false
77.196.5.41
 unknown France
15557 LDCOMNETFR false
141.47.94.72
 unknown Germany
553 BELWUEBelWue-KoordinationEU false
155.242.144.37
 unknown United States
11845 Vox-TelecomZA false
157.86.12.198
 unknown Brazil
21612 FUNDACAOINSTITUTOOSWALDOCRUZBR false
193.205.14.83
 unknown Italy
137 ASGARRConsortiumGARREU false
141.222.141.239
 unknown United States
46470 SKIDMORE-I2-ASUS false
248.178.12.214
 unknown Reserved
unknown unknown false
130.236.106.32
 unknown Sweden
2843 LIUNETSE false
8.56.43.32
 unknown United States
3356 LEVEL3US false
109.134.50.111
 unknown Belgium
5432 PROXIMUS-ISP-ASBE false
194.42.215.59
 unknown United Kingdom
12545 TRANSCOMUA false
216.48.181.31
 unknown United States
26929 DOLLAR-PHONE-CORP-SUPERNETUS false
204.204.217.152
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
68.83.50.110
 unknown United States
7922 COMCAST-7922US false
71.197.168.11
 unknown United States
7922 COMCAST-7922US false
145.132.27.185
 unknown Netherlands
1136 KPNKPNNationalEU false
58.145.201.196
 unknown Japan 4637 ASN-TELSTRA-GLOBALTelstraGlobalHK false
99.79.219.225
 unknown United States
16509 AMAZON-02US false
61.21.7.195
 unknown Japan 9824 JTCL-JP-ASJupiterTelecommunicationCoLtdJP false
173.209.11.54
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
108.37.65.108
 unknown United States
701 UUNETUS false
53.49.108.164
 unknown Germany
31399 DAIMLER-ASITIGNGlobalNetworkDE false
133.82.171.97
 unknown Japan 2907 SINET-ASResearchOrganizationofInformationandSystemsN false
8.159.149.254
 unknown Singapore
37963 CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd false
202.206.246.91
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
220.199.37.233
 unknown China
17816 CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi false
17.246.239.114
 unknown United States
714 APPLE-ENGINEERINGUS false
182.201.61.245
 unknown China
134762 CHINANET-LIAONING-DALIAN-MANCHINANETLiaoningprovinceDali false
135.134.3.82
 unknown United States
14962 NCR-252US false
182.164.249.114
 unknown Japan 17511 OPTAGEOPTAGEIncJP false
76.10.110.240
 unknown United States
14090 NDTELCOUS false
76.91.213.27
 unknown United States
20001 TWC-20001-PACWESTUS false
40.244.52.111
 unknown United States
4249 LILLY-ASUS false
113.119.101.76
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
14.61.53.243
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
223.128.147.211
 unknown China
4538 ERX-CERNET-BKBChinaEducationandResearchNetworkCenter false
146.110.115.237
 unknown Hungary
25171 BKAENET-ASBudapestUniversityofEconomicSciencesandPubl false
82.179.224.236
 unknown Russian Federation
8398 TVERSURussiaTverRU false
195.102.173.191
 unknown United Kingdom
8426 CLARANET-ASClaraNETLTDGB false
31.234.115.216
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
94.16.168.104
 unknown Switzerland
15600 FINECOMQuicklineAGCH false
190.244.213.9
 unknown Argentina
10318 TelecomArgentinaSAAR false
173.70.80.240
 unknown United States
701 UUNETUS false
68.9.201.124
 unknown United States
22773 ASN-CXA-ALL-CCI-22773-RDCUS false
201.206.184.125
 unknown Costa Rica
11830 InstitutoCostarricensedeElectricidadyTelecomCR false
178.164.106.133
 unknown Norway
34087 NTE-BREDBANDNIX1OsloNorwayNO false
69.31.168.62
 unknown Canada
30295 2ICSYSTEMSINCCA false
96.250.157.221
 unknown United States
701 UUNETUS false